Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    20/07/2024, 00:59

General

  • Target

    Uninstall.exe

  • Size

    148KB

  • MD5

    ac1987eb85b44e639f0cad7c0720086e

  • SHA1

    22f3c6708cebe5a2b9c393c0340ae338e2539fbd

  • SHA256

    54f5304e6f4261bc953722f44fc79765962dd4c5013ecac4fe931f98376fa4b4

  • SHA512

    e892b2e6288aedae67566e2b078e5fb712efb2e6b852a2e9a1af58bf0f5b6e717983c463592e99fbda36409370752c4b98070fe7036542c9a04f4ec09d3f951b

  • SSDEEP

    3072:gk5+bFdkJYYschIykPtTIJLDaDKvheeLJsDcbUeEPEiKKVKuU8:V0FWJnaDKv5LCgEcKnH

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 6 IoCs
  • NSIS installer 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Uninstall.exe
    "C:\Users\Admin\AppData\Local\Temp\Uninstall.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2868
    • C:\Users\Admin\AppData\Local\Temp\A~NSISu_.exe
      "C:\Users\Admin\AppData\Local\Temp\A~NSISu_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: GetForegroundWindowSpam
      PID:2692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nso19BA.tmp\ioSpecial.ini

    Filesize

    655B

    MD5

    fce26fdb3037354e135174f633851cfe

    SHA1

    1367c4db1aad2cbdb1c72770a6289be4f52bca4b

    SHA256

    b532bc19a7b6b0096c9b26a7944c736ac49e33678f21e22de4520b74e4938f73

    SHA512

    136a23e4a64921339ba724b5266b5fbedaeefe18b6f1863b705570eb6747a1c9282f6e1be0f76a49d86cd9ad6fb43772d00841e33a3133d947d41a97114d8b22

  • \Users\Admin\AppData\Local\Temp\A~NSISu_.exe

    Filesize

    148KB

    MD5

    ac1987eb85b44e639f0cad7c0720086e

    SHA1

    22f3c6708cebe5a2b9c393c0340ae338e2539fbd

    SHA256

    54f5304e6f4261bc953722f44fc79765962dd4c5013ecac4fe931f98376fa4b4

    SHA512

    e892b2e6288aedae67566e2b078e5fb712efb2e6b852a2e9a1af58bf0f5b6e717983c463592e99fbda36409370752c4b98070fe7036542c9a04f4ec09d3f951b

  • \Users\Admin\AppData\Local\Temp\nso19BA.tmp\InstallOptions.dll

    Filesize

    12KB

    MD5

    57db62366ef11fdc47922a02031f0492

    SHA1

    6d30db5285b653025f94e74b9b045870dc0aeb7a

    SHA256

    2338752092918db8e068d55bea61f8cdeb9be37b6e6d30a730d9703b169b08b4

    SHA512

    d0257e02370863e07feb9346b88d87a102089f0c48aea13e069e55a14f0f6db51fb3d5f41ed5d2f39e36b612f4b6194a6b7c059709808bfb23ded89d0b0a3db5

  • \Users\Admin\AppData\Local\Temp\nso19BA.tmp\UserInfo.dll

    Filesize

    4KB

    MD5

    593345196fcd1c553b0702cc026ccccd

    SHA1

    84446849c10e0c4d6683072f4c2eea5a085bac2f

    SHA256

    fb4a4bea088b8dbf2adda6fdeb50be4b96bf20ba62bd9ac64b68ea628166a28d

    SHA512

    b28da01bec7a34a493316606c7406c06d0b278f1318563874f037caf203c2ec261c3f5c2a1790c6c177537bbb0f4dd0b7be482976f7114f70be75b5e4b311306