Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/03/2024, 01:49

General

  • Target

    MainInstaller.exe

  • Size

    531KB

  • MD5

    9ce448dcd7cf13dd950725957361bdff

  • SHA1

    5831ff31825ea82d90a2989e0fc0a33b859d5f97

  • SHA256

    3dbc5aff076ef9c86a90ad30e963581f7cb22f8e212aa38db29d82cf45b73f80

  • SHA512

    b4a175da3677cd3380cb3789f281f2afb10aa00dc9592217062d66eb9b5e73805886b692975d7244cdd439d8d5bcd0eb5810533284ba4b13ff02a20b792bf74f

  • SSDEEP

    12288:z/8Ze69hm2S17Y/bv9VXXLVS+n28L6OdBCZrrf3xSEowuj6ZQM7gMWZQkN:zihc17YpVE+PGsB03xSEowuj6ZQM71WD

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • NSIS installer 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MainInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\MainInstaller.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4604
    • C:\Users\Admin\AppData\Local\Temp\Setup.exe
      C:\Users\Admin\AppData\Local\Temp\Setup.exe /PID=0 /NOTIFY=0 /FFR=1 /FFP=1
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2256
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1352 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:4344

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\Setup.exe

      Filesize

      505KB

      MD5

      5d8d0c08384ad73216d52a2eabc064f5

      SHA1

      0fa5c77fd6b6323b926c9648679e063d1bbc8bcc

      SHA256

      30522715240f4a05859099ac370dfb516097ab257402981c6a9ad31951f36cce

      SHA512

      42a3003019e39622082506c7ae50d8a27e2920fdfdf15eb9a8dbf7f1dbd49a02cd0390dabd74c136ed44e9d8ba270540ce9390f31aa84c2fc9fdfcc9e912dd57

    • C:\Users\Admin\AppData\Local\Temp\nsq3AB3.tmp\InstallOptions.dll

      Filesize

      14KB

      MD5

      325b008aec81e5aaa57096f05d4212b5

      SHA1

      27a2d89747a20305b6518438eff5b9f57f7df5c3

      SHA256

      c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

      SHA512

      18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

    • C:\Users\Admin\AppData\Local\Temp\nsq3AB3.tmp\ioSpecial.ini

      Filesize

      694B

      MD5

      781d575d4fa228d8c7633617b186f8d3

      SHA1

      cc0e03860342523d10ce788353b6f04894d4f3a4

      SHA256

      5f20cd209d1e9ecd22d61f579b26edcf042cded27055f6f02c0ce2a4ba13ce18

      SHA512

      cd2404782a15c6bbed9a6f464e1d6fed2c5cd771744d6801870c4a50f47e6be02891b300ca019df36774bdf8d8f43c3b0e6a7dd08bd8361403838e23730daa70