Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3NLBrute 1....en.zip
windows7-x64
1NLBrute 1....en.zip
windows10-2004-x64
1NLBrute 1....en.exe
windows7-x64
5NLBrute 1....en.exe
windows10-2004-x64
5NLBrute 1....64.exe
windows7-x64
5NLBrute 1....64.exe
windows10-2004-x64
5NLBrute 1....32.dll
windows7-x64
1NLBrute 1....32.dll
windows10-2004-x64
1masScan_1.6/Input.txt
windows7-x64
1masScan_1.6/Input.txt
windows10-2004-x64
5masScan_1....UI.exe
windows7-x64
1masScan_1....UI.exe
windows10-2004-x64
1masScan_1....et.dll
windows7-x64
1masScan_1....et.dll
windows10-2004-x64
1masScan_1...._3.exe
windows7-x64
7masScan_1...._3.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...ns.ini
windows7-x64
1$PLUGINSDI...ns.ini
windows10-2004-x64
1$PLUGINSDI...al.ini
windows7-x64
1$PLUGINSDI...al.ini
windows10-2004-x64
1$PLUGINSDI...er.bmp
windows7-x64
3$PLUGINSDI...er.bmp
windows10-2004-x64
7$PLUGINSDI...rd.bmp
windows7-x64
3$PLUGINSDI...rd.bmp
windows10-2004-x64
7$SYSDIR/Packet.dll
windows7-x64
1$SYSDIR/Packet.dll
windows10-2004-x64
1$SYSDIR/pthreadVC.dll
windows7-x64
1$SYSDIR/pthreadVC.dll
windows10-2004-x64
1$SYSDIR/wpcap.dll
windows7-x64
1$SYSDIR/wpcap.dll
windows10-2004-x64
1Analysis
-
max time kernel
92s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
20/02/2024, 09:07
Static task
static1
Behavioral task
behavioral1
Sample
NLBrute 1.2 x64 & VPN - KeyGen.zip
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
NLBrute 1.2 x64 & VPN - KeyGen.zip
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
NLBrute 1.2 x64 & VPN - KeyGen/NLBrute 1.2 x64 & VPN - KeyGen.exe
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
NLBrute 1.2 x64 & VPN - KeyGen/NLBrute 1.2 x64 & VPN - KeyGen.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
NLBrute 1.2 x64 & VPN - KeyGen/NLBrute 1.2 x64.exe
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
NLBrute 1.2 x64 & VPN - KeyGen/NLBrute 1.2 x64.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
NLBrute 1.2 x64 & VPN - KeyGen/libeay32.dll
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
NLBrute 1.2 x64 & VPN - KeyGen/libeay32.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral9
Sample
masScan_1.6/Input.txt
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
masScan_1.6/Input.txt
Resource
win10v2004-20231222-en
Behavioral task
behavioral11
Sample
masScan_1.6/Massscan_GUI.exe
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
masScan_1.6/Massscan_GUI.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
masScan_1.6/Packet.dll
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
masScan_1.6/Packet.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
masScan_1.6/WinPcap_4_1_3.exe
Resource
win7-20231215-en
Behavioral task
behavioral16
Sample
masScan_1.6/WinPcap_4_1_3.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20231215-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/bootOptions.ini
Resource
win7-20231215-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/bootOptions.ini
Resource
win10v2004-20231215-en
Behavioral task
behavioral21
Sample
$PLUGINSDIR/ioSpecial.ini
Resource
win7-20231215-en
Behavioral task
behavioral22
Sample
$PLUGINSDIR/ioSpecial.ini
Resource
win10v2004-20231215-en
Behavioral task
behavioral23
Sample
$PLUGINSDIR/modern-header.bmp
Resource
win7-20240215-en
Behavioral task
behavioral24
Sample
$PLUGINSDIR/modern-header.bmp
Resource
win10v2004-20231215-en
Behavioral task
behavioral25
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win7-20231215-en
Behavioral task
behavioral26
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win10v2004-20231215-en
Behavioral task
behavioral27
Sample
$SYSDIR/Packet.dll
Resource
win7-20231215-en
Behavioral task
behavioral28
Sample
$SYSDIR/Packet.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral29
Sample
$SYSDIR/pthreadVC.dll
Resource
win7-20240215-en
Behavioral task
behavioral30
Sample
$SYSDIR/pthreadVC.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral31
Sample
$SYSDIR/wpcap.dll
Resource
win7-20231215-en
Behavioral task
behavioral32
Sample
$SYSDIR/wpcap.dll
Resource
win10v2004-20231215-en
General
-
Target
NLBrute 1.2 x64 & VPN - KeyGen/NLBrute 1.2 x64 & VPN - KeyGen.exe
-
Size
2.5MB
-
MD5
62b039b2af7bf5f6abf35ef903024300
-
SHA1
4ae220e451482e839619c2e927752468e0eda8d5
-
SHA256
83d7f6eaf7fe075503ea6a0bc726633c34595a6eae7edd7deab95ab4d4a66fd5
-
SHA512
8abcf2fb422465fa578eb59e2788317ef88360551b675c964e03475a865e22dd4b86550bb442c1823fa72de059cedb438cac34538dcb291ccdb22fd34ee5433e
-
SSDEEP
49152:45U/Jdf39XFINkWr5kkYe6TdOYz44rcaMJIsjOO/ry3X0EdNZgJAxGEG8CZaFD:L79XaH5kheKdX4cjuR6q6XTNTI58Z
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1596 NLBrute 1.2 x64 & VPN - KeyGen.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1596 NLBrute 1.2 x64 & VPN - KeyGen.exe 1596 NLBrute 1.2 x64 & VPN - KeyGen.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NLBrute 1.2 x64 & VPN - KeyGen\NLBrute 1.2 x64 & VPN - KeyGen.exe"C:\Users\Admin\AppData\Local\Temp\NLBrute 1.2 x64 & VPN - KeyGen\NLBrute 1.2 x64 & VPN - KeyGen.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1596