Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    136s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/05/2024, 07:18

General

  • Target

    HAB910_v1.4_230413.exe

  • Size

    32.1MB

  • MD5

    bb39a9e910c509b15109bad6f07a0812

  • SHA1

    0fc45d5b4fd6e96ac3a66317d8903892d7c97deb

  • SHA256

    acac2e1bad58381fb4fa36027b7e9e8fb15158ef32f36533953f0e24068fe634

  • SHA512

    3b31bb66201b1aacd763fa574d66ae25a32d9f1c60d77188bfdb852256e0b7689ec9aa0909520f983123af9b1818a4f6892fb842e8d27d581e954df710fed946

  • SSDEEP

    393216:u/gE/XyOav5Gj8CWSNs7Jhppvq3sYXXujTD7+z5R+EtFvTHhCfmdH1t/zRQk3Zbm:u/1fav5GI/SwJvpvq6SzV/hzXRwmPFQl

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

Processes

  • C:\Users\Admin\AppData\Local\Temp\HAB910_v1.4_230413.exe
    "C:\Users\Admin\AppData\Local\Temp\HAB910_v1.4_230413.exe"
    1⤵
    • Loads dropped DLL
    PID:3496

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsn422A.tmp\StartMenu.dll

    Filesize

    7KB

    MD5

    c275bc6ee70d85aebc2328c06515a2a2

    SHA1

    0f12e4736eff8f1a1a4c467e2f52eba2dac4e7e6

    SHA256

    30336c7b09582de438d6c3f561f55366dd7094faf24f34e12df44acf19be9242

    SHA512

    aeff89ebf093555aeaaa15f86e519523266b08e814578540430b3f2b67c6ad92a8e0072716f8ab80e6afc9a160a7bbaab0800b372107613d78793a9fd0fb9240

  • C:\Users\Admin\AppData\Local\Temp\nsn422A.tmp\System.dll

    Filesize

    11KB

    MD5

    b0c77267f13b2f87c084fd86ef51ccfc

    SHA1

    f7543f9e9b4f04386dfbf33c38cbed1bf205afb3

    SHA256

    a0cac4cf4852895619bc7743ebeb89f9e4927ccdb9e66b1bcd92a4136d0f9c77

    SHA512

    f2b57a2eea00f52a3c7080f4b5f2bb85a7a9b9f16d12da8f8ff673824556c62a0f742b72be0fd82a2612a4b6dbd7e0fdc27065212da703c2f7e28d199696f66e

  • C:\Users\Admin\AppData\Local\Temp\nsn422A.tmp\nsDialogs.dll

    Filesize

    9KB

    MD5

    eac1c3707970fe7c71b2d760c34763fa

    SHA1

    f275e659ad7798994361f6ccb1481050aba30ff8

    SHA256

    062c75ad650548750564ffd7aef8cd553773b5c26cae7f25a5749b13165194e3

    SHA512

    3415bd555cf47407c0ae62be0dbcba7173d2b33a371bf083ce908fc901811adb888b7787d11eb9d99a1a739cbd9d1c66e565db6cd678bdadaf753fbda14ffd09