Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    4s
  • max time network
    40s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230831-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/09/2023, 12:38

General

  • Target

    Device/HarddiskVolume4/Users/rafeeq/Downloads/PowerISO7-x64.exe

  • Size

    4.9MB

  • MD5

    c45d4c2c85a97d4cfaab1632368489f7

  • SHA1

    8f74a6ff6ce9a7d38507d4aa8971e769d8595d7f

  • SHA256

    1404b7fc531f720cc27e1414b297097d1b6b6f8aab0b2afd1c19cabb322861fd

  • SHA512

    2fb6aa4f7ebe3d5fee74f927f12edadb241b85cafb3b95ac19cf8ea2da29536e8339f80b9130eaca4803da3ef9c4b04d94dd5085b19cdcd3081121c1db7f5eeb

  • SSDEEP

    98304:QOzubG1up2BRPKYvjCBCqgr/FK9A8pF9yz7S70nrPx:QOzu/p25ey/k9A8LQz7Y0nb

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

Processes

  • C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume4\Users\rafeeq\Downloads\PowerISO7-x64.exe
    "C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume4\Users\rafeeq\Downloads\PowerISO7-x64.exe"
    1⤵
    • Loads dropped DLL
    PID:4120

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsg6F56.tmp\System.dll

    Filesize

    11KB

    MD5

    bf712f32249029466fa86756f5546950

    SHA1

    75ac4dc4808ac148ddd78f6b89a51afbd4091c2e

    SHA256

    7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af

    SHA512

    13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4

  • C:\Users\Admin\AppData\Local\Temp\nsg6F56.tmp\zCqCQnbml.dll

    Filesize

    991KB

    MD5

    6f840a6f2b621670507c222086aaccd3

    SHA1

    a540821e88deed7d7cd48ed4891c15081c61fe0c

    SHA256

    8923c6d8fa4b43651671f74cd38f6b6a57985533e3fd0b8450a7a347469941f4

    SHA512

    a7b68373a038ab958874a97d2f2fa482a8538e3c949d000aee871b3aec5d70a07e257b476af010e9298896e12130fca0b372cc583759d3705b2092d5b0012b84

  • C:\Users\Admin\AppData\Local\Temp\nsg6F56.tmp\zCqCQnbml.dll

    Filesize

    991KB

    MD5

    6f840a6f2b621670507c222086aaccd3

    SHA1

    a540821e88deed7d7cd48ed4891c15081c61fe0c

    SHA256

    8923c6d8fa4b43651671f74cd38f6b6a57985533e3fd0b8450a7a347469941f4

    SHA512

    a7b68373a038ab958874a97d2f2fa482a8538e3c949d000aee871b3aec5d70a07e257b476af010e9298896e12130fca0b372cc583759d3705b2092d5b0012b84

  • memory/4120-9-0x0000000003240000-0x000000000333E000-memory.dmp

    Filesize

    1016KB

  • memory/4120-12-0x00000000036C0000-0x00000000037A4000-memory.dmp

    Filesize

    912KB

  • memory/4120-13-0x0000000003D50000-0x0000000003F5A000-memory.dmp

    Filesize

    2.0MB

  • memory/4120-17-0x0000000003D50000-0x0000000003F5A000-memory.dmp

    Filesize

    2.0MB

  • memory/4120-18-0x0000000003D50000-0x0000000003F5A000-memory.dmp

    Filesize

    2.0MB

  • memory/4120-16-0x0000000003D50000-0x0000000003F5A000-memory.dmp

    Filesize

    2.0MB

  • memory/4120-19-0x0000000003D50000-0x0000000003F5A000-memory.dmp

    Filesize

    2.0MB

  • memory/4120-20-0x0000000003D50000-0x0000000003F5A000-memory.dmp

    Filesize

    2.0MB

  • memory/4120-21-0x0000000003D50000-0x0000000003F5A000-memory.dmp

    Filesize

    2.0MB

  • memory/4120-259-0x0000000003D50000-0x0000000003F5A000-memory.dmp

    Filesize

    2.0MB

  • memory/4120-263-0x0000000003D50000-0x0000000003F5A000-memory.dmp

    Filesize

    2.0MB