Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
303s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
28/09/2024, 15:48
General
-
Target
libusbK-3.1.0.0-setup-debug.exe
-
Size
8.1MB
-
MD5
2b633874de9f173c45b4782ce9a30998
-
SHA1
809a1f303f25bb13866350a55e9e26378f9b2af4
-
SHA256
5271ca2b083f11fa359740d3c712fda868f90b6becd308a4e89d9ba103a03cc6
-
SHA512
e2467140d27de5f595bb6bca7dbdd679cf5549f8ef07f080dbe209a48161ecef4a58bc2fd60c043da2da0309fa319bbe17833bdd31dc7f9344807456c8f8090b
-
SSDEEP
196608:gBnxBt7J7P76jwXzQ+bargIltIAUGU2mrrTl/NC1TdyFlv+9lB:GxJU+lygIIKmPTRgNdyi
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
-
Executes dropped EXE 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 8 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks SCSI registry key(s) 3 TTPs 40 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\libusbK-3.1.0.0-setup-debug.exe"C:\Users\Admin\AppData\Local\Temp\libusbK-3.1.0.0-setup-debug.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-99OOO.tmp\libusbK-3.1.0.0-setup-debug.tmp"C:\Users\Admin\AppData\Local\Temp\is-99OOO.tmp\libusbK-3.1.0.0-setup-debug.tmp" /SL5="$2101DE,8231457,58368,C:\Users\Admin\AppData\Local\Temp\libusbK-3.1.0.0-setup-debug.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
-
C:\libusbK-dev-kit\install-filter-win.exe"C:\libusbK-dev-kit\install-filter-win.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
702KB
MD51afbd25db5c9a90fe05309f7c4fbcf09
SHA1baf330b5c249ca925b4ea19a52fe8b2c27e547fa
SHA2563bb0ee5569fe5453c6b3fa25aa517b925d4f8d1f7ba3475e58fa09c46290658c
SHA5123a448f06862c6d163fd58b68b836d866ae513e04a69774abf5a0c5b7df74f5b9ee37240083760185618c5068bf93e7fd812e76b3e530639111fb1d74f4d28419
-
Filesize
189KB
MD50c9a37b639b174d64c031ae77871508a
SHA174adf178435766f074c97711d0da38a61964bcc5
SHA2561344fff0a613bd5febd240efbc0acc7941fc969c4d74ce79fdd96fd503c526f4
SHA5120a104ec1a874d9711d1fb088071ca30ab4cd15d03b888cbd13b89f19059e90ffe218db061f4441799297a447eff3d756277dde971877e5d05f6909332e996f56
-
Filesize
159KB
MD55eacf85f31530f6daf83e193a63fba8d
SHA12a838aba0658fd079db731df675c87a31f89e8ff
SHA25629746359cf49dd87375730b2fc2e24c8586479b65de4295aad8c60f23a37179c
SHA5124aea4306d2784934aee58d4c25d913650de06346500ec64b88f6c2f70521f784230a255853253b39f4d9e489404adadd222b626a468d5f0dd43cf1ad68f06416
-
Filesize
153KB
MD59453b6314567d59bc29e311aaf49f057
SHA10d498098f0de6d35369d89a2a7d9dcebaac2f848
SHA2561d4adabaeda15954be06167cb259e4939566164563a22500d3404dafe5e74c6a
SHA512e19c4e3beeb6bfab89eae617d638bb2e750e40fcdba603bb79c2e279122f6a78176cdbf2b409bad180ba63952d6ffa3aa782fcd0fae44364256df61e4e3157a9
-
Filesize
3KB
MD57f0b2ba7b5fd5ef25cb1d9b4a0fbd08c
SHA12feca4ba5ed6b3d0dedf490a9063cb7ab9430790
SHA25673fff5e6442123a6073f15829625f979403d8680fbeb4ed7da7de27264ba2a54
SHA512b86e9fa40f0403899ac0a32f4b0647cd88109f807dd9d10178ff86f80714ae44c9ec84ed6dbebf253c17650ee21f6485d5d106f3d01c59605a985cc9f97457cc
-
Filesize
2KB
MD5e5545764e68d62a7f04688bb0b9512aa
SHA108d40aedf477a62efb9c0ab6835396973e703d44
SHA2568fb75d9a180f99a6f5166fedd5261b16778623da46f46df2aed3ea23de330ba0
SHA512950fd158467b142869adc7a6c84a11bf9e474abf2587cab5dd9c63e3b299e812e07eda7c8600118138d74c1c441c6b15bf11bccc693e8b6202db4d71121636ac
-
Filesize
20KB
MD5b38491f7835fdef5d2e23aa582926147
SHA13eabd99f8e0f3fab49d501dac0f56cb63904bbcd
SHA25658574353c248d092a93db6c2925617ec7f4e1c72da4c3723419fefef76d88c6a
SHA512010322c874b9332f223482d4bb4a5afaaf34d296f369c43d6d79093730f0cfeee48e030b802518cafbe23f368f4bac0e19772eb8066df1cbef950492fd643ec1
-
Filesize
249B
MD58c0f00d7d9b0046695a0255f1b11b061
SHA15e1d04de66ffcc5dfd813530ab6992e6daaae417
SHA256f6a4290723520caddd934b8800319c7ca6cc7eeab647059ec89b7a13b1513265
SHA512a95c07dc3241b7c9f37b7f0a5c143c9c133c3bcbfa16e4a689cf47f45b3e9d0ccf5c965143a6848237e7a9fa8deecb89837dc12b12fabd8231fe94f3ccba26aa
-
Filesize
5KB
MD50cd8c971317d19bbed44757809bcb92b
SHA147b15748ecc8e952c5935170090db7c269ce4b4f
SHA25666b5ebd1b0fc73f041ba669ce2184f6f471d5e3524efa34ca31233e9f5395262
SHA512883dba84bf7daae3ea49f9d54c13dda4f125da82ba63f90eeba0900602896ad9492a0adf7b69b67d838034090af20926af5c2934797afaadb38aa069786c1fc6
-
Filesize
6KB
MD52c3b5a7333bb87ff8427b91945d751aa
SHA11c4358dca057b00006ed90c0ffca5a5971e2adcd
SHA2567e7254a4b5c7059afa2a0707554ba94073b46f6c01eb0ecc0187a2ac7e487ccb
SHA51277ac9c61fdfdcba397324d239265811245d147f54808a972ef03e1e364c8e702fd4af3d7d853254ccaf9be6b9d7cdcf49c1993ce03f892fa68196ff54fd03ac8
-
Filesize
62KB
MD5e137d49ea7f9056af173ba6bbab25ec1
SHA1fc6c288a714129da27d6833607bb57021fa00a80
SHA2568a2834f927c543d0025746c76cd8ebc3d8b4398e5a50d64f60288244008145dc
SHA51212f858455166e7f53befbd9156266565034f22e105bab830df588c6daf75decd4a43033a453f41cefe8df2c6f5ddd2103c0500fcaa5ba9973ab11038fdb7919d
-
Filesize
84KB
-
Filesize
44KB
-
Filesize
84KB
-
Filesize
84KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
764KB