Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    24/12/2023, 16:06

General

  • Target

    04dfa2a5912bb84e6da07b067a67aeef.exe

  • Size

    180KB

  • MD5

    04dfa2a5912bb84e6da07b067a67aeef

  • SHA1

    6977b2ab2967180501be42d530aded23dd08ed8a

  • SHA256

    42a6e450a4d7eb0ad52fc79096e1f2c7691b9452baab9ef762111cb12ee0e794

  • SHA512

    df290df232b7aa4fbf35ec804b00a0749d95869a73b37b36a1e5467e9ed188c6ccb531013ae0d3bf11a2a36f08b78919d7bebad7e861c327c68954002603b17d

  • SSDEEP

    3072:xLk395hYXJm45+QHO/Ej4nRjy4wetX6tvsq3RVTZPsfI6w1ZoNbqUYP/wwds:xQqM1QkEyRjtX6t1ph1ZoNYP/fds

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 7 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

Processes

  • C:\Users\Admin\AppData\Local\Temp\04dfa2a5912bb84e6da07b067a67aeef.exe
    "C:\Users\Admin\AppData\Local\Temp\04dfa2a5912bb84e6da07b067a67aeef.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    PID:2040

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsi84B.tmp\accept2.bmp

    Filesize

    16KB

    MD5

    f642e8cfce23aa5d124533357de7394b

    SHA1

    80ce98a2bc4b416db357ea52a74424d742cfaa55

    SHA256

    f1bed304ea1d96094c1e4e3f8e112b7ce15af4441192e73c9144f774ad132d2e

    SHA512

    d0ec47e3a69cc6c6f54e8ba58cade7875ace43b66946e7bd4b678dc246c61acf8d36aeaf80082308f08783c28424c5db601bdde1d820f7797b60ca4fe948ad26

  • C:\Users\Admin\AppData\Local\Temp\nsi84B.tmp\inetc3.dll

    Filesize

    25KB

    MD5

    9d8ce05f532dc7b5742831ec8a63c2d8

    SHA1

    b014365f723c78a84bcdf8a46cfa016eb2b8dbc5

    SHA256

    fcc46c2e60931a76fe529a9fa5a85ba2f4bf7907d651161f92fc524ac4747982

    SHA512

    98f268bebf0c82d019873a7b109e1822011c0532e6a6d8ba94d2b8a918d9558f4db89100b6ee357c9c510ff56adc349e619489fd7e8d21e7f826877185ede3fe

  • \Users\Admin\AppData\Local\Temp\nsi84B.tmp\NSISdl.dll

    Filesize

    14KB

    MD5

    a5f8399a743ab7f9c88c645c35b1ebb5

    SHA1

    168f3c158913b0367bf79fa413357fbe97018191

    SHA256

    dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

    SHA512

    824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

  • \Users\Admin\AppData\Local\Temp\nsi84B.tmp\System.dll

    Filesize

    650B

    MD5

    3d0e8e1bbc71e9012918501ac05a66fa

    SHA1

    ba7ab6abc53e3c1bd52ebe1dfcc322be510bee60

    SHA256

    1a4840ef7f0799c0f0970d10e6336c0b472b81ec12fcaf5b552bc110d5ff4d16

    SHA512

    7bbdbe97787ab49fc196ba55bdd5d33a471f8bf89d70e709ea94c1ca55c61cb7651177479b38f11fa6bb7fbc65c6c126b82b934b4ff2aa3cb6c9fdfb9f6f0fcc

  • \Users\Admin\AppData\Local\Temp\nsi84B.tmp\nsDialogs.dll

    Filesize

    9KB

    MD5

    c10e04dd4ad4277d5adc951bb331c777

    SHA1

    b1e30808198a3ae6d6d1cca62df8893dc2a7ad43

    SHA256

    e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a

    SHA512

    853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e