Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
62s -
max time network
66s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05/10/2024, 01:08
Static task
static1
Behavioral task
behavioral1
Sample
setup.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
setup.exe
Resource
win10v2004-20240802-en
General
-
Target
setup.exe
-
Size
3.5MB
-
MD5
2b0f0539d579adb08b12d33d8bea9cfc
-
SHA1
7d26e620c16cba0c9c2ad3ebce799316e37baaec
-
SHA256
bd1d9ec11440ba3393d10abfdd23e89ad470587eb672ebda8ef062aeba9c3bdf
-
SHA512
f5f93ed41ef5a6b8946409c9042307fe2e493af5a6fb99fe667c37a590d58d26f0d9d97d460e1afec3a8cce83ea69132f278649eea9a293c1ce844d6e1676d61
-
SSDEEP
98304:EMMMMMM4uMMMMqxC1nMMMMMZC7Pslcq2JnpvBghE+dLMzC1Py7kYhk9b0IQjYKHi:EJnpJq2C1Py7ktT0C
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 3656 setup.tmp 4196 unins000.exe 4752 _iu14D2N.tmp -
Loads dropped DLL 6 IoCs
pid Process 3656 setup.tmp 3656 setup.tmp 3656 setup.tmp 3656 setup.tmp 3656 setup.tmp 3656 setup.tmp -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language unins000.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language _iu14D2N.tmp -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3656 setup.tmp 3656 setup.tmp -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 3656 setup.tmp 3656 setup.tmp 4752 _iu14D2N.tmp -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1824 wrote to memory of 3656 1824 setup.exe 82 PID 1824 wrote to memory of 3656 1824 setup.exe 82 PID 1824 wrote to memory of 3656 1824 setup.exe 82 PID 3656 wrote to memory of 4196 3656 setup.tmp 93 PID 3656 wrote to memory of 4196 3656 setup.tmp 93 PID 3656 wrote to memory of 4196 3656 setup.tmp 93 PID 4196 wrote to memory of 4752 4196 unins000.exe 94 PID 4196 wrote to memory of 4752 4196 unins000.exe 94 PID 4196 wrote to memory of 4752 4196 unins000.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\is-4OVQ5.tmp\setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-4OVQ5.tmp\setup.tmp" /SL5="$50274,2977136,489472,C:\Users\Admin\AppData\Local\Temp\setup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Games\Resident Evil 5 Gold Edition\unins000.exe"C:\Games\Resident Evil 5 Gold Edition\unins000.exe" /VERYSILENT /NODELSAVE3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp"C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp" /SECONDPHASE="C:\Games\Resident Evil 5 Gold Edition\unins000.exe" /FIRSTPHASEWND=$30254 /VERYSILENT /NODELSAVE4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:4752
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25KB
MD53b4cfacb47193b1d200fe603e835a1e5
SHA17593499cd903a4eee9a6a88ca731704831d81ce8
SHA256fff90402b6dc466fc0e38c73d39b3a1661b949dca5a423e544c205786af5a05d
SHA512b9019e90d9d9004e096f13b9abb78d354569887c4fabc08c9e6d14b34e135d26c4c71272189b3ce1f016719b90bfc9cd346a2dc91ef7131f0184df077c4735d2
-
Filesize
1.5MB
MD5384e20ea0ace31928a969c858951660d
SHA1c7ad862f20322c0da76de7b4de6a157225927a17
SHA2560489d4bc0a8b0c77e1635a81fd210956c277e69719c39349644ea84876940d2b
SHA512037c34de2704a7fd8ce02dc5603a37b0b4e7316d599b37e32cf6fd98c214766728e64e43733c55969b7f105be44a1f2874cc25e6a92c6a5134a1b249868d24a8
-
Filesize
452KB
MD54feafa8b5e8cdb349125c8af0ac43974
SHA17f17e5e1b088fc73690888b215962fbcd395c9bd
SHA256bb8a0245dcc5c10a1c7181bad509b65959855009a8105863ef14f2bb5b38ac71
SHA512d63984ee385b4f1eba8e590d6de4f082fb0121689295ec6e496539209459152465f6db09e6d8f92eec996a89fc40432077cbfa807beb2de7f375154fef6554bc
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
4KB
MD5f07e819ba2e46a897cfabf816d7557b2
SHA18d5fd0a741dd3fd84650e40dd3928ae1f15323cc
SHA25668f42a7823ed7ee88a5c59020ac52d4bbcadf1036611e96e470d986c8faa172d
SHA5127ed26d41ead2ace0b5379639474d319af9a3e4ed2dd9795c018f8c5b9b533fd36bfc1713a1f871789bf14884d186fd0559939de511dde24673b0515165d405af
-
Filesize
16KB
MD59436df49e08c83bad8ddc906478c2041
SHA1a4fa6bdd2fe146fda2e78fdbab355797f53b7dce
SHA2561910537aa95684142250ca0c7426a0b5f082e39f6fbdbdba649aecb179541435
SHA512f9dc6602ab46d709efdaf937dcb8ae517caeb2bb1f06488c937be794fd9ea87f907101ae5c7f394c7656a6059dc18472f4a6747dcc8cc6a1e4f0518f920cc9bf
-
Filesize
1.5MB
MD5c8830b6840b3a34021030c45b36b8334
SHA181848a759b5688d5bf55db0747487232468fb03f
SHA25689552ba7733f4ab16a9e377bafa91adb26c8f9264f0588aab2fb5467cf692b3b
SHA512c6cbcd4a8b28dbd9147bddc753df29b9e65bf4cea6a0ea1e997b799ccabcd8aff2003b3f422fc6321d7eb7043b9323f9439ac0ee391e6f13bc85c3307868fdfb
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3