Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04/10/2024, 12:14
Static task
static1
Behavioral task
behavioral1
Sample
Set-up.exe
Resource
win7-20240903-en
General
-
Target
Set-up.exe
-
Size
9.6MB
-
MD5
b8660079898d3de03e6545c6083d4889
-
SHA1
2309d43ab2adf9f8ba701725a8a9fe5e6690087a
-
SHA256
c53ac9f977cc5054bfd42ed1ccb631047c902bedea0670cb8e3c80b13462d785
-
SHA512
41e060b3358045a81d6bb3781230f74951eed3237f433a47445dc43619146735ab60f479294629b80b1ba7984902811a6419f7041ca5c127375c671777ae33ea
-
SSDEEP
24576:6efrBW/UoV7vYnRRsEraYE0alT/+jA0i3w05rOA+A401Qwhpsh+Txlwdb+fkVtwx:IVMRsJfxlCTmd4DOfY/hqiHx8oO6S
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2584 service123.exe 2360 service123.exe 772 service123.exe -
Loads dropped DLL 5 IoCs
pid Process 2084 Set-up.exe 2084 Set-up.exe 2584 service123.exe 2360 service123.exe 772 service123.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Set-up.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Set-up.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Set-up.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3032 schtasks.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2084 wrote to memory of 2584 2084 Set-up.exe 31 PID 2084 wrote to memory of 2584 2084 Set-up.exe 31 PID 2084 wrote to memory of 2584 2084 Set-up.exe 31 PID 2084 wrote to memory of 2584 2084 Set-up.exe 31 PID 2084 wrote to memory of 3032 2084 Set-up.exe 32 PID 2084 wrote to memory of 3032 2084 Set-up.exe 32 PID 2084 wrote to memory of 3032 2084 Set-up.exe 32 PID 2084 wrote to memory of 3032 2084 Set-up.exe 32 PID 2464 wrote to memory of 2360 2464 taskeng.exe 35 PID 2464 wrote to memory of 2360 2464 taskeng.exe 35 PID 2464 wrote to memory of 2360 2464 taskeng.exe 35 PID 2464 wrote to memory of 2360 2464 taskeng.exe 35 PID 2464 wrote to memory of 772 2464 taskeng.exe 37 PID 2464 wrote to memory of 772 2464 taskeng.exe 37 PID 2464 wrote to memory of 772 2464 taskeng.exe 37 PID 2464 wrote to memory of 772 2464 taskeng.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\Set-up.exe"C:\Users\Admin\AppData\Local\Temp\Set-up.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\service123.exe"C:\Users\Admin\AppData\Local\Temp\service123.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2584
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3032
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {D1ED4BD9-FD6C-4D4F-9F92-97ACE74758B3} S-1-5-21-3533259084-2542256011-65585152-1000:XPAJOTIY\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\service123.exeC:\Users\Admin\AppData\Local\Temp\/service123.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2360
-
-
C:\Users\Admin\AppData\Local\Temp\service123.exeC:\Users\Admin\AppData\Local\Temp\/service123.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:772
-