Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    15/03/2024, 03:11

General

  • Target

    HA_AoneiPodConvertor5.70_LRH.exe

  • Size

    8.0MB

  • MD5

    c62d2cca34ca7887025b3f4f11bd3a6e

  • SHA1

    4100d2cf195783a9da19759e5f1c9feb67e36b25

  • SHA256

    f1acb23347b35a271c722272ea50fb6db0b428f9d3c2d90173235903e052ed93

  • SHA512

    e46bd746397e0a367c1de8589633bd4082d7c9b1c35a59b1181474ddb2d72abdeb5f4008bef4b2a2e84f60f1235f1fdadd0df9a5f548ab4c031416d56e6ffb0c

  • SSDEEP

    196608:tf7wHTo/BWDFn1GURAKNfcpKMe0EkYkSNNKZp:t7wHTo/EDF11fcpjeW2ap

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\HA_AoneiPodConvertor5.70_LRH.exe
    "C:\Users\Admin\AppData\Local\Temp\HA_AoneiPodConvertor5.70_LRH.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: GetForegroundWindowSpam
    PID:2100

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsi1392.tmp\ioSpecial.ini

    Filesize

    679B

    MD5

    d51acd32e6ead4405a10e1aeb063cef4

    SHA1

    51a1da32c69cf6c000ff748a9fea77184aff5749

    SHA256

    31218906aa1e582527a6deea4e3f6ca029ed54d7513ba0ebd4a613fe80f1b991

    SHA512

    386453efafd7d7b7e9ffd53dffae89e1b4b28f5a3deb4e11dcc69835b6e5bcc7c4c737fc0e27e812712d803eebd9aca199f1717fb9967b29ab6206d7110f7f78

  • \Users\Admin\AppData\Local\Temp\nsi1392.tmp\brandingurl.dll

    Filesize

    3KB

    MD5

    9c3488b5e9655d1837c3963ecec33f70

    SHA1

    f0fa9b4c29e75c6e4419c4633d09f2797aee2ef3

    SHA256

    05ef4beb7fab9d04c1fb251874166fa2d73a34b4a7f2b145d37a2fd00c88979a

    SHA512

    6af9f88d65d2279a71620f2a656062b1737b3a9a1692ed4e5887bdee891ce08d21c5c0b25ab3acbe6da9fe255dcd7f8a517c2751e73dc56add216740c945e4a7

  • \Users\Admin\AppData\Local\Temp\nsi1392.tmp\installoptions.dll

    Filesize

    14KB

    MD5

    99a01229bfad8d31bf0ccf636f993393

    SHA1

    699c225ac447723d20bb786d18f4c95f5fd8951c

    SHA256

    58b6827090451254627c340ddc941cfdd87930606e3859bd29495ece878ca115

    SHA512

    bbf78a03004347cae25fab552e846dfd4873b39a2cc3613bc05a328a5a6cff026b13fa0653d3607197faccbabd4a9d97df2948bcf2ef5414e7d08cdfad6bbe15

  • memory/2100-0-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2100-89-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB