Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    19/06/2024, 18:33

General

  • Target

    0a6ec10fa98122e1fcf01f504e8957dff9c4de5c533fe7f99b42a7c18d0bfc45.exe

  • Size

    72KB

  • MD5

    a15df6cad75c773ca2d4f92801ed47a9

  • SHA1

    0e39ba8c5935b80b196e8e965b69233c2fe80f85

  • SHA256

    0a6ec10fa98122e1fcf01f504e8957dff9c4de5c533fe7f99b42a7c18d0bfc45

  • SHA512

    fc578f72398a2a0885e302473aedbd1f78c4a8754cd9a9b8c2c085ecfb19601d8b65090fbc501cfdd7ebd09777d0bc96842cfb69f6256ea5c5c6db8ed4553763

  • SSDEEP

    1536:oLXB65939tY6HBg4sXJKxIjVlWmBX6CCtl8S8qcy4rLnVG:oLk395hYXJK+KpCC/8jy4fn

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • NSIS installer 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0a6ec10fa98122e1fcf01f504e8957dff9c4de5c533fe7f99b42a7c18d0bfc45.exe
    "C:\Users\Admin\AppData\Local\Temp\0a6ec10fa98122e1fcf01f504e8957dff9c4de5c533fe7f99b42a7c18d0bfc45.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2200
    • C:\Users\Admin\AppData\Local\Temp\nsd6F28.tmp\PogoGamesSetup.exe
      C:\Users\Admin\AppData\Local\Temp\nsd6F28.tmp\PogoGamesSetup.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of WriteProcessMemory
      PID:2748
      • C:\Users\Admin\AppData\Local\Temp\nsd8FC2.tmp\InstGameInfoHelperPDGC.exe
        "C:\Users\Admin\AppData\Local\Temp\nsd8FC2.tmp\InstGameInfoHelperPDGC.exe"
        3⤵
        • Executes dropped EXE
        PID:2588

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsd6F28.tmp\ftdownload.dat

    Filesize

    512B

    MD5

    c4554686c6fddea021ca6cd402fb6f16

    SHA1

    a3b0641a2398b4c3f8e596cd4404b3415b6503c9

    SHA256

    d45f058640c4c294cf2555fd70251286bd0bc836d9224d654e9d107d564e6556

    SHA512

    92236f28d48e4a072a772ad1e51f3435d42eb947254dcd449b6646bc86ce8f6396583dcd230856eea6e21618e4f6f8eb134cc1ab67088c8b9eedf3d919dced32

  • \Users\Admin\AppData\Local\Temp\nsd6F28.tmp\NSISdl.dll

    Filesize

    14KB

    MD5

    a5f8399a743ab7f9c88c645c35b1ebb5

    SHA1

    168f3c158913b0367bf79fa413357fbe97018191

    SHA256

    dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

    SHA512

    824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

  • \Users\Admin\AppData\Local\Temp\nsd6F28.tmp\PogoGamesSetup.exe

    Filesize

    45.6MB

    MD5

    36005a637bb8ec75ada6b8c18a36d824

    SHA1

    705df461833c7d3782e035a465e98736be4bc801

    SHA256

    4ee6bf01aadb0bc90bfce6e80862e20886338dc71114794384d874733873b444

    SHA512

    f4242a85f8d3204a8cc3acab46df3161d5045ecab2f15a694506fd9aa0603f74f2748fb96ad40df7f793e45795c7fb506b5c988476607a8227a29ce226c6248c

  • \Users\Admin\AppData\Local\Temp\nsd6F28.tmp\System.dll

    Filesize

    11KB

    MD5

    c17103ae9072a06da581dec998343fc1

    SHA1

    b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

    SHA256

    dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

    SHA512

    d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

  • \Users\Admin\AppData\Local\Temp\nsd8FC2.tmp\ButtonEvent.dll

    Filesize

    4KB

    MD5

    55788069d3fa4e1daf80f3339fa86fe2

    SHA1

    d64e05c1879a92d5a8f9ff2fd2f1a53e1a53ae96

    SHA256

    d6e429a063adf637f4d19d4e2eb094d9ff27382b21a1f6dccf9284afb5ff8c7f

    SHA512

    d3b1eec76e571b657df444c59c48cad73a58d1a10ff463ce9f3acd07acce17d589c3396ad5bdb94da585da08d422d863ffe1de11f64298329455f6d8ee320616

  • \Users\Admin\AppData\Local\Temp\nsd8FC2.tmp\InstGameInfoHelperPDGC.exe

    Filesize

    439KB

    MD5

    697f994b0b2f77418f4ff7c479b2b419

    SHA1

    9891834f745d30b73d22180a845289ad94c3a812

    SHA256

    9c2b9dbe13d6f8901d7609d4a3e2e292e964ad76fcb57a61a16ecea6f86b7513

    SHA512

    4339ea4daa31d73507bb776254ec9fbca6204ef8ebe7e5f03f6d9ffa3e48bf2544ca98984d12232c70180ab685fc9945bb6e7b6559d6c837773dc8643d0e6e0d

  • \Users\Admin\AppData\Local\Temp\nsd8FC2.tmp\nsExec.dll

    Filesize

    6KB

    MD5

    acc2b699edfea5bf5aae45aba3a41e96

    SHA1

    d2accf4d494e43ceb2cff69abe4dd17147d29cc2

    SHA256

    168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

    SHA512

    e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe