Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/12/2023, 19:38

General

  • Target

    0e2112c0a38d07c4379a9bf1dc274be4.exe

  • Size

    1.6MB

  • MD5

    0e2112c0a38d07c4379a9bf1dc274be4

  • SHA1

    e839253540aa57b44bc761b3200b43d05b41f510

  • SHA256

    fda9847dd1d543d09942f2b9a6ac89c86269e7aefc623aa59ed450738e39d687

  • SHA512

    98a784cebd8fa8345ae4e5bd8cf3d67d217e7e9f6f805f415dea6264f93a0062995111cb147132a397fb27d8514ce2046aac9077c548b5791dfc0facae5d4411

  • SSDEEP

    24576:etfm+N0ZBqyEpB4jZtXCoRdYK3maaog+/qDsI258+WteGFKHlawM+/t+vHVmt:Uo+qXFOaaP+S1AygGFKDMilt

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

Processes

  • C:\Users\Admin\AppData\Local\Temp\0e2112c0a38d07c4379a9bf1dc274be4.exe
    "C:\Users\Admin\AppData\Local\Temp\0e2112c0a38d07c4379a9bf1dc274be4.exe"
    1⤵
    • Loads dropped DLL
    PID:2280

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsd4E03.tmp\BrandingURL.dll

    Filesize

    4KB

    MD5

    71c46b663baa92ad941388d082af97e7

    SHA1

    5a9fcce065366a526d75cc5ded9aade7cadd6421

    SHA256

    bb2b9c272b8b66bc1b414675c2acba7afad03fff66a63babee3ee57ed163d19e

    SHA512

    5965bd3f5369b9a1ed641c479f7b8a14af27700d0c27d482aa8eb62acc42f7b702b5947d82f9791b29bcba4d46e1409244f0a8ddce4ec75022b5e27f6d671bce

  • C:\Users\Admin\AppData\Local\Temp\nsd4E03.tmp\InstallOptions.dll

    Filesize

    14KB

    MD5

    107737e3282fefd85684f2fa3df6d1c3

    SHA1

    3befbcae116a644ae28cebdc1d7dfe6be5c8ca5f

    SHA256

    21042be362d4073053bffcc90511b3ecf77902243525b56bb159581b5ece43a0

    SHA512

    439ac2f3066902e08d63dc3061f55063089857e765feb29fe47ba5819a9bebdff3fe2fe55fc8bfcfddb729d340f006ee95b5aa4422d712f9dcc07cc02ec410b4

  • C:\Users\Admin\AppData\Local\Temp\nsd4E03.tmp\InstallOptions.dll

    Filesize

    9KB

    MD5

    a38396486ec2a73c7d0501578d58d27d

    SHA1

    91609702a67f752d9aeceb6899187ace3aa8aceb

    SHA256

    c8b544c9e1f4d54dc1cefe3c5ae28dac59dfc6f4e168552da1305bbe82d6e26f

    SHA512

    15309401cf8f7ef4f6968cce3c2d440fac850b26d87c972fd3c177ef003519561da895bcf5e07927a976e4b56c3bc8d6bd637d5f87f5237aa2e592e57ce8d212

  • C:\Users\Admin\AppData\Local\Temp\nsd4E03.tmp\ioSpecial.ini

    Filesize

    621B

    MD5

    75cf822c3822131ba9ad38837b06468e

    SHA1

    b0dea2ee3120c29c7409c6d8bd2905ab6bbc604a

    SHA256

    598c09f188cbf0583cc8afc26635a9c854a78bbb5243f6eb1fbe85a129a7b044

    SHA512

    454dac069d0b3ddef680ecea04bbfd50f97026b6bd7b98247a4de0d32cb28dbc6c63eba80df4afbfa90d8a23d59b2e471972d622676186294381af2c09a851f9