Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    135s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    23/09/2023, 06:57

General

  • Target

    TriDef-3D-7.0-Installer.exe

  • Size

    55.7MB

  • MD5

    900a5ea682ed9c65cf625d0685602b48

  • SHA1

    d09eef947b805f56f7a0242cebec98e19ca4a684

  • SHA256

    a166dab90677bfcbf4a579553c93023a5676a11fcf1ca7988808a383675883d7

  • SHA512

    d72286e13b7f09432d482bdc27725b63b6c8154e55072f5b4f1b1279e256d9df359481cb317c70d0f189ef9902f8524f6557acd923f66819eec85b8e012a0ab3

  • SSDEEP

    1572864:FITp+MX+GGYz996IHr8sEHpK6GOfEZx0ZVvmJb94bhc9:Fo5uGGYz96dFZtZ56z

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TriDef-3D-7.0-Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\TriDef-3D-7.0-Installer.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: GetForegroundWindowSpam
    PID:1644

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsy8A27.tmp\UserInfo.dll

    Filesize

    4KB

    MD5

    d16e06c5de8fb8213a0464568ed9852f

    SHA1

    d063690dc0d2c824f714acb5c4bcede3aa193f03

    SHA256

    728472ba312ae8af7f30d758ab473e0772477a68fcd1d2d547dafe6d8800d531

    SHA512

    60502bb65d91a1a895f38bd0f070738152af58ffa4ac80bac3954aa8aad9fda9666e773988cbd00ce4741d2454bf5f2e0474ce8ea18cfe863ec4c36d09d1e27a

  • \Users\Admin\AppData\Local\Temp\nsy8A27.tmp\DDDNSIS.dll

    Filesize

    144KB

    MD5

    8d908988f0e9782ca3b9f4ec370400b6

    SHA1

    180d169af5258c1a2ec7bca26254f270bd8109d7

    SHA256

    f61355dc65eebd44f3695bb0037f6d4923155583c291f66291f96d30e8570ae5

    SHA512

    29b2aed20f27b81e7af4744667978cb996cf9b25714deb85740232d094a377b073a7cb78f58edf0224288774f5edb89e0d3f757460dc9ddf605166c471ddebd2

  • \Users\Admin\AppData\Local\Temp\nsy8A27.tmp\System.dll

    Filesize

    11KB

    MD5

    959ea64598b9a3e494c00e8fa793be7e

    SHA1

    40f284a3b92c2f04b1038def79579d4b3d066ee0

    SHA256

    03cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b

    SHA512

    5e765e090f712beffce40c5264674f430b08719940d66e3a4d4a516fd4ade859f7853f614d9d6bbb602780de54e11110d66dbb0f9ca20ef6096ede531f9f6d64

  • \Users\Admin\AppData\Local\Temp\nsy8A27.tmp\UserInfo.dll

    Filesize

    4KB

    MD5

    d16e06c5de8fb8213a0464568ed9852f

    SHA1

    d063690dc0d2c824f714acb5c4bcede3aa193f03

    SHA256

    728472ba312ae8af7f30d758ab473e0772477a68fcd1d2d547dafe6d8800d531

    SHA512

    60502bb65d91a1a895f38bd0f070738152af58ffa4ac80bac3954aa8aad9fda9666e773988cbd00ce4741d2454bf5f2e0474ce8ea18cfe863ec4c36d09d1e27a

  • \Users\Admin\AppData\Local\Temp\nsy8A27.tmp\UserInfo.dll

    Filesize

    4KB

    MD5

    d16e06c5de8fb8213a0464568ed9852f

    SHA1

    d063690dc0d2c824f714acb5c4bcede3aa193f03

    SHA256

    728472ba312ae8af7f30d758ab473e0772477a68fcd1d2d547dafe6d8800d531

    SHA512

    60502bb65d91a1a895f38bd0f070738152af58ffa4ac80bac3954aa8aad9fda9666e773988cbd00ce4741d2454bf5f2e0474ce8ea18cfe863ec4c36d09d1e27a

  • memory/1644-9-0x0000000001E70000-0x0000000001EF6000-memory.dmp

    Filesize

    536KB