Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    12/01/2024, 08:24

General

  • Target

    DeskSpaceTrialSetup.exe

  • Size

    2.9MB

  • MD5

    7e558f6aeec33330fab187b65bb77c42

  • SHA1

    71484851c1663c1d9f731a23ca2a316d19b0ff47

  • SHA256

    c22672281be4efe5ca7f5af81c10a6ea47ada6952e08da17619bac3db4d50412

  • SHA512

    e9971ccdc9a6f5704395799fecaec51070cdad8fb46c79ad329d904107c08c5d1a21b19ce130da3331e627a5dc13f3f8383f3b70717fc2e757e35c48cc973ba4

  • SSDEEP

    49152:BlTFg4LkfRdFHHk2C04oPlFzUxom+c2rgKVoQ5s97UXfUZjwq6:BYHdFn0APlF8d2rN5A7LZ8q6

Score
7/10
upx

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DeskSpaceTrialSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\DeskSpaceTrialSetup.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: GetForegroundWindowSpam
    PID:2896

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\nstB49.tmp\UAC.dll

    Filesize

    16KB

    MD5

    acfb66ee6fc1f4266229ec6098fe1740

    SHA1

    e1aeb31b11996015d7f17308e2f2bbe69d4e1476

    SHA256

    6d7e8070fa09cc4bb66fb99c2b88d0f5419602fa64a519437f430d9378300b1e

    SHA512

    bf0b5b22c57c08c88b4cbdd75bdf0c8eac433d42b4d163349391b71bc44d913e4d0e28e0826a7c27b418e6d2aa37c08c90577b56baa946a8f129486fbe01c303

  • memory/2896-0-0x0000000000400000-0x00000000004FC000-memory.dmp

    Filesize

    1008KB

  • memory/2896-86-0x0000000000400000-0x00000000004FC000-memory.dmp

    Filesize

    1008KB