Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    54s
  • max time network
    73s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-es
  • resource tags

    arch:x64arch:x86image:win10-20230220-eslocale:es-esos:windows10-1703-x64systemwindows
  • submitted
    24/03/2023, 03:40

General

  • Target

    USBHelperInstaller.exe

  • Size

    282KB

  • MD5

    d387c6c808a9ab80f0d8e843500f903d

  • SHA1

    b14fc2a27c1e215d74d8cb6f01729855c1dbd8f4

  • SHA256

    43d9426874eea0bb56c3feac25d20bc35fb3ddaa9447e1ca5f0ba3de1d194382

  • SHA512

    e60b8d2ffebb9bbb27c31b52b0d6c597e0a72486a7865ecee84b40a84f8e9e102353990314d28cf01227a30c5fc3c1f407f38c95c68ec69ca075549dc9ce2085

  • SSDEEP

    6144:F5GZq/Z1IVfA1AbKowcNj/CGYSx3YT+tT8:iZGZ05fwcNj/CDYoCV8

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

Processes

  • C:\Users\Admin\AppData\Local\Temp\USBHelperInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\USBHelperInstaller.exe"
    1⤵
    • Loads dropped DLL
    PID:3576

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\nsw59A0.tmp\System.dll

    Filesize

    11KB

    MD5

    fbe295e5a1acfbd0a6271898f885fe6a

    SHA1

    d6d205922e61635472efb13c2bb92c9ac6cb96da

    SHA256

    a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1

    SHA512

    2cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06

  • \Users\Admin\AppData\Local\Temp\nsw59A0.tmp\nsDialogs.dll

    Filesize

    9KB

    MD5

    ab101f38562c8545a641e95172c354b4

    SHA1

    ec47ac5449f6ee4b14f6dd7ddde841a3e723e567

    SHA256

    3cdf3e24c87666ed5c582b8b028c01ee6ac16d5a9b8d8d684ae67605376786ea

    SHA512

    72d4b6dc439f40b7d68b03353a748fc3ad7ed10b0401741c5030705d9b1adef856406075e9ce4f1a08e4345a16e1c759f636c38ad92a57ef369867a9533b7037