Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
13/08/2024, 16:59
General
-
Target
GSClient_Setup_CS_1_6.exe
-
Size
263.1MB
-
MD5
c7067a7d7a096da7f12c5b0577ce1eda
-
SHA1
1c989db53e9a3e6c38e4a4d44a8dd572f6a31e5d
-
SHA256
9cc115b0e4a690b1d82a0e4ada34defb19c1bd246a45ba56295a3fbde0abe158
-
SHA512
f64b6f53386abd4455d9df2db49ecf980f9358c3ad0b79cc553e66404421d98f23d28272c2275362ad95fe84b0ef6389be0dcff575f8497bcb63feb3bf0b5823
-
SSDEEP
6291456:7UMXs+AiZ+VZXO+R/juaKFG3CX6whYIHxZJPN7kkI8u:QCGzO+R7wG3CKwhpxNIRL
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 13 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\GSClient_Setup_CS_1_6.exe"C:\Users\Admin\AppData\Local\Temp\GSClient_Setup_CS_1_6.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-D70P2.tmp\GSClient_Setup_CS_1_6.tmp"C:\Users\Admin\AppData\Local\Temp\is-D70P2.tmp\GSClient_Setup_CS_1_6.tmp" /SL5="$400EC,275247376,249344,C:\Users\Admin\AppData\Local\Temp\GSClient_Setup_CS_1_6.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD58e42b787972ceab134ed881797801a4c
SHA15bf3a7e93ff12fde20dfef9d2669e48f46afc955
SHA256b0ccd219bf17a4e3f489f9cdacfcf7db1bed5680952e552b050b89ed62032d7c
SHA512296ff18c493a9c070ca19965003481b01dae6bd8227f3b36d296540f6a710c5d094f9f0f5df79291be1382d862ebc99d5f982c4a7f210b2e789ef9396dc8bfdb
-
Filesize
3.0MB
MD5b0ca93ceb050a2feff0b19e65072bbb5
SHA17ebbbbe2d2acd8fd516f824338d254a33b69f08d
SHA2560e93313f42084d804b9ac4be53d844e549cfcaf19e6f276a3b0f82f01b9b2246
SHA51237242423e62af30179906660c6dbbadca3dc2ba9e562f84315a69f3114765bc08e88321632843dbd78ba1728f8d1ce54a4edfa3b96a9d13e540aee895ae2d8e2
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
1.2MB
-
Filesize
3.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
284KB
-
Filesize
68KB
-
Filesize
284KB