Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    10s
  • max time network
    26s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240221-en
  • resource tags

    arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    25/02/2024, 00:47

Errors

Reason
Machine shutdown

General

  • Target

    NoPingSetup.exe

  • Size

    104.0MB

  • MD5

    8ddb03b1ca26db7e67fdcdc72a1fe8e6

  • SHA1

    c36ea15daf1d7714e6b07b74ad7a2855c0bc85e0

  • SHA256

    afafbdec1ba92a21549741d7a07d98a94e5986642f3fc87621cedf557f9ed6b0

  • SHA512

    7dd7948c95a70f2e644b2185933fcdfd7b9302d2d32278272cc613b228ea039a241814f9fe2dea12eb25c695eadb85789e3002b8406e8669e0dd54ce46c913a3

  • SSDEEP

    1572864:oiJX0FGgQi+annVsZl6CpzVtGPE+/aUQZIf/3NTMMqw7ALIo7KOpttD7y0/5QB6y:za7PVM0E+3+/wcL1De0/i4kDe0/F

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 19 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NoPingSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\NoPingSetup.exe"
    1⤵
    • Loads dropped DLL
    • Enumerates connected drives
    • Drops file in Windows directory
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:736
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\NoPing\NoPing\prerequisites\Windows Packet Filter 3.2.32.1 x64.msi" /qn
      2⤵
        PID:2852
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Blocklisted process makes network request
      • Enumerates connected drives
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1008
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 32F77BC6296AAF783CB150B9649127E0 C
        2⤵
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4952
        • C:\Users\Admin\AppData\Local\Temp\NoPingSetup.exe
          "C:\Users\Admin\AppData\Local\Temp\NoPingSetup.exe" /groupsextract:102; /out:"C:\Users\Admin\AppData\Roaming\NoPing\NoPing\prerequisites" /callbackid:4952
          3⤵
            PID:1104
        • C:\Windows\syswow64\MsiExec.exe
          C:\Windows\syswow64\MsiExec.exe -Embedding 21E21994983757EF5F00FCDAB45E5A86 E Global\MSI0000
          2⤵
            PID:4500
            • C:\Windows\system32\certutil.exe
              "C:\Windows\system32\certutil.exe" -addstore -f "TrustedPublisher" "C:\Program Files\Windows Packet Filter\certificates\root.cer"
              3⤵
                PID:5380
              • C:\Windows\system32\netcfg.exe
                "C:\Windows\system32\netcfg.exe" -v -l "C:\Program Files\Windows Packet Filter\drivers\ndisrd_lwf.inf" -c s -i nt_ndisrd
                3⤵
                  PID:5460
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
              1⤵
                PID:5516
                • C:\Windows\system32\DrvInst.exe
                  DrvInst.exe "4" "1" "C:\Program Files\Windows Packet Filter\drivers\ndisrd_lwf.inf" "9" "4fed96993" "0000000000000154" "WinSta0\Default" "0000000000000164" "208" "C:\Program Files\Windows Packet Filter\drivers"
                  2⤵
                    PID:5552

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\PROGRA~1\WINDOW~1\drivers\ndisrd.cat

                  Filesize

                  10KB

                  MD5

                  57f18ba4482ce389813f1d9a7e4c25e2

                  SHA1

                  80952e76258d61bb2857a2cdad0b5f08d23f3f50

                  SHA256

                  b5d021d96b29b9c961c135dc992b68aea4380653b7179747b0f39e4a019a6f57

                  SHA512

                  f5812729085dfe557c2e48a74168064f501a274ea0f6bfbd590b67bd144a48d6b8576f04739b53d871fdb999ff7f5c2e6a7d025ae6d561eca1a376c4983efea8

                • C:\PROGRA~1\WINDOW~1\drivers\ndisrd.sys

                  Filesize

                  56KB

                  MD5

                  36b09f1926e69866333f33a87ae87c54

                  SHA1

                  120c914cb5a1c96971514a392acb9150ed1d748d

                  SHA256

                  8e9a3db5d50cea173fcf7f93552bd62846af4b92cafa8c25e55fff88a5a1d364

                  SHA512

                  3f4c6fd484666f4a4942ca92e124a48e3d1f3891ac613b6e14a79c2f9036006162ea46bcbcdd6901abeadbe45785f82561acd827299ab87000f626d644dea920

