Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    181s
  • max time network
    215s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/11/2022, 23:02

General

  • Target

    60df92ed42bd96eb882ba026b8de96ef27a19275ac3c3e0eefe35b7bc0c69ade.exe

  • Size

    105KB

  • MD5

    16075316d91c55eaf8184ee64badaf70

  • SHA1

    9af89d08ac17e196c58c7bab76ffd8609696a4a4

  • SHA256

    60df92ed42bd96eb882ba026b8de96ef27a19275ac3c3e0eefe35b7bc0c69ade

  • SHA512

    6079cb01fd2a90d4d801e0d31e752420dc20aa9f9dc08c3a7ebd5e1cc830c5d9433d33bb543ce4bfd54626b18407c9e61f18ddb60ed88c4e7047d9df522c195b

  • SSDEEP

    3072:Ad50ccSrwf7nbLPnI45GT7hayXolR56eNM+:AzjwjnbLQZT7hHXijM+

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

Processes

  • C:\Users\Admin\AppData\Local\Temp\60df92ed42bd96eb882ba026b8de96ef27a19275ac3c3e0eefe35b7bc0c69ade.exe
    "C:\Users\Admin\AppData\Local\Temp\60df92ed42bd96eb882ba026b8de96ef27a19275ac3c3e0eefe35b7bc0c69ade.exe"
    1⤵
    • Loads dropped DLL
    PID:4060

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsp6D71.tmp\ButtonEvent.dll

    Filesize

    4KB

    MD5

    55788069d3fa4e1daf80f3339fa86fe2

    SHA1

    d64e05c1879a92d5a8f9ff2fd2f1a53e1a53ae96

    SHA256

    d6e429a063adf637f4d19d4e2eb094d9ff27382b21a1f6dccf9284afb5ff8c7f

    SHA512

    d3b1eec76e571b657df444c59c48cad73a58d1a10ff463ce9f3acd07acce17d589c3396ad5bdb94da585da08d422d863ffe1de11f64298329455f6d8ee320616

  • C:\Users\Admin\AppData\Local\Temp\nsp6D71.tmp\NSISdl.dll

    Filesize

    15KB

    MD5

    7caaf58a526da33c24cbe122e7839693

    SHA1

    7687112cb6593947226f8a8319d6e2d0cdef3b11

    SHA256

    19debdc4c0b6f5dc9582bda7a2c1146516f683e8d741190e6d4b81ad10b33f61

    SHA512

    aafd0cb2abb3d2dee95c2d037a6a1a5bff0518e3210ced0c39e6d6696e4fab4734df01476fe9dcb208f02c529cd03346bc8b7f3319ae49701bbf2cb453d59bae

  • C:\Users\Admin\AppData\Local\Temp\nsp6D71.tmp\NSISdl.dll

    Filesize

    15KB

    MD5

    7caaf58a526da33c24cbe122e7839693

    SHA1

    7687112cb6593947226f8a8319d6e2d0cdef3b11

    SHA256

    19debdc4c0b6f5dc9582bda7a2c1146516f683e8d741190e6d4b81ad10b33f61

    SHA512

    aafd0cb2abb3d2dee95c2d037a6a1a5bff0518e3210ced0c39e6d6696e4fab4734df01476fe9dcb208f02c529cd03346bc8b7f3319ae49701bbf2cb453d59bae

  • C:\Users\Admin\AppData\Local\Temp\nsp6D71.tmp\NSISdl.dll

    Filesize

    15KB

    MD5

    7caaf58a526da33c24cbe122e7839693

    SHA1

    7687112cb6593947226f8a8319d6e2d0cdef3b11

    SHA256

    19debdc4c0b6f5dc9582bda7a2c1146516f683e8d741190e6d4b81ad10b33f61

    SHA512

    aafd0cb2abb3d2dee95c2d037a6a1a5bff0518e3210ced0c39e6d6696e4fab4734df01476fe9dcb208f02c529cd03346bc8b7f3319ae49701bbf2cb453d59bae

  • C:\Users\Admin\AppData\Local\Temp\nsp6D71.tmp\nsDialogs.dll

    Filesize

    9KB

    MD5

    4ccc4a742d4423f2f0ed744fd9c81f63

    SHA1

    704f00a1acc327fd879cf75fc90d0b8f927c36bc

    SHA256

    416133dd86c0dff6b0fcaf1f46dfe97fdc85b37f90effb2d369164a8f7e13ae6

    SHA512

    790c5eb1f8b297e45054c855b66dfc18e9f3f1b1870559014dbefa3b9d5b6d33a993a9e089202e70f51a55d859b74e8605c6f633386fd9189b6f78941bf1bfdb