Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
136s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
02/09/2024, 13:54
Static task
static1
Behavioral task
behavioral1
Sample
Premier-Setup.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
Premier-Setup.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
Premier-Setup.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral4
Sample
Premier-Setup.exe
Resource
win11-20240802-en
General
-
Target
Premier-Setup.exe
-
Size
11.5MB
-
MD5
697d58ea071c6e6c0fe13e9a7f3833b2
-
SHA1
1cf095f10fb5ed9527815df78f96418c97899eb5
-
SHA256
44d0da69a6a1e723b6393a5bc21be27552914736ea16e292262265fb7839db66
-
SHA512
7a7b4df64b0a10369f8c127a5f2587eb98fde03aaf57daf6b8a0f71f8fcb92422d1a7c494ad8442e37369f1a49dbc87e7a683a95c21c02cf2ef28fb3b811b365
-
SSDEEP
98304:6pyO7tfOvQc4nPqCTUpo49RP6/XJ83CeKAdVHEpyWuoaSjkLR7AM:OfvCCTUpo49RyfJ83CeKIEg1o7M
Malware Config
Extracted
lumma
https://disappointypsm.shop/api
https://locatedblsoqp.shop/api
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4588 set thread context of 2336 4588 Premier-Setup.exe 73 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Premier-Setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BitLockerToGo.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4588 wrote to memory of 2336 4588 Premier-Setup.exe 73 PID 4588 wrote to memory of 2336 4588 Premier-Setup.exe 73 PID 4588 wrote to memory of 2336 4588 Premier-Setup.exe 73 PID 4588 wrote to memory of 2336 4588 Premier-Setup.exe 73 PID 4588 wrote to memory of 2336 4588 Premier-Setup.exe 73 PID 4588 wrote to memory of 2336 4588 Premier-Setup.exe 73 PID 4588 wrote to memory of 2336 4588 Premier-Setup.exe 73 PID 4588 wrote to memory of 2336 4588 Premier-Setup.exe 73 PID 4588 wrote to memory of 2336 4588 Premier-Setup.exe 73
Processes
-
C:\Users\Admin\AppData\Local\Temp\Premier-Setup.exe"C:\Users\Admin\AppData\Local\Temp\Premier-Setup.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"2⤵
- System Location Discovery: System Language Discovery
PID:2336
-