Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
04/02/2024, 13:41
Static task
static1
Behavioral task
behavioral1
Sample
NordVPNSetup.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
NordVPNSetup.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral3
Sample
NordVPNSetup.exe
Resource
macos-20231201-en
General
-
Target
NordVPNSetup.exe
-
Size
1.7MB
-
MD5
59cb69a08fdd9cb4b0539e3356df1d4d
-
SHA1
0c773a0a76f821780c002d527bee387b98904569
-
SHA256
bea34078c360c71fcadc1a86ebd397d081f0d589913ad43970c1a3983231f522
-
SHA512
51d4f3d396d183bc5dcaaa0a26cf024fade9b5e5c0e73e1d2ee7663ba26bc55e799beb488d5bab8d8252147b33df6ea1209ebd730124a919940e899758842ec2
-
SSDEEP
24576:u7FUDowAyrTVE3U5Fg23TD2D+Fz3ifFUwo433RfFcdnOtksSm:uBuZrEUWq0t9D7l
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2840 NordVPNSetup.tmp -
Loads dropped DLL 4 IoCs
pid Process 1700 NordVPNSetup.exe 2840 NordVPNSetup.tmp 2840 NordVPNSetup.tmp 2840 NordVPNSetup.tmp -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2840 NordVPNSetup.tmp -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1700 wrote to memory of 2840 1700 NordVPNSetup.exe 28 PID 1700 wrote to memory of 2840 1700 NordVPNSetup.exe 28 PID 1700 wrote to memory of 2840 1700 NordVPNSetup.exe 28 PID 1700 wrote to memory of 2840 1700 NordVPNSetup.exe 28 PID 1700 wrote to memory of 2840 1700 NordVPNSetup.exe 28 PID 1700 wrote to memory of 2840 1700 NordVPNSetup.exe 28 PID 1700 wrote to memory of 2840 1700 NordVPNSetup.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\NordVPNSetup.exe"C:\Users\Admin\AppData\Local\Temp\NordVPNSetup.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\is-NJ4FL.tmp\NordVPNSetup.tmp"C:\Users\Admin\AppData\Local\Temp\is-NJ4FL.tmp\NordVPNSetup.tmp" /SL5="$40150,890440,866304,C:\Users\Admin\AppData\Local\Temp\NordVPNSetup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2840
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
59KB
MD5f9abdd3dc2af9a8f1a30eabd07f3e4a5
SHA151e5bce27cc827cc0f8cda32f56f9940161f7229
SHA2568bc258bfc826f232a58d943dbc6e1a49b70351612d5219a900f959189e444ae2
SHA512c760ced308257919bc6097c2a8f2372c6cb81f9d6c0f79b025163ac3d64c6aa79196e4d6818909b42417b6cce29174f642358accc9231feaa2dc19b694ccb020
-
Filesize
109KB
MD599645b0d0a302fd27c049f1724c4e819
SHA13a4836ca7894b5908311cacbbf88ef849428a011
SHA256bcf5fab5e18016895459b3672012c8ba13a87dfd17b95bac79c3fef5964a61fa
SHA5123dac2d2fd05d318f82d79f26984cd4b74a0fc87aea61bd0d0955477e2c3d12b83cecbf2c310063c26761ed8d6f89f9cb20ab2f532bcffeb8770dc90359d71976
-
Filesize
435KB
MD5ae89ceeea711cbb15500f0b3b633b4c5
SHA101a2855aa1407fe6004215c45c4bd9653066f849
SHA256f548dccf5d179d7233102a2b646db118f5eb1ac8f0baf06be42a3637f0fc89b2
SHA512577015efe072ede35688b2141d0d464e65ccf85a83d42374dc92bed6f04e022cfd7c101e0520541998789bef54895d32c1d12c2c4a83056acc2499037dfa95ee
-
Filesize
1.2MB
MD5b7765fc6f05ad11e2eff89b77beb6389
SHA15e091687407c69976c0e9a534f2cbf69cba3719e
SHA256b1c2a95ca75b45439fd891dbb921b87acf9e9e585a4e9d337e20a7a8e7582c10
SHA512978dde8676c1405741a53e04e519c69f68e783c151a185f459963aae0dd631abf0fc0b790ba00336fc536355ea70bf7ee233d8bfe32e8be00ced6584583966d8
-
Filesize
40KB
MD5fb3b4bb0ea4f23de6109281606a35c8e
SHA101fc9184e971407bf2c7bc4b4e5181c96a16e38b
SHA2565a8c26e985a7346e04d95e57373e7f65646d42f2403ccb24e5092d21d6a2a5b9
SHA5126481aa9610589fb9609d74c8daa70b527593833972540bbcfeef11bc1ec66544b77ad5517b06b46b3e157969593095045253487c57a6b712efba9f47b75873e6
-
Filesize
1.4MB
MD50879ed7bcbd2d9ada3b967d9c9d7326f
SHA164035b9d1f2942d788e6f42fd59242ae9ec6ec4c
SHA256567e436af74280817b8e54244d4e5b5d9e2b1a6577b00f6489579d9a8d5f9d0b
SHA512b265e157df6630b38dbdea1eae5bd4c4b5efa6fd5f21dea7d9b9cf823a4912b4cd5bfecbe65cb46d8da7c9636957f1bd19b56896827c5de5d1cf9ca35279bec8