Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/03/2024, 06:23

General

  • Target

    $0/uninstall.exe

  • Size

    78KB

  • MD5

    15c684cbe9b6a3d4b075b555dda6c3a5

  • SHA1

    9df0ff2343eb9d1e0e855a527ea2f47b9b69123f

  • SHA256

    ede89fd80817313dfe13954bd3d9d9231253dace78ed8d6d0f273d2230f0467f

  • SHA512

    e870477a2deb5834236b30a6a11600380886d5c4414260717c5b5c0989e41c40f259b6658f1e15f93f42a54889aa192b85cec09e6053eb05c5869496d3383d8c

  • SSDEEP

    1536:PEkjY1zy214Qay0DGkJ7qAELVigJSxhcpub3RsagxxZ/RL32/DH:8kjAJ4dDGkJ+AI0x+8hsagjZ/RLm/T

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • NSIS installer 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\$0\uninstall.exe
    "C:\Users\Admin\AppData\Local\Temp\$0\uninstall.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:460
    • C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
      "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\$0\
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:3312

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsk5FB5.tmp\InstallOptions.dll

    Filesize

    13KB

    MD5

    d765c492c21689e3d9d61634371fd861

    SHA1

    ac200933671ae52c9d5544d0e2e8e9144d286c83

    SHA256

    551e6042dd494ea01549555ffc194ab9729da09058ec714eb368dd06642c9bbc

    SHA512

    9919a9e848c8f1e26c75d0d29207571e4b86a4140bd554743d2c1f8bd7f386fe4919345b163d89a5d907fb165e435ba0ac5f6b1101713636141f156a420e2e0f

  • C:\Users\Admin\AppData\Local\Temp\nsk5FB5.tmp\System.dll

    Filesize

    10KB

    MD5

    fe24766ba314f620d57d0cf7339103c0

    SHA1

    8641545f03f03ff07485d6ec4d7b41cbb898c269

    SHA256

    802ef71440f662f456bed6283a5ff78066af016897fe6bfd29cac6edc2967bbd

    SHA512

    60d36959895cebf29c4e7713e6d414980139c7aa4ed1c8c96fefb672c1263af0ce909fb409534355895649c0e8056635112efb0da2ba05694446aec2ca77e2e3

  • C:\Users\Admin\AppData\Local\Temp\nsk5FB5.tmp\ioSpecial.ini

    Filesize

    650B

    MD5

    0e9ebf409db459aaa4ada3deaf05e777

    SHA1

    cf173727b4ae746ec595f4ee7ece174e42a4206a

    SHA256

    62e07237b2ad4b17eb5ffe450480a3598beebc5be585d2e2cf4d3492ea861202

    SHA512

    06892299c7b83d46f85c8fca07bef958d1bda38c9b09da4480e534b4312f8317c37b0f47d5d53ea2c364e2b5e727dfd9ad2b9aaa1fbf9323dd52299979d341ac

  • C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

    Filesize

    78KB

    MD5

    15c684cbe9b6a3d4b075b555dda6c3a5

    SHA1

    9df0ff2343eb9d1e0e855a527ea2f47b9b69123f

    SHA256

    ede89fd80817313dfe13954bd3d9d9231253dace78ed8d6d0f273d2230f0467f

    SHA512

    e870477a2deb5834236b30a6a11600380886d5c4414260717c5b5c0989e41c40f259b6658f1e15f93f42a54889aa192b85cec09e6053eb05c5869496d3383d8c