Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/10/2023, 12:15

General

  • Target

    NSPack.exe

  • Size

    630KB

  • MD5

    55d8296cf5bf2252857879003ee52390

  • SHA1

    606d44f7c9492272ba6be28b82dec781091b7882

  • SHA256

    9b73a07c36f996b04968b61ca06da40109824f03b304267828e44c4fdd836cee

  • SHA512

    a0920234ea46ac07211a18ee93f46e77c21d1ba0e2627249d030b675370235573a22c176899f424b5188084b71e5538e392992436f72a75f635b48cb9b14fd46

  • SSDEEP

    12288:dacx/ikb7gjxG6gLjUMlqDGGSGupSj8VbNtTirdS+V:dacx/iymxG66j0DGG2XVLTEdS6

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NSPack.exe
    "C:\Users\Admin\AppData\Local\Temp\NSPack.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4132

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4132-0-0x0000000000400000-0x00000000005E8000-memory.dmp

    Filesize

    1.9MB

  • memory/4132-1-0x0000000000900000-0x0000000000943000-memory.dmp

    Filesize

    268KB

  • memory/4132-2-0x0000000002590000-0x0000000002591000-memory.dmp

    Filesize

    4KB

  • memory/4132-3-0x0000000000780000-0x0000000000781000-memory.dmp

    Filesize

    4KB

  • memory/4132-5-0x0000000000E30000-0x0000000000E31000-memory.dmp

    Filesize

    4KB

  • memory/4132-4-0x0000000000E40000-0x0000000000E41000-memory.dmp

    Filesize

    4KB

  • memory/4132-6-0x0000000000E20000-0x0000000000E21000-memory.dmp

    Filesize

    4KB

  • memory/4132-7-0x0000000000950000-0x0000000000951000-memory.dmp

    Filesize

    4KB

  • memory/4132-8-0x00000000025B0000-0x00000000025B1000-memory.dmp

    Filesize

    4KB

  • memory/4132-10-0x0000000002640000-0x0000000002641000-memory.dmp

    Filesize

    4KB

  • memory/4132-9-0x00000000025F0000-0x00000000025F4000-memory.dmp

    Filesize

    16KB

  • memory/4132-11-0x0000000002650000-0x0000000002651000-memory.dmp

    Filesize

    4KB

  • memory/4132-13-0x00000000025C0000-0x00000000025C1000-memory.dmp

    Filesize

    4KB

  • memory/4132-12-0x0000000002600000-0x0000000002601000-memory.dmp

    Filesize

    4KB

  • memory/4132-14-0x00000000025D0000-0x00000000025D1000-memory.dmp

    Filesize

    4KB

  • memory/4132-16-0x0000000002620000-0x0000000002621000-memory.dmp

    Filesize

    4KB

  • memory/4132-15-0x0000000002630000-0x0000000002631000-memory.dmp

    Filesize

    4KB

  • memory/4132-17-0x0000000002610000-0x0000000002611000-memory.dmp

    Filesize

    4KB

  • memory/4132-18-0x0000000002780000-0x0000000002781000-memory.dmp

    Filesize

    4KB

  • memory/4132-19-0x0000000002770000-0x0000000002771000-memory.dmp

    Filesize

    4KB

  • memory/4132-20-0x00000000027A0000-0x00000000027A1000-memory.dmp

    Filesize

    4KB

  • memory/4132-21-0x0000000002790000-0x0000000002791000-memory.dmp

    Filesize

    4KB

  • memory/4132-23-0x0000000002880000-0x0000000002881000-memory.dmp

    Filesize

    4KB

  • memory/4132-24-0x0000000002870000-0x0000000002871000-memory.dmp

    Filesize

    4KB

  • memory/4132-22-0x0000000002840000-0x0000000002841000-memory.dmp

    Filesize

    4KB

  • memory/4132-25-0x00000000028A0000-0x00000000028A1000-memory.dmp

    Filesize

    4KB

  • memory/4132-26-0x0000000002890000-0x0000000002891000-memory.dmp

    Filesize

    4KB

  • memory/4132-28-0x00000000028B0000-0x00000000028B1000-memory.dmp

    Filesize

    4KB

  • memory/4132-27-0x00000000028C0000-0x00000000028C1000-memory.dmp

    Filesize

    4KB

  • memory/4132-29-0x00000000028E0000-0x00000000028E1000-memory.dmp

    Filesize

    4KB

  • memory/4132-30-0x00000000028D0000-0x00000000028D1000-memory.dmp

    Filesize

    4KB

