Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    23/05/2024, 20:33

General

  • Target

    uninstall.exe

  • Size

    87KB

  • MD5

    33a31007ff9cb4f4a2fef2e22b33ca5e

  • SHA1

    1be6277e76984da795471a7dc5e173a767720025

  • SHA256

    7ab2d70344ebd729c369e366ce5011ee906bfae9b648a0528eb66764da256aa1

  • SHA512

    c9dfab5bd3ca5204c28270861da695975b72df46a805f4fb9068b55f032978e253921bf407840834e3ed47443eaebcf336b1d42bbf840b224013af62d8b1e485

  • SSDEEP

    1536:WoM1dKyOSoYNXoK3LX78JBXJkUFh8gdLeAyN21tRrWsVqQTNAO51WVdh1NW6sM:HM1BjoYNXoKDIJBXJPIceAXMQTNAO7M/

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • NSIS installer 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\uninstall.exe
    "C:\Users\Admin\AppData\Local\Temp\uninstall.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2204
    • C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
      "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: GetForegroundWindowSpam
      PID:2224

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

    Filesize

    87KB

    MD5

    33a31007ff9cb4f4a2fef2e22b33ca5e

    SHA1

    1be6277e76984da795471a7dc5e173a767720025

    SHA256

    7ab2d70344ebd729c369e366ce5011ee906bfae9b648a0528eb66764da256aa1

    SHA512

    c9dfab5bd3ca5204c28270861da695975b72df46a805f4fb9068b55f032978e253921bf407840834e3ed47443eaebcf336b1d42bbf840b224013af62d8b1e485

  • \Users\Admin\AppData\Local\Temp\nsy1A07.tmp\LangDLL.dll

    Filesize

    5KB

    MD5

    6affaef1473695eb1325129879b5d12e

    SHA1

    626f362d322bd12543d1255678c70b577b0e916e

    SHA256

    df361cd0f1b68f3cfb0aa97a04a6d28eaf2ed4713e9717dbc86b25d46ddb0634

    SHA512

    f1d5a4c51e0bd2a644939df3722024d646f9bfc679b04964fc638f00e5191b8c02872f5a298c16f59a59a234d3cf6f929c98daec4d03c757e68ea8ee99580f6c