Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    133s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/12/2022, 18:18

General

  • Target

    862c82ceeb0334c43deda9a6038576652c6c66ca39cf7da202f34b0bfdcaa111.exe

  • Size

    313KB

  • MD5

    70e4a329e881fcd6f955b160d5c0f5cf

  • SHA1

    16ede5b1df8a365928cbb7b8ad5dd2d07cd6e25a

  • SHA256

    862c82ceeb0334c43deda9a6038576652c6c66ca39cf7da202f34b0bfdcaa111

  • SHA512

    1b61d472af5bb2299a007cdf52f76c924b1ca864f4d4e21bcc35f747145458c46b75b3788c967611595d6d4d9287e1bd80aadbbc86fa60fb70d94fe515f22cc0

  • SSDEEP

    6144:H+K03SwpNXT2TPGLURQN3vTLWBQ/7TzttuCMNhGK6DgsQQYJ:+3Bxq7HqFvfW6jTz3uCMNQKagf

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

Processes

  • C:\Users\Admin\AppData\Local\Temp\862c82ceeb0334c43deda9a6038576652c6c66ca39cf7da202f34b0bfdcaa111.exe
    "C:\Users\Admin\AppData\Local\Temp\862c82ceeb0334c43deda9a6038576652c6c66ca39cf7da202f34b0bfdcaa111.exe"
    1⤵
    • Loads dropped DLL
    PID:1180

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nspE0E0.tmp\nsisdl.dll

    Filesize

    14KB

    MD5

    1dadb63a5dfaa0679485c5dbaf96033f

    SHA1

    d1717aab683c55bd13bbd520d2a91178efa0d676

    SHA256

    72c65f7cd4a611b077b1ad0be8185780909e9cb04c53ecdac3e17fc72c99b245

    SHA512

    46535c2d96937d49ee7c222428db4a8d61eb346efa0845fcd88e06523ed7836518e5a72d623e9c5563bf6759b449b6d2fcb0340b98a6e7966027bc983db4f722

  • C:\Users\Admin\AppData\Local\Temp\nspE0E0.tmp\nsisdl.dll

    Filesize

    14KB

    MD5

    1dadb63a5dfaa0679485c5dbaf96033f

    SHA1

    d1717aab683c55bd13bbd520d2a91178efa0d676

    SHA256

    72c65f7cd4a611b077b1ad0be8185780909e9cb04c53ecdac3e17fc72c99b245

    SHA512

    46535c2d96937d49ee7c222428db4a8d61eb346efa0845fcd88e06523ed7836518e5a72d623e9c5563bf6759b449b6d2fcb0340b98a6e7966027bc983db4f722

  • C:\Users\Admin\AppData\Local\Temp\nspE0E0.tmp\nsisdl.dll

    Filesize

    14KB

    MD5

    1dadb63a5dfaa0679485c5dbaf96033f

    SHA1

    d1717aab683c55bd13bbd520d2a91178efa0d676

    SHA256

    72c65f7cd4a611b077b1ad0be8185780909e9cb04c53ecdac3e17fc72c99b245

    SHA512

    46535c2d96937d49ee7c222428db4a8d61eb346efa0845fcd88e06523ed7836518e5a72d623e9c5563bf6759b449b6d2fcb0340b98a6e7966027bc983db4f722

  • C:\Users\Admin\AppData\Local\Temp\nspE0E0.tmp\nsisdl.dll

    Filesize

    14KB

    MD5

    1dadb63a5dfaa0679485c5dbaf96033f

    SHA1

    d1717aab683c55bd13bbd520d2a91178efa0d676

    SHA256

    72c65f7cd4a611b077b1ad0be8185780909e9cb04c53ecdac3e17fc72c99b245

    SHA512

    46535c2d96937d49ee7c222428db4a8d61eb346efa0845fcd88e06523ed7836518e5a72d623e9c5563bf6759b449b6d2fcb0340b98a6e7966027bc983db4f722

  • C:\Users\Admin\AppData\Local\Temp\nspE0E0.tmp\nsisdl.dll

    Filesize

    14KB

    MD5

    1dadb63a5dfaa0679485c5dbaf96033f

    SHA1

    d1717aab683c55bd13bbd520d2a91178efa0d676

    SHA256

    72c65f7cd4a611b077b1ad0be8185780909e9cb04c53ecdac3e17fc72c99b245

    SHA512

    46535c2d96937d49ee7c222428db4a8d61eb346efa0845fcd88e06523ed7836518e5a72d623e9c5563bf6759b449b6d2fcb0340b98a6e7966027bc983db4f722

  • C:\Users\Admin\AppData\Local\Temp\nspE0E0.tmp\nsisdl.dll

    Filesize

    14KB

    MD5

    1dadb63a5dfaa0679485c5dbaf96033f

    SHA1

    d1717aab683c55bd13bbd520d2a91178efa0d676

    SHA256

    72c65f7cd4a611b077b1ad0be8185780909e9cb04c53ecdac3e17fc72c99b245

    SHA512

    46535c2d96937d49ee7c222428db4a8d61eb346efa0845fcd88e06523ed7836518e5a72d623e9c5563bf6759b449b6d2fcb0340b98a6e7966027bc983db4f722

  • C:\Users\Admin\AppData\Local\Temp\nspE0E0.tmp\nsisdl.dll

    Filesize

    14KB

    MD5

    1dadb63a5dfaa0679485c5dbaf96033f

    SHA1

    d1717aab683c55bd13bbd520d2a91178efa0d676

    SHA256

    72c65f7cd4a611b077b1ad0be8185780909e9cb04c53ecdac3e17fc72c99b245

    SHA512

    46535c2d96937d49ee7c222428db4a8d61eb346efa0845fcd88e06523ed7836518e5a72d623e9c5563bf6759b449b6d2fcb0340b98a6e7966027bc983db4f722