Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    170s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/03/2024, 23:56

General

  • Target

    bd233208f1839c8f352f97de36b36bb3.exe

  • Size

    6.5MB

  • MD5

    bd233208f1839c8f352f97de36b36bb3

  • SHA1

    2d4080d0fa4176dda7d9ca7d985e2956aaf65a93

  • SHA256

    630a76310508c5aa4cde07bd19374129306618751e71301673af4b77e8daec77

  • SHA512

    e2a614d4f65c5c37cdf871c40bad95fdfd6997dbfb1281ab5340f1eab909cf5a42fd3330a449617d2743219d476650bd2475cc5d31c0ebd2f1b30cea5c31b8b7

  • SSDEEP

    196608:HvOr8+kIIFthsGUNJdNZ/mAvKf6GZhk547:G8utfdNZ/m43Ik5o

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

Processes

  • C:\Users\Admin\AppData\Local\Temp\bd233208f1839c8f352f97de36b36bb3.exe
    "C:\Users\Admin\AppData\Local\Temp\bd233208f1839c8f352f97de36b36bb3.exe"
    1⤵
    • Loads dropped DLL
    PID:8
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3984 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:4276

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\nso7413.tmp\InstallOptions.dll

      Filesize

      14KB

      MD5

      325b008aec81e5aaa57096f05d4212b5

      SHA1

      27a2d89747a20305b6518438eff5b9f57f7df5c3

      SHA256

      c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

      SHA512

      18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

    • C:\Users\Admin\AppData\Local\Temp\nso7413.tmp\ioSpecial.ini

      Filesize

      728B

      MD5

      db1446e0f41cdfb27f55b5328624ec00

      SHA1

      d9e9dc234dd8f0bf02f9187c27c269a6d34a39c7

      SHA256

      44959090ee2267d32c616dccd1f0ce8ace280deda7c8e624cb19b22e518fe2c1

      SHA512

      a38b8472a0d30fe06982bfecf838ee3799ca86fd9912232b0551b3210dc4b76a55eea17005afac6c6e29696ab9138348db3021602b0a092237efd39258163118

    • C:\Users\Admin\AppData\Local\Temp\nso7413.tmp\registry.dll

      Filesize

      24KB

      MD5

      2b7007ed0262ca02ef69d8990815cbeb

      SHA1

      2eabe4f755213666dbbbde024a5235ddde02b47f

      SHA256

      0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d

      SHA512

      aa75ee59ca0b8530eb7298b74e5f334ae9d14129f603b285a3170b82103cfdcc175af8185317e6207142517769e69a24b34fcdf0f58ed50a4960cbe8c22a0aca