                • C:\Program Files\Windows Packet Filter\certificates\root.cer

                  Filesize

                  1KB

                  MD5

                  6a3ba8df688d08464008efa7ae49be8d

                  SHA1

                  fdb7cffe05417c221025e753bc3999e44d10c22a

                  SHA256

                  a09f01679b590ef637341dc874fb846581caecff0571036493ac42f4ff9ce335

                  SHA512

                  6109c023c87b1688b542baca5f94a7d4029e83fafbdec6e5dac811c80fb6ad7a17073a8896bae2a12620e21a364a75945e2fbfba7380a65a2ad665597c201788

                • C:\Program Files\Windows Packet Filter\drivers\ndisrd_lwf.inf

                  Filesize

                  2KB

                  MD5

                  7037faf01371f8f2b40acd965624f564

                  SHA1

                  df69062aeef984b957290d6b9216319ef19a8a57

                  SHA256

                  bff2d6c7975e221074c2a20c74f8671f191e7a43dcf9e7435366213dc40ac993

                  SHA512

                  29758763b23efd18f037c9695eb4f949feebfa15e41e2cfe3635d1163515e349fdc95de595215e5996ea3f6db1b15ee2f28c968e788b78e43b6dcf46dd04c0ed

                • C:\Users\Admin\AppData\Local\AdvinstAnalytics\5d51b84050869a5337d42184\2.15.8\tracking.ini

                  Filesize

                  84B

                  MD5

                  59f98bd7304552fc5b08b69c874b512c

                  SHA1

                  5a07a8eb582309a6a148eb408cd520e9955b295d

                  SHA256

                  604dcfc19a650bbddb7a718e62608969abebdbc812952fe2f42c48b8c1731168

                  SHA512

                  e6950c3f39556d01bb05443a9867ac643a798c60d623adbaff47aebc2da8ce3ebc66e3c13e525ec8956b80c36651e84ebd5786dbe99525965b573e1d82711990

                • C:\Users\Admin\AppData\Local\AdvinstAnalytics\5d51b84050869a5337d42184\2.15.8\{0E96B3D7-9307-4367-B620-6ECBFD2852D4}.session

                  Filesize

                  9KB

                  MD5

                  b5dc2c3725eeb0d50fc43f8d72a6a775

                  SHA1

                  7babda2f2b8ad020545a343060ecdd94d9e858f5

                  SHA256

                  6c10155cbc30998aeef300d83f8a62765dd3eae6a779ded9b7e5d21e0a4f80e6

                  SHA512

                  463038c08ff32b710270a653d06c1b21602ea1d297679ab81e658e49c94c9d1b34306d711b416cbd3975e3b5f6498c081fec3420b7b40fb76646cedf2becc549

                • C:\Users\Admin\AppData\Local\AdvinstAnalytics\5d51b84050869a5337d42184\2.15.8\{0E96B3D7-9307-4367-B620-6ECBFD2852D4}.session

                  Filesize

                  9KB

                  MD5

                  297928f403439c2a3f52e879f370eab5

                  SHA1

                  1f7ea6d226c46a0f23a724cf7773e670c5b69cc3

                  SHA256

                  2471aea26d8ab4781b728086e24953b3078975ac0e774a64338bd46ef3992357

                  SHA512

                  b41209cfc19e28956e3bc47be9db74fab4c592a08e07e8ea504b991e2f63974a54de1f9848e7af57c9ba5cd14260165a4ac2c0a581d2c76a7713711c3d2d68e8

