Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240319-en
  • resource tags

    arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
  • submitted
    29/03/2024, 11:50

General

  • Target

    QDeskSetup1.1.1.6.exe

  • Size

    10.1MB

  • MD5

    413fd3e1d20e10b93ceb366b51bf6f53

  • SHA1

    e8a7d0c2ad2b4f923b56edecb547304f433eda07

  • SHA256

    4969529f962c7cbbb1c368b92dd2f99131c3ad6e5a12919b8aee8b47c92beacf

  • SHA512

    9b90b7ff03decc5154cc8e07a40e0d7f73fe7e110809550957d3fc841526c62a6ca785c417ae717e9cad7ebd3cc96fbb96d304933fc5b79b26c71e27f85081fd

  • SSDEEP

    196608:FC6Dc8zspBYxPYvYWAi19y5bx+ys/4OLQAFzTk9xRCk2KINKwXOIdpyVJ6:Fvzsp3vYm85b8yslZTcF8tXkI

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\QDeskSetup1.1.1.6.exe
    "C:\Users\Admin\AppData\Local\Temp\QDeskSetup1.1.1.6.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: GetForegroundWindowSpam
    PID:2024

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nso3620.tmp\ioSpecial.ini

    Filesize

    706B

    MD5

    9e852ff7375b83b21c9fa0d94379eb29

    SHA1

    0f9b35a414aed1c4b339c4f7fb13eed0e08a37eb

    SHA256

    9533d92f0f999877b787d663982ff7c4237fbfa18d3c173cd7d8dd162a842971

    SHA512

    0d21191bc68435f784ad7df772af3c9c1a2f6e29fc8528258e27c478229df5f4a7479728436a26599c2f09b5b7f928d28965e7e41407197beda748b86f329ea8

  • \Users\Admin\AppData\Local\Temp\nso3620.tmp\InstallOptions.dll

    Filesize

    14KB

    MD5

    20f3184efe7edddfef3325efc25d12a5

    SHA1

    8db4c500d73f9525a7e9834df6caea2e70189939

    SHA256

    0e014352b64abc431d97460d79757cbafbf6ba997c08b608c294e1f582af269a

    SHA512

    433188957a4603c9c61ec698a720021aacf61f46ccc32d5a11bcb6f2d0b1f01e5680635707d8a0ec7a9ef2aa2a85d6dec07ded452e4cb9e280062c0bed555c1a

  • \Users\Admin\AppData\Local\Temp\nso3620.tmp\LangDLL.dll

    Filesize

    5KB

    MD5

    ea60c7bd5edd6048601729bd31362c16

    SHA1

    6e6919d969eb61a141595014395b6c3f44139073

    SHA256

    4e72c8b4d36f128b25281440e59e39af7ec2080d02e024f35ac413d769d91f39

    SHA512

    f9dc35220697153bb06e3a06caf645079881cb75aed008dbe5381ecaf3442d5be03500b36bbca8b3d114845fac3d667ddf4063c16bc35d29bbea862930939993