Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

nmap-7.60/...32.dll

windows7-x64

1

nmap-7.60/...32.dll

windows10-2004-x64

1

nmap-7.60/libssh2.dll

windows7-x64

3

nmap-7.60/libssh2.dll

windows10-2004-x64

3

nmap-7.60/ncat.exe

windows7-x64

1

nmap-7.60/ncat.exe

windows10-2004-x64

1

nmap-7.60/ndiff.bat

windows7-x64

1

nmap-7.60/ndiff.bat

windows10-2004-x64

1

nmap-7.60/ndiff.py

ubuntu-18.04-amd64

1

nmap-7.60/ndiff.py

debian-9-armhf

1

nmap-7.60/ndiff.py

debian-9-mips

1

nmap-7.60/ndiff.py

debian-9-mipsel

1

nmap-7.60/...te.exe

windows7-x64

1

nmap-7.60/...te.exe

windows10-2004-x64

1

nmap-7.60/nmap.exe

windows7-x64

1

nmap-7.60/nmap.exe

windows10-2004-x64

1

nmap-7.60/...93.exe

windows7-x64

7

nmap-7.60/...93.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

DiagReport.bat

windows7-x64

1

DiagReport.bat

windows10-2004-x64

1

DiagReport.ps1

windows7-x64

1

DiagReport.ps1

windows10-2004-x64

1

NPFInstall.exe

windows7-x64

4

NPFInstall.exe

windows10-2004-x64

4

NPFInstall2.exe

windows7-x64

4

NPFInstall2.exe

windows10-2004-x64

4

nmap-7.60/nping.exe

windows7-x64

1

nmap-7.60/nping.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    120s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    20/04/2024, 06:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    nmap-7.60/npcap-0.93.exe

  • Size

    715KB

  • MD5

    8faab76aa24d99b1e87f61c8d4dd3f18

  • SHA1

    41f206ca290afd00bc019afdf485d2704483077a

  • SHA256

    c3757e7f49bd40012ef9cd320568c401bad1ba1843a4055b11bebc2f10bd83ca

  • SHA512

    f4c78000a1d9f7930836811578715e3abbd7fc52607f9e96d8ab3d25f35bfb69a8e445d2f32d9741607c4ac2b71b992e1b53d16b3dd450e3bf8322be123dc9f5

  • SSDEEP

    12288:i3Lb6z7uM0bXuhuPeaPItATTaFO8ejup4cSUcDHWh9u/Qhj3fU3aqMzLjeIJVMwo:i3LaqMoje4ItAyc81pMUhQy3fU5KLjru

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\nmap-7.60\npcap-0.93.exe
    "C:\Users\Admin\AppData\Local\Temp\nmap-7.60\npcap-0.93.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Suspicious behavior: GetForegroundWindowSpam
    PID:2220

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\nsy5EC.tmp\System.dll
    Filesize

    10KB

    MD5

    56a321bd011112ec5d8a32b2f6fd3231

    SHA1

    df20e3a35a1636de64df5290ae5e4e7572447f78

    SHA256

    bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1

    SHA512

    5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3

    Download Submit