Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    102s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    08/07/2024, 19:38

General

  • Target

    $0/uninstall.exe

  • Size

    78KB

  • MD5

    326bab29f247b0d0b8438334af19d2a9

  • SHA1

    df0411d0ed56443af8015d2ffe54af67d627cb9a

  • SHA256

    f17b04164f332b6fefe9cf8280657940d45acd5f822816752b74ab0ce740f5cd

  • SHA512

    e357e9dea57e906b09b1c9fd8d50dd379ac065fd7c6c54be4f493cf7783269ab2e01630a8a82d914b8f131a747efc9684b9f26280d725d5520f6558dca4efdac

  • SSDEEP

    1536:PEkjY1zy214Qay0DGkJ7qAELVigJ/cfUcpuQMF2Ir1A2/D7:8kjAJ4dDGkJ+AI0aAkQ+2IrR/H

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • NSIS installer 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\$0\uninstall.exe
    "C:\Users\Admin\AppData\Local\Temp\$0\uninstall.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2800
    • C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
      "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\$0\
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: GetForegroundWindowSpam
      PID:2132

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nse93A9.tmp\ioSpecial.ini

    Filesize

    691B

    MD5

    92b523099463f29bf77936087afc0814

    SHA1

    180b9cf81cae126bd5de532a99bb024f9ae258a2

    SHA256

    d80b566de203b21ce0c3c4817b13a1b856d1bdce56e7008e4a36f24daf509cef

    SHA512

    cc737e54a25f55cee227c4c40edb2f6e2e7c30199b910719690df49ba0f69f721e06dacb65be82d87d3ae43063e12a55ea346cf664f462f4c2f8e1e1f4c4d305

  • C:\Users\Admin\AppData\Local\Temp\nse93A9.tmp\ioSpecial.ini

    Filesize

    730B

    MD5

    df454eb5667b212e0db1597dd59e469e

    SHA1

    c203662886d6edcd379bb4b18b3e3ace74b06858

    SHA256

    e1c590e2468288cbe624d6ded15946556052892c276493a523e55a8dfd734d32

    SHA512

    b7816213a5aacae5b80d09ec8a5d920968605ef848cac372580b1630a73613d0637dc6bf0df045313e9fb24c7268daa5e4f5b869fb73f9ab6ea9d42d3f94ed5b

  • \Users\Admin\AppData\Local\Temp\nse93A9.tmp\InstallOptions.dll

    Filesize

    13KB

    MD5

    d765c492c21689e3d9d61634371fd861

    SHA1

    ac200933671ae52c9d5544d0e2e8e9144d286c83

    SHA256

    551e6042dd494ea01549555ffc194ab9729da09058ec714eb368dd06642c9bbc

    SHA512

    9919a9e848c8f1e26c75d0d29207571e4b86a4140bd554743d2c1f8bd7f386fe4919345b163d89a5d907fb165e435ba0ac5f6b1101713636141f156a420e2e0f

  • \Users\Admin\AppData\Local\Temp\nse93A9.tmp\System.dll

    Filesize

    10KB

    MD5

    fe24766ba314f620d57d0cf7339103c0

    SHA1

    8641545f03f03ff07485d6ec4d7b41cbb898c269

    SHA256

    802ef71440f662f456bed6283a5ff78066af016897fe6bfd29cac6edc2967bbd

    SHA512

    60d36959895cebf29c4e7713e6d414980139c7aa4ed1c8c96fefb672c1263af0ce909fb409534355895649c0e8056635112efb0da2ba05694446aec2ca77e2e3

  • \Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

    Filesize

    78KB

    MD5

    326bab29f247b0d0b8438334af19d2a9

    SHA1

    df0411d0ed56443af8015d2ffe54af67d627cb9a

    SHA256

    f17b04164f332b6fefe9cf8280657940d45acd5f822816752b74ab0ce740f5cd

    SHA512

    e357e9dea57e906b09b1c9fd8d50dd379ac065fd7c6c54be4f493cf7783269ab2e01630a8a82d914b8f131a747efc9684b9f26280d725d5520f6558dca4efdac