Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
3nssm-2.24-...og.vbs
windows11-21h2-x64
1nssm-2.24-...nv.vbs
windows11-21h2-x64
1nssm-2.24-...ry.vbs
windows11-21h2-x64
1nssm-2.24-...gs.vbs
windows11-21h2-x64
1nssm-2.24-...on.cmd
windows11-21h2-x64
1nssm-2.24-...sm.exe
windows11-21h2-x64
1nssm-2.24-...sm.exe
windows11-21h2-x64
1Analysis
-
max time kernel
90s -
max time network
203s -
platform
windows11-21h2_x64 -
resource
win11-20240419-en -
resource tags
arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system -
submitted
16/05/2024, 07:26
Static task
static1
Behavioral task
behavioral1
Sample
nssm-2.24-101-g897c7ad/ChangeLog.vbs
Resource
win11-20240508-en
Behavioral task
behavioral2
Sample
nssm-2.24-101-g897c7ad/src/env.vbs
Resource
win11-20240508-en
Behavioral task
behavioral3
Sample
nssm-2.24-101-g897c7ad/src/registry.vbs
Resource
win11-20240426-en
Behavioral task
behavioral4
Sample
nssm-2.24-101-g897c7ad/src/settings.vbs
Resource
win11-20240508-en
Behavioral task
behavioral5
Sample
nssm-2.24-101-g897c7ad/src/version.cmd
Resource
win11-20240419-en
Behavioral task
behavioral6
Sample
nssm-2.24-101-g897c7ad/win32/nssm.exe
Resource
win11-20240426-en
Behavioral task
behavioral7
Sample
nssm-2.24-101-g897c7ad/win64/nssm.exe
Resource
win11-20240508-en
General
-
Target
nssm-2.24-101-g897c7ad/src/version.cmd
-
Size
1KB
-
MD5
3e67b67b2ecb2d3042dfaa7d216883b1
-
SHA1
1e857c1fac7a99a8d280e219e9a8f1bd4d315a5d
-
SHA256
15b426e1c03c0976c9b133f82553da5c7e9cf3320dbb3b5cf269854afc80b548
-
SHA512
6482ee84a35462f38468cf3d4e31841524d4ad4b1bae9ac24df6f24c74676a8fe8c3999461698ec4e29bcfc57c9e1348795454edc9d95380c020dfdd5ba71407
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 5092 wrote to memory of 2232 5092 cmd.exe 80 PID 5092 wrote to memory of 2232 5092 cmd.exe 80 PID 5092 wrote to memory of 3756 5092 cmd.exe 81 PID 5092 wrote to memory of 3756 5092 cmd.exe 81
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\nssm-2.24-101-g897c7ad\src\version.cmd"1⤵
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c git describe --tags --long2⤵PID:2232
-
-
C:\Windows\system32\fc.exefc version.h version.h.new2⤵PID:3756
-