Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
14/09/2024, 17:01
General
-
Target
setup-ttdown.exe
-
Size
89.5MB
-
MD5
f51e4fc121e79e1ed3684282c1361857
-
SHA1
b9b040f34fe46dc7515ef56215a387c0a53d5af9
-
SHA256
2efa6773e89296e5b5fc3e6a92640efa95ae400977767ed59047692c72ade8ed
-
SHA512
51d0fb1835cd4a32003a2acd988413916e1016df92e887c1ed6b761d0a44da2368c7031ebf297df20966a4f6bab2dc5ce05733b3d89f4c5d3f4063658733ce14
-
SSDEEP
1572864:Zs0D4yiOUCTaTBIENm/t/hRf/iWA61S30fmFJMajGJ4qR4oHbmi9LipJR4PFjs0i:ZZHiOhTa1v+tnFQk+oaCSi9Wmjs08D
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
UPX packed file 17 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in System32 directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup-ttdown.exe"C:\Users\Admin\AppData\Local\Temp\setup-ttdown.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\talio.exe"C:\Users\Admin\AppData\Local\Temp\talio.exe" C:\Users\Admin\AppData\Local\Temp\talio.mp32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x41c 0x4b41⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD5756c38bddf52b077812975e8c4e8ceba
SHA18fc93e1afe8717bd64d0d37e51c1fe457aef1a4f
SHA2562b5789f575ff17383227305b7432f0837d1802a8e51263d9ed9ca7fe1150b9e7
SHA512c9cc365021885a8af4064923435aea1975fa2626c68e18cc57cdd382c097e7d4513e50eed9f8a9eaebdc82f19b22ea1bcfb07d4d81c68c78516e787e187fb9a9
-
Filesize
161KB
MD5263e81631fb67194dc968dc3f4bdb4e7
SHA12998697c503a542d5cf1e25a0d0df18fcd38d66c
SHA2569200949ab6f777df957fc524d4733e2cb47b89a209c07d2be57b4c63cecbf766
SHA5122eb6fd28ba87f193a35f1c4bd4c6ff29495a3c10fea8bfa0506df97fcae5ca16f2617703137ecb32cf6b7dbd3048507dd4d0c7418845cfdce5c43896aec45dbb
-
Filesize
84KB
MD59ac1f2e22cb405eecee6d32031c223c6
SHA1ea4cbd989cf7f6a37fdb7e45d51abad1282e6809
SHA25667aea582781863b69da97bb2c861d639cb24a46cfe60f884c5c7a02d9f959c2b
SHA512372cd87bb07134f21a788e2b89748832e84a8844ac9e423f00113d14ebfeed8ee29a7cdde9ba3318422ac1826f7c378e7a84325bc1db57c0867e3a330093f2ee
-
Filesize
17KB
MD57b1d2025668327a6a502e34218dc7112
SHA1435342a1e2f36fecbd430747addc2b1edbdac06e
SHA256b35651280ae6c90f7cc7a7c9e0a45660a239d335a0fa743474bb4e6d8e7adbc3
SHA512e8cc47d9ffacec416be54570cc07342c1a72422dafe7eddcf3b54582cfa29e0ee37b21cbc0ca445542092767ebddd3a7ec96b55219d8a860f61bfc167f0df5d3
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB