Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3Clear_glas...p1.exe
windows7-x64
5Clear_glas...p1.exe
windows10-2004-x64
5Clear_glas...le.dll
windows7-x64
1Clear_glas...le.dll
windows10-2004-x64
1Clear_glas...le.dll
windows7-x64
3Clear_glas...le.dll
windows10-2004-x64
1Clear_glas...pp.exe
windows7-x64
10Clear_glas...pp.exe
windows10-2004-x64
10Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/11/2024, 22:06
Static task
static1
Behavioral task
behavioral1
Sample
Clear_glass_red_metalic_windows7/Choose Theme/Theme Setup1.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Clear_glass_red_metalic_windows7/Choose Theme/Theme Setup1.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Clear_glass_red_metalic_windows7/Common Tasks/Bottom Common Tasks/Shellstyle.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Clear_glass_red_metalic_windows7/Common Tasks/Bottom Common Tasks/Shellstyle.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Clear_glass_red_metalic_windows7/Common Tasks/Left Dark Blue Common Tasks/Shellstyle.dll
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
Clear_glass_red_metalic_windows7/Common Tasks/Left Dark Blue Common Tasks/Shellstyle.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Clear_glass_red_metalic_windows7/Setup App.exe
Resource
win7-20241010-en
General
-
Target
Clear_glass_red_metalic_windows7/Choose Theme/Theme Setup1.exe
-
Size
169KB
-
MD5
06679d2853687d80f3f5e139e0fd1b96
-
SHA1
5c0f4fe9d025d7891df580d7292711ba37e2b3bb
-
SHA256
72572ddb1a3ce18646ad7d9a2a44dd5169e708ee2e05c5075ed4d02c04ebb753
-
SHA512
1403edb048e123ecf7aa9317ae0c367ee1871f67cee9960e40a82bafc58fcbd81c3e9f0c5c57fe47810d2e6a79e722a054d06b54274dc7d546561a6827d4e444
-
SSDEEP
3072:NikH6RwMZVxYwgJf+lOLPICU7/7Na15WGUmuQAR5IjWz+l7EoI0Hzn:NHH6+MZVCofFsu4WMIG
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1192 set thread context of 3144 1192 Theme Setup1.exe 85 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Theme Setup1.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3144 Theme Setup1.exe 3144 Theme Setup1.exe 3144 Theme Setup1.exe 3144 Theme Setup1.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1192 wrote to memory of 3144 1192 Theme Setup1.exe 85 PID 1192 wrote to memory of 3144 1192 Theme Setup1.exe 85 PID 1192 wrote to memory of 3144 1192 Theme Setup1.exe 85 PID 1192 wrote to memory of 3144 1192 Theme Setup1.exe 85 PID 1192 wrote to memory of 3144 1192 Theme Setup1.exe 85 PID 1192 wrote to memory of 3144 1192 Theme Setup1.exe 85 PID 1192 wrote to memory of 3144 1192 Theme Setup1.exe 85 PID 3144 wrote to memory of 3424 3144 Theme Setup1.exe 56 PID 3144 wrote to memory of 3424 3144 Theme Setup1.exe 56 PID 3144 wrote to memory of 3424 3144 Theme Setup1.exe 56 PID 3144 wrote to memory of 3424 3144 Theme Setup1.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\Clear_glass_red_metalic_windows7\Choose Theme\Theme Setup1.exe"C:\Users\Admin\AppData\Local\Temp\Clear_glass_red_metalic_windows7\Choose Theme\Theme Setup1.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\Clear_glass_red_metalic_windows7\Choose Theme\Theme Setup1.exe"C:\Users\Admin\AppData\Local\Temp\Clear_glass_red_metalic_windows7\Choose Theme\Theme Setup1.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3144
-
-