Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/04/2024, 08:21

General

  • Target

    06d04cd2bd662c1177757a7d866a03487b335950ef9de8a3188c794f1124c59a.exe

  • Size

    1.1MB

  • MD5

    7101c093b6dd6b748b143cf5a717072b

  • SHA1

    47ee4c8d25d718f1b0b49307403c32e602764009

  • SHA256

    06d04cd2bd662c1177757a7d866a03487b335950ef9de8a3188c794f1124c59a

  • SHA512

    c923fe4a9d6b34d1cf5ff3c80daf43c5d051801c0132ea8308eeb1700cf7283fc44c5f8b60cc4456a80c95b1c8a579c26323cbe3ff5aed7ce456c3c263c24ddc

  • SSDEEP

    24576:xfLOtoAsunvTFA50rpanO68GIMF1sR8Fw306AQ9FMiOfK:9OlvTQ1IzwsCFwE6AWUi

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

Processes

  • C:\Users\Admin\AppData\Local\Temp\06d04cd2bd662c1177757a7d866a03487b335950ef9de8a3188c794f1124c59a.exe
    "C:\Users\Admin\AppData\Local\Temp\06d04cd2bd662c1177757a7d866a03487b335950ef9de8a3188c794f1124c59a.exe"
    1⤵
    • Loads dropped DLL
    PID:1196

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsq2E93.tmp\InstallOptions.dll

    Filesize

    15KB

    MD5

    d095b082b7c5ba4665d40d9c5042af6d

    SHA1

    2220277304af105ca6c56219f56f04e894b28d27

    SHA256

    b2091205e225fc07daf1101218c64ce62a4690cacac9c3d0644d12e93e4c213c

    SHA512

    61fb5cf84028437d8a63d0fda53d9fe0f521d8fe04e96853a5b7a22050c4c4fb5528ff0cdbb3ae6bc74a5033563fc417fc7537e4778227c9fd6633ae844c47d9

  • C:\Users\Admin\AppData\Local\Temp\nsq2E93.tmp\LangDLL.dll

    Filesize

    5KB

    MD5

    50016010fb0d8db2bc4cd258ceb43be5

    SHA1

    44ba95ee12e69da72478cf358c93533a9c7a01dc

    SHA256

    32230128c18574c1e860dfe4b17fe0334f685740e27bc182e0d525a8948c9c2e

    SHA512

    ed4cf49f756fbf673449dca20e63dce6d3a612b61f294efc9c3ccebeffa6a1372667932468816d3a7afdb7e5a652760689d8c6d3f331cedee7247404c879a233

  • C:\Users\Admin\AppData\Local\Temp\nsq2E93.tmp\ioSpecial.ini

    Filesize

    1KB

    MD5

    07456afd4ba75ee4ec7e127e96030a07

    SHA1

    98e2bf37398d1c913f694431656205fc133c1248

    SHA256

    5d3429e761605bfc697d6a56a854f0939dc8ce961cc82bb037e22e0a976202dc

    SHA512

    4dbfc1d5eb93e92f7e6461977ab0c3dc167b4dec935106101169e81b39169709b61b2296b626f25d86cf943b9c7af13136145937a00c004fb6980eb26e521940