  • memory/4132-31-0x00000000028F0000-0x00000000028F1000-memory.dmp

    Filesize

    4KB

  • memory/4132-36-0x0000000002570000-0x0000000002571000-memory.dmp

    Filesize

    4KB

  • memory/4132-37-0x0000000000E10000-0x0000000000E11000-memory.dmp

    Filesize

    4KB

  • memory/4132-35-0x00000000008F0000-0x00000000008F1000-memory.dmp

    Filesize

    4KB

  • memory/4132-34-0x0000000002A30000-0x0000000002A31000-memory.dmp

    Filesize

    4KB

  • memory/4132-33-0x0000000002A40000-0x0000000002A41000-memory.dmp

    Filesize

    4KB

  • memory/4132-32-0x0000000002910000-0x0000000002911000-memory.dmp

    Filesize

    4KB

  • memory/4132-38-0x00000000025E0000-0x00000000025E5000-memory.dmp

    Filesize

    20KB

  • memory/4132-41-0x0000000002900000-0x0000000002901000-memory.dmp

    Filesize

    4KB

  • memory/4132-40-0x0000000002850000-0x0000000002851000-memory.dmp

    Filesize

    4KB

  • memory/4132-43-0x0000000002A60000-0x0000000002A61000-memory.dmp

    Filesize

    4KB

  • memory/4132-42-0x0000000002A20000-0x0000000002A21000-memory.dmp

    Filesize

    4KB

  • memory/4132-45-0x0000000002A80000-0x0000000002A81000-memory.dmp

    Filesize

    4KB

  • memory/4132-46-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

    Filesize

    4KB

  • memory/4132-44-0x0000000002A50000-0x0000000002A51000-memory.dmp

    Filesize

    4KB

  • memory/4132-47-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

    Filesize

    4KB

  • memory/4132-48-0x0000000002BF0000-0x0000000002BF1000-memory.dmp

    Filesize

    4KB

  • memory/4132-49-0x0000000002BE0000-0x0000000002BE1000-memory.dmp

    Filesize

    4KB

  • memory/4132-50-0x0000000002C10000-0x0000000002C11000-memory.dmp

    Filesize

    4KB

  • memory/4132-51-0x0000000002C00000-0x0000000002C01000-memory.dmp

    Filesize

    4KB

  • memory/4132-53-0x0000000002C50000-0x0000000002C51000-memory.dmp

    Filesize

    4KB

  • memory/4132-52-0x0000000002C20000-0x0000000002C21000-memory.dmp

    Filesize

    4KB

  • memory/4132-54-0x0000000002C40000-0x0000000002C41000-memory.dmp

    Filesize

    4KB

  • memory/4132-55-0x0000000002C60000-0x0000000002C61000-memory.dmp

    Filesize

    4KB

  • memory/4132-56-0x0000000002A90000-0x0000000002A91000-memory.dmp

    Filesize

    4KB

  • memory/4132-57-0x0000000002C30000-0x0000000002C31000-memory.dmp

    Filesize

    4KB

  • memory/4132-58-0x0000000002C70000-0x0000000002C71000-memory.dmp

    Filesize

    4KB

  • memory/4132-59-0x0000000004290000-0x0000000004291000-memory.dmp

    Filesize

    4KB

  • memory/4132-60-0x0000000004280000-0x0000000004281000-memory.dmp

    Filesize

    4KB

  • memory/4132-61-0x00000000053C0000-0x00000000053C1000-memory.dmp

    Filesize

    4KB

  • memory/4132-62-0x00000000053B0000-0x00000000053B1000-memory.dmp

    Filesize

    4KB

  • memory/4132-63-0x0000000000400000-0x00000000005E8000-memory.dmp

    Filesize

    1.9MB

  • memory/4132-64-0x0000000005510000-0x0000000005511000-memory.dmp

    Filesize

    4KB

  • memory/4132-67-0x0000000000400000-0x00000000005E8000-memory.dmp

    Filesize

    1.9MB

  • memory/4132-68-0x0000000000400000-0x00000000005E8000-memory.dmp

    Filesize

    1.9MB

  • memory/4132-72-0x0000000000400000-0x00000000005E8000-memory.dmp

    Filesize

    1.9MB

  • memory/4132-73-0x0000000000400000-0x00000000005E8000-memory.dmp

    Filesize

    1.9MB

  • memory/4132-78-0x0000000000400000-0x00000000005E8000-memory.dmp

    Filesize

    1.9MB

  • memory/4132-79-0x0000000000400000-0x00000000005E8000-memory.dmp

    Filesize

    1.9MB