Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    161s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/01/2024, 11:04

General

  • Target

    7210e90869924eb8d652281e4a2c7cd8.exe

  • Size

    840KB

  • MD5

    7210e90869924eb8d652281e4a2c7cd8

  • SHA1

    e6d3b51b68d67415cd2fc5fb8e9fe1b6be407e40

  • SHA256

    557c52ce5b2287387b843a22af6e4b84b200f67e4c869a7812f713b050d73f9a

  • SHA512

    fc730eac45eecc043466690aeeb04ba9fe5fb79444fc7fef6951fbbdeda1612e52e17069630c91e35d78039733625be768165565f8109a8ec58ade8794c18cf9

  • SSDEEP

    24576:SiwRwU3UXu5Hs4BTqLVx3tHGkEPWlQN/XFXA7ui9wD:vHzosjZxdHGkEPWlC/XFXA0D

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7210e90869924eb8d652281e4a2c7cd8.exe
    "C:\Users\Admin\AppData\Local\Temp\7210e90869924eb8d652281e4a2c7cd8.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    PID:3436

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\DLLWaitForKillProgram.dll

    Filesize

    28KB

    MD5

    9c4b8ec42d89f7557bfd90798ce52787

    SHA1

    2376dde426ea65aa27c30e304086310605382475

    SHA256

    ed52bdad7b383a179b9b0e21fefdda2d72695c5263a815d5e1e0bfac6c718548

    SHA512

    17c12a27a08746755868558c037376dd7e20f03f0f71888c1329903b70975a54f57786c3c32bf88aaf30119f11ed978a6830ba91949e11cfc94fbb5ad95305b7

  • C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\FILEDownPlug.dll

    Filesize

    20KB

    MD5

    b118053825642ecf3bba36500a70645b

    SHA1

    ce436f731bd8bf744399bf39e77f7bca5a4461af

    SHA256

    eb97c0e8d17986beb01c1366405c8fa70e5d69c5f82b30f184454a47c258fda5

    SHA512

    11e00d2e2fc6b85e96de5b9fd11ea3f1d681180879ac3c2a7cfbe35a3808466f8eaff70faa39d6f5739238a34558825a22f0887d5653df54305a3ccce3836c73

  • C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\InstallOptions.dll

    Filesize

    14KB

    MD5

    325b008aec81e5aaa57096f05d4212b5

    SHA1

    27a2d89747a20305b6518438eff5b9f57f7df5c3

    SHA256

    c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

    SHA512

    18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

  • C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\KillProcDLL.dll

    Filesize

    36KB

    MD5

    6958016193a066833556992077bad4fe

    SHA1

    5f564945936f99381d7e2408f034f97d069005a4

    SHA256

    f38c669c87f2a73768a27a01622690997e9d93d5ca3830b349bd24c3ff9f8d2e

    SHA512

    fd6ab5c341b331b80c940ba97a2cd14547c796933a2df26d3dd87ede1602b86d9f8c37baebd7dd4c68d811199fc96a27ad4cb995bb8889d51af91db9f43ba0a7

  • C:\Users\Admin\AppData\Local\Temp\nsyDBAB.tmp\ioSpecial.ini

    Filesize

    603B

    MD5

    15c28e2ea8ca0b88365c80c5604028d8

    SHA1

    707ca188b7fa29add02455dd2c816d7770145a5f

    SHA256

    b07b50919a4abab9256bd67d845b7090a5426dc71d003de00e2c92ed823ad56f

    SHA512

    6f6372bf09fec622077f564c46a5a23bb1b7da4da5c7bdb3448ec795f33e679b29683085f353f905c5917ac28951314d2807e5481678ead3b044508e9c714cea