Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

1

USBHelperI...er.exe

windows10-1703-x64

7

USBHelperI...er.exe

windows7-x64

7

USBHelperI...er.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-es
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-eslocale:es-esos:windows10-2004-x64systemwindows
  • submitted
    24/03/2023, 03:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    USBHelperInstaller.exe

  • Size

    282KB

  • MD5

    d387c6c808a9ab80f0d8e843500f903d

  • SHA1

    b14fc2a27c1e215d74d8cb6f01729855c1dbd8f4

  • SHA256

    43d9426874eea0bb56c3feac25d20bc35fb3ddaa9447e1ca5f0ba3de1d194382

  • SHA512

    e60b8d2ffebb9bbb27c31b52b0d6c597e0a72486a7865ecee84b40a84f8e9e102353990314d28cf01227a30c5fc3c1f407f38c95c68ec69ca075549dc9ce2085

  • SSDEEP

    6144:F5GZq/Z1IVfA1AbKowcNj/CGYSx3YT+tT8:iZGZ05fwcNj/CDYoCV8

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

Processes

  • C:\Users\Admin\AppData\Local\Temp\USBHelperInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\USBHelperInstaller.exe"
    1⤵
    • Loads dropped DLL
    PID:572

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsl7055.tmp\INetC.dll
    Filesize

    21KB

    MD5

    2b342079303895c50af8040a91f30f71

    SHA1

    b11335e1cb8356d9c337cb89fe81d669a69de17e

    SHA256

    2d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f

    SHA512

    550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsl7055.tmp\INetC.dll
    Filesize

    21KB

    MD5

    2b342079303895c50af8040a91f30f71

    SHA1

    b11335e1cb8356d9c337cb89fe81d669a69de17e

    SHA256

    2d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f

    SHA512

    550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsl7055.tmp\INetC.dll
    Filesize

    21KB

    MD5

    2b342079303895c50af8040a91f30f71

    SHA1

    b11335e1cb8356d9c337cb89fe81d669a69de17e

    SHA256

    2d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f

    SHA512

    550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsl7055.tmp\INetC.dll
    Filesize

    21KB

    MD5

    2b342079303895c50af8040a91f30f71

    SHA1

    b11335e1cb8356d9c337cb89fe81d669a69de17e

    SHA256

    2d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f

    SHA512

    550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsl7055.tmp\System.dll
    Filesize

    11KB

    MD5

    fbe295e5a1acfbd0a6271898f885fe6a

    SHA1

    d6d205922e61635472efb13c2bb92c9ac6cb96da

    SHA256

    a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1

    SHA512

    2cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsl7055.tmp\nsArray.dll
    Filesize

    12KB

    MD5

    0917ee492308b691326e6581e8c793c9

    SHA1

    ff689c8051ffca7657461ac828bc46e303ab8e59

    SHA256

    81745087f193b6fa131189f4b3ee9caa93e9692e408d3955fbcb9a4ec8516e2f

    SHA512

    2a4ae4b93b0eac113a0e65f459798466120f1af4605a82a11f9022d790fe0b4f7d368b312f8a073b1dcfe8760e529ea56a5b5d4289321dc9f2fc8a22691b42b5

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsl7055.tmp\nsDialogs.dll
    Filesize

    9KB

    MD5

    ab101f38562c8545a641e95172c354b4

    SHA1

    ec47ac5449f6ee4b14f6dd7ddde841a3e723e567

    SHA256

    3cdf3e24c87666ed5c582b8b028c01ee6ac16d5a9b8d8d684ae67605376786ea

    SHA512

    72d4b6dc439f40b7d68b03353a748fc3ad7ed10b0401741c5030705d9b1adef856406075e9ce4f1a08e4345a16e1c759f636c38ad92a57ef369867a9533b7037

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsl7055.tmp\nsJSON.dll
    Filesize

    22KB

    MD5

    c8222584e91b74c47f5ce2a84d1cdc4f

    SHA1

    750359dd536c840b1d4016826af7f34a8562e242

    SHA256

    6785ab17a6c27be18072aa1c274078321b4ea27bfa752d3c882ec3093dc4637b

    SHA512

    a89f0083c791e7d4d54fd728e848e44bd44ef9e11c799a48ab95a48d3c4e02e68699e28818c1232b694120973ac0c3e418740759830ef70d328d7ef9e5789f51

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsl7055.tmp\xml.dll
    Filesize

    118KB

    MD5

    42df1fbaa87567adf2b4050805a1a545

    SHA1

    b892a6efbb39b7144248e0c0d79e53da474a9373

    SHA256

    e900fcb9d598643eb0ee3e4005da925e73e70dbaa010edc4473e99ea0638b845

    SHA512

    4537d408e2f54d07b018907c787da6c7340f909a1789416de33d090055eda8918f338d8571bc3b438dd89e5e03e0ded70c86702666f12adb98523a91cbb1de1d

    Download Submit