Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

SecuriteIn...54.exe

windows7-x64

7

SecuriteIn...54.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    25s
  • max time network
    30s
  • platform
    windows7_x64
  • resource
    win7-20230703-en
  • resource tags

    arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
  • submitted
    06/07/2023, 14:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Gen.Variant.Nemesis.22775.910.6254.exe

  • Size

    361KB

  • MD5

    995af99408580d7fc0646715b7415b37

  • SHA1

    9bdfce77846bfa373a88373b009df76d1bae191e

  • SHA256

    b1c7d85b71168a227630f11b74f10aead1d659a5ac9353bbd2a64f89a4f09561

  • SHA512

    83938ad4fc0b29aa26c84cdbdb5e912e99a86e3f327aba2e13eba4c5e8455134eaa091a54fc837a714ab9dc044fc1c501001a192168e05e9763b1bbc84c6d51b

  • SSDEEP

    6144:/Ya60G4z100ZEfEWCTCC6aXpJoubyFp/Zm4uhLZDGNZEQ:/Y6G4zlZEfEZC7gJoubim4u5A/

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Gen.Variant.Nemesis.22775.910.6254.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Gen.Variant.Nemesis.22775.910.6254.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:2300
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Gen.Variant.Nemesis.22775.910.6254.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Gen.Variant.Nemesis.22775.910.6254.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2176

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\nst697F.tmp\vwyvequl.dll
    Filesize

    255KB

    MD5

    f3988fcf1d4348e0f71022b513b964cf

    SHA1

    e93061c33aadf7c7c70c1f077153a3c8446d08ce

    SHA256

    c32338cfc3b63975693a3e49a0a2d4d08a832b9ecc65e6f18b25140790df2de2

    SHA512

    124e1058ef2164c8d81dc7150b3acd9db5487f3ba6843c09bdc1e41f5061737a863be34e00ee0823a8e6c0127ae285d6c04dfbad1f1d81431ea23372407d5a3c

    Download Submit

  • memory/2176-61-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

    Download

  • memory/2176-62-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

    Download

  • memory/2176-63-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

    Download

  • memory/2176-65-0x0000000000830000-0x0000000000B33000-memory.dmp

    Filesize

    3.0MB

    Download