Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

11/08/2024, 13:15

240811-qhjfxs1cnl 7

11/08/2024, 13:11

240811-qe2hbs1bpq 7

11/08/2024, 13:05

240811-qbzvbs1amn 7

11/08/2024, 12:58

240811-p7tshsvcma 7

Analysis

  • max time kernel
    141s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    11/08/2024, 13:05

General

  • Target

    BorderlessGaming10.0_admin_setup.exe

  • Size

    48.8MB

  • MD5

    d52cda79789a76bc6687e99a206d3ef4

  • SHA1

    3e8e1f1f17bd0c5087e26bf5b6c6f63dd110b01e

  • SHA256

    a15810bb4e49e29191ef909985a569339f0d309d65087aa3cd4f1f16eea162b0

  • SHA512

    7677362141297e7e1eab3bbeee08b6df10ba21de5ccf5232e5fa80dcb097c57f0802534a0a62bbf4a37c0c51c97d2f8cd23e432f011ea717ea8bf9d7aafb1071

  • SSDEEP

    786432:RgyfSSjla4cxOAyl45+TpT+qluCGXmsGjVfKaC93M9RHwDqmOX4Cpw85z9JYlb:RgYSSUY3l3doCGX0uUQems4CpJhJCb

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\BorderlessGaming10.0_admin_setup.exe
    "C:\Users\Admin\AppData\Local\Temp\BorderlessGaming10.0_admin_setup.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3008
    • C:\Users\Admin\AppData\Local\Temp\is-E9M69.tmp\BorderlessGaming10.0_admin_setup.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-E9M69.tmp\BorderlessGaming10.0_admin_setup.tmp" /SL5="$50150,50295133,805376,C:\Users\Admin\AppData\Local\Temp\BorderlessGaming10.0_admin_setup.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2632

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\is-E9M69.tmp\BorderlessGaming10.0_admin_setup.tmp

    Filesize

    3.0MB

    MD5

    a7f253a0b50775b6551e22b4d9a24859

    SHA1

    fd5f8d0375eace3f98e58eefbed312c4a8c1adbd

    SHA256

    78b2450bfe461841b7feb4f099fda5598d468385a548012eb902793f3a927671

    SHA512

    c44812a59ac03373d745c74a84f326d3faf52f25d0a2afa90965806958b288ebde1ce133455fc0bbe70ab2c8dbecf88459ed0cafba7ecb646531e6f8e7831a9f

  • memory/2632-9-0x0000000000400000-0x000000000070E000-memory.dmp

    Filesize

    3.1MB

  • memory/2632-11-0x0000000000400000-0x000000000070E000-memory.dmp

    Filesize

    3.1MB

  • memory/3008-0-0x0000000000400000-0x00000000004D2000-memory.dmp

    Filesize

    840KB

  • memory/3008-2-0x0000000000401000-0x00000000004B7000-memory.dmp

    Filesize

    728KB

  • memory/3008-10-0x0000000000400000-0x00000000004D2000-memory.dmp

    Filesize

    840KB