Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21/09/2024, 19:27
Static task
static1
Behavioral task
behavioral1
Sample
setup.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
setup.exe
Resource
win10v2004-20240802-en
General
-
Target
setup.exe
-
Size
3.6MB
-
MD5
7f389afca0ee092713b24ea0854f176b
-
SHA1
823eaecd0c8d0ed3c36417fdc27d25137e10d933
-
SHA256
3cbf31ab5b877c857caa6ebb25201ed7bbf1231156e794274d5d6a66d37261a1
-
SHA512
d55903d791cc8aac972c3b390bcff05028761bc029f1d684ec49322bb11e74569f9c983436aed9a3ee292bfaf4b297aac1a466f53a039b36e15bbeea3ff43748
-
SSDEEP
49152:B3t16el+n4CcPKJXjvC+cp9wUOsRrdFj7CUzBtqI5Dvc3cUpm7P8RYxtaxgYg7:RCWSxcPAX7C+2RRFjLVtP5z2Hp8WZgb7
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2532 setup.tmp -
Loads dropped DLL 7 IoCs
pid Process 2232 setup.exe 2532 setup.tmp 2532 setup.tmp 2532 setup.tmp 2532 setup.tmp 2532 setup.tmp 2532 setup.tmp -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.tmp -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2532 setup.tmp -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2532 setup.tmp -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2232 wrote to memory of 2532 2232 setup.exe 30 PID 2232 wrote to memory of 2532 2232 setup.exe 30 PID 2232 wrote to memory of 2532 2232 setup.exe 30 PID 2232 wrote to memory of 2532 2232 setup.exe 30 PID 2232 wrote to memory of 2532 2232 setup.exe 30 PID 2232 wrote to memory of 2532 2232 setup.exe 30 PID 2232 wrote to memory of 2532 2232 setup.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\is-ISJUP.tmp\setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-ISJUP.tmp\setup.tmp" /SL5="$400F4,3113320,319488,C:\Users\Admin\AppData\Local\Temp\setup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:2532
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD57b6f9b0baab46d5bc961981d6b930972
SHA199b84256c95463f14cf177ecf389a71564b97527
SHA256f94becd49ef21809536bd7cdd8c9cb3aba6b45a5e62bc4f52ca82dda949fd067
SHA512f5eb9780707ba3bf9b1e5997746224a206b4fd789600e8863d0ec0e026b8b4a8b9bde3529cb69eadea6c117f249cba71878dc437c31691a95ad6d25a0c03e0a5
-
Filesize
452KB
MD54feafa8b5e8cdb349125c8af0ac43974
SHA17f17e5e1b088fc73690888b215962fbcd395c9bd
SHA256bb8a0245dcc5c10a1c7181bad509b65959855009a8105863ef14f2bb5b38ac71
SHA512d63984ee385b4f1eba8e590d6de4f082fb0121689295ec6e496539209459152465f6db09e6d8f92eec996a89fc40432077cbfa807beb2de7f375154fef6554bc
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
4KB
MD5f07e819ba2e46a897cfabf816d7557b2
SHA18d5fd0a741dd3fd84650e40dd3928ae1f15323cc
SHA25668f42a7823ed7ee88a5c59020ac52d4bbcadf1036611e96e470d986c8faa172d
SHA5127ed26d41ead2ace0b5379639474d319af9a3e4ed2dd9795c018f8c5b9b533fd36bfc1713a1f871789bf14884d186fd0559939de511dde24673b0515165d405af
-
Filesize
16KB
MD59436df49e08c83bad8ddc906478c2041
SHA1a4fa6bdd2fe146fda2e78fdbab355797f53b7dce
SHA2561910537aa95684142250ca0c7426a0b5f082e39f6fbdbdba649aecb179541435
SHA512f9dc6602ab46d709efdaf937dcb8ae517caeb2bb1f06488c937be794fd9ea87f907101ae5c7f394c7656a6059dc18472f4a6747dcc8cc6a1e4f0518f920cc9bf