                • C:\Users\Admin\AppData\Local\Temp\AIEA41F.tmp

                  Filesize

                  5.2MB

                  MD5

                  6ff72f6da902335ed1150e1fc33d8851

                  SHA1

                  1eb6d898e64034db4e022c1a2c983322105904d8

                  SHA256

                  1b8e9fb8cf87de84fede1609bb6e0af3bd14923770b2e5b5dbdc8a3af1f417e8

                  SHA512

                  725167db08e7b55c7ad0a73dd7426b25d2b34be3bc33229b208df6ff10b5807b825f4c13e6c5d9eaa15ec018190ecb763b78368dab48187a49375209660108dc

                • C:\Users\Admin\AppData\Local\Temp\AIEA41F.tmp

                  Filesize

                  5.2MB

                  MD5

                  0e4e992c2b43f0d4ff1ea59d358d9f05

                  SHA1

                  0173a0205bb6672919dff22e0a227450f176fe76

                  SHA256

                  d6839e192acb2f90e39e7022d65fba4560c8f825e138d2e06da04a2842a54610

                  SHA512

                  0464e399caef55b176b03ca80326f989ab00a02405485dd69c3ec14a65acff6a24b5ebf86291f495be8362e2073d5e640fecc87961656cc380da1644bb0ccbf6

                • C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_736\nopingbackground.bmp

                  Filesize

                  455KB

                  MD5

                  62268f7fd11af4a8a880d9c61113e7cc

                  SHA1

                  de0b193cfebf92774df0093367136e4fd594a88e

                  SHA256

                  4a17c06e672d3b997089b4c99137703c82be31e21888c12d5dbd5db9128dc50f

                  SHA512

                  aebf0c88f981a785e7334616cde72e82fe7605aca70d35bec075245f9f7339ef443d7e27b99ec505e909d96e6e678706fc800ecb9b7ce23812cd1faa057b9821

                • C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_736\nopingcapa.bmp

                  Filesize

                  87KB

                  MD5

                  ca3b4618805596be0f16c9563ded4eeb

                  SHA1

                  6f55762a98819218819bd744cd84e5f5d1796643

                  SHA256

                  eae47f71faafd5c6597f2c0ad030168500be7d5e8dff908e9d0c8804b2f9ee4d

                  SHA512

                  abceeff59d3a28672e9f44be00405c5ae54ca193bdb36ef76fc307b827eeae7f10fa0003e8395fe5d770d2bcdba6902c40642de00fd3ee25919132df9ba442d2

                • C:\Users\Admin\AppData\Local\Temp\INAAEDE.tmp

                  Filesize

                  727KB

                  MD5

                  6477efb82f12b11bae7a8a10cbe02d7e

                  SHA1

                  35ee1331af5d78f76b9a3aba5437d1058f31d834

                  SHA256

                  40c0576c36198324cf0b6bc7a812d974c53fec4ccc0d5d3cac10bfd2e8073e42

                  SHA512

                  39ad79bdeeaf76bacf6ce5e80c622c4330b79e0dab16e675a0fc0855189ec6c954de61c02adbd932db782176aec1ecf33a54f3909bbff44cc34a2a4a162be9ee

                • C:\Users\Admin\AppData\Local\Temp\MSIAF8C.tmp

                  Filesize

                  376KB

                  MD5

                  c39daeba173815516c180ca4361f7895

                  SHA1

                  db3ae54329834baa954569a35be5b947c86dc25e

                  SHA256

                  a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc

                  SHA512

                  e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929

                • C:\Users\Admin\AppData\Local\Temp\MSIB039.tmp

                  Filesize

                  834KB

                  MD5

                  b0b2090c4200fb19e335598969a40f26

                  SHA1

                  e31d5533f85ef03dd8eb21723df14ff71586bb60

                  SHA256

                  e16ce1f8a1b24d03353502af35fa159ab9962b4ecce8f3bb9dd4b075552505cd

                  SHA512

                  177dad69d6773dab432a39a91f113949573caa3f3513e1e79361e9d74efe813746bd25a9101ec6436be7476cd77b663102d7ee138a01afbc902738e3ad75fce2

