Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
3InternetInstall.exe
windows7-x64
3InternetInstall.exe
windows10-2004-x64
3CaptureNI.exe
windows7-x64
3CaptureNI.exe
windows10-2004-x64
3Receiver.exe
windows7-x64
3Receiver.exe
windows10-2004-x64
3capture.exe
windows7-x64
3capture.exe
windows10-2004-x64
3keyserver.exe
windows7-x64
3keyserver.exe
windows10-2004-x64
3Analysis
-
max time kernel
144s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03/10/2024, 23:13
Static task
static1
Behavioral task
behavioral1
Sample
InternetInstall.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
InternetInstall.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
CaptureNI.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
CaptureNI.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
Receiver.exe
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
Receiver.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
capture.exe
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
capture.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
keyserver.exe
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
keyserver.exe
Resource
win10v2004-20240802-en
General
-
Target
InternetInstall.exe
-
Size
387KB
-
MD5
972ecb1ba79e30827c965aec38f94b66
-
SHA1
c2c01dc84b8d1e47ef2ff5060915fbae84493891
-
SHA256
4556f44f293d6991c1a2e6482bdb7bc8bf193977f2a365023b4359fe68cca15d
-
SHA512
bfcf4a17bf836b140cbffd113884bac2ef3c64e996722cce358d5d49c2c1fc821e4f38a4a655c5bcc3645103e9f7123091d98eea7bafad33277c5fe3af5b8fe7
-
SSDEEP
6144:FnjSqKltz5/k9L7mFGUuRjso4E2ECHAGU2D/bp+V5mSysaVK/9:FnjC5/k9nmhuRJ41hgWD/kV5mSy/4
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language InternetInstall.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 876 InternetInstall.exe -
Suspicious use of FindShellTrayWindow 23 IoCs
pid Process 876 InternetInstall.exe 876 InternetInstall.exe 876 InternetInstall.exe 876 InternetInstall.exe 876 InternetInstall.exe 876 InternetInstall.exe 876 InternetInstall.exe 876 InternetInstall.exe 876 InternetInstall.exe 876 InternetInstall.exe 876 InternetInstall.exe 876 InternetInstall.exe 876 InternetInstall.exe 876 InternetInstall.exe 876 InternetInstall.exe 876 InternetInstall.exe 876 InternetInstall.exe 876 InternetInstall.exe 876 InternetInstall.exe 876 InternetInstall.exe 876 InternetInstall.exe 876 InternetInstall.exe 876 InternetInstall.exe