Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    05/06/2024, 13:14

General

  • Target

    Install_Xfer_Serum_130b9.exe

  • Size

    163.1MB

  • MD5

    0439beec0cc7c002c40deb110d68ac86

  • SHA1

    6841ab3237cd06e2e5ce8e561cede8c3bb197888

  • SHA256

    ca9fa20f5cecf6a9988527835dc9cae2f03efa22b0e3a19f844161d709acfc63

  • SHA512

    7ed3f500c401db788cef8a3912b29f774342fb0469bf46f859167f7803a6e0a2afe8d3f99663ff967d2026594bdcd498dff93be6fadc96f6132292b5d5db54d6

  • SSDEEP

    3145728:jgAjN8KwGOZeuA2jvP2E2pJTCT+qBWAYO+WbaI4T3UEcbWFS:jN8+VuACPh2pJTwfc3U1yS

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Install_Xfer_Serum_130b9.exe
    "C:\Users\Admin\AppData\Local\Temp\Install_Xfer_Serum_130b9.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: GetForegroundWindowSpam
    PID:1976

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\nsd14AA.tmp\System.dll

    Filesize

    11KB

    MD5

    b0c77267f13b2f87c084fd86ef51ccfc

    SHA1

    f7543f9e9b4f04386dfbf33c38cbed1bf205afb3

    SHA256

    a0cac4cf4852895619bc7743ebeb89f9e4927ccdb9e66b1bcd92a4136d0f9c77

    SHA512

    f2b57a2eea00f52a3c7080f4b5f2bb85a7a9b9f16d12da8f8ff673824556c62a0f742b72be0fd82a2612a4b6dbd7e0fdc27065212da703c2f7e28d199696f66e

  • \Users\Admin\AppData\Local\Temp\nsd14AA.tmp\advsplash.dll

    Filesize

    5KB

    MD5

    74fcb6435b746349a712dd9213975ffd

    SHA1

    0cd54fcd81488ba6d39ee0d832117c4f3dfa80dc

    SHA256

    12a4ea944895e42a8119e7fca3b9e73e881faf774e39b9c9d4d9efb4a19ffb00

    SHA512

    2ab77aef5e758a7b3018d5c45e60b6154faca92384609902bb2445234a9e8bc526f8a70961a1d8c2acebd68a9bf8b8b6fe7d4a4542a9cf0e53930aa9b30ade80

  • \Users\Admin\AppData\Local\Temp\nsd14AA.tmp\nsDialogs.dll

    Filesize

    9KB

    MD5

    eac1c3707970fe7c71b2d760c34763fa

    SHA1

    f275e659ad7798994361f6ccb1481050aba30ff8

    SHA256

    062c75ad650548750564ffd7aef8cd553773b5c26cae7f25a5749b13165194e3

    SHA512

    3415bd555cf47407c0ae62be0dbcba7173d2b33a371bf083ce908fc901811adb888b7787d11eb9d99a1a739cbd9d1c66e565db6cd678bdadaf753fbda14ffd09