                • C:\Users\Admin\AppData\Local\Temp\MSIB531.tmp

                  Filesize

                  525KB

                  MD5

                  1c62521f4ade74fe465aaf61049c3634

                  SHA1

                  758bd079f98c5f1153213a4c78ee25f89eb64fa6

                  SHA256

                  ae5544ebfa8d92072562dcc4f3a6b48e77ab1a1e263e8e8dabebf6a627286f9e

                  SHA512

                  4b58f0216f2dcfff69f3e668d09e21c0c85a7087a01621f43a787344afcf31d05644b9374b2ee4719b2ede0019d88083104f7a8122409c1ea961a9c5016262fd

                • C:\Users\Admin\AppData\Local\Temp\shiB548.tmp

                  Filesize

                  1.5MB

                  MD5

                  49837c8e11395b788ed57ae565c2d528

                  SHA1

                  a94cfc43658c26c708ebd696512a19bee642ba4d

                  SHA256

                  da58d01b7d1ca0ede5551baf411a90f948564a659e1dd78e0b56b45d419709b7

                  SHA512

                  65e63c038802f066ebdca24a4c24682a4e84bda029652adfc0b2011cd619ea10cccacb751b3266b838fb040de340d80973f58a317ccbec3a3c720af01b34b94d

                • C:\Users\Admin\AppData\Local\Temp\shiB578.tmp

                  Filesize

                  85KB

                  MD5

                  9055f8ba2eb52ec3d998d9a10201227e

                  SHA1

                  bbbb67ed2c844f6b99824072a615317596ebe5cb

                  SHA256

                  be69a9ade29f36d5da7aeff9dcfc521cf226b3b8a9d99e465be9db3cc56143ae

                  SHA512

                  207b8c264cd73ec983ee431fd7647ab6e80d37bd3aec0a6ea4474540607e77ea75d8389cea20a18b7d312dcefb71d630bb96895793c1d106bab0f590a56cb7b8

                • C:\Users\Admin\AppData\Roaming\NoPing\NoPing 2.15.8\install\1033.dll

                  Filesize

                  105KB

                  MD5

                  1b4e214ecaed73d23fbc5bc8534474e6

                  SHA1

                  f5e6dda10f04718866f6e5fc516f77e6425ceb01

                  SHA256

                  13757a6ce2be8f00ebf38ad4c9e2c44bf416d474a87d7bec808a1640473d51bc

                  SHA512

                  e19e6363402f9d46662d0a3a630b9ae064802ea314523b480ac5fa6f8bc9801c9bfa2fb66c49449250fbf274551bd82695c9486e9736d306f23b7fbe00a17ca9

                • C:\Users\Admin\AppData\Roaming\NoPing\NoPing 2.15.8\install\decoder.dll

                  Filesize

                  182KB

                  MD5

                  fc136d5c16573d1d1a64b0a62b586235

                  SHA1

                  8363d0d80fb25e4ace7b77efcfe119b7675913a1

                  SHA256

                  5a12236a02ba2984b62d7acfe5afb048e461fc4c76989d055ffe8965f212ebbf

                  SHA512

                  0ad82e28de1a65251eb536aef9739a76baaaa28a41dae78faacb82a9d1acd83d71816051dec16b7664e16a741706803d1fc0ad914bcdca4d28cb2ac2a05ff427

                • C:\Users\Admin\AppData\Roaming\NoPing\NoPing\prerequisites\Windows Packet Filter 3.2.32.1 x64.msi

                  Filesize

                  628KB

                  MD5

                  0dd117284e8e5c456116876acd81bb96

                  SHA1

                  caaeebd848aa6296b08a85e03164d8f922d3925e

                  SHA256

                  39ffe8ac933a53f0bfe1fe3a61065f597c48b53572a7a744867a028e391005f0

                  SHA512

                  a3f224e09a650396793659636a96bd57aa05d61ad0f5961393794dd8509cb41c80902cb47fbec95583a4e426dc49a13d08e92f011883a80792f7779130ca4e08

                • C:\Windows\Installer\MSIC322.tmp

                  Filesize

                  211KB

                  MD5

                  a3ae5d86ecf38db9427359ea37a5f646

                  SHA1

                  eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

                  SHA256

                  c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

                  SHA512

                  96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0