Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

81581c33df...0N.exe

windows7-x64

7

81581c33df...0N.exe

windows10-2004-x64

7

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...te.exe

windows7-x64

1

$PLUGINSDI...te.exe

windows10-2004-x64

1

$PLUGINSDI...er.exe

windows7-x64

3

$PLUGINSDI...er.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    120s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    26/07/2024, 05:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    81581c33dfd8c0267f75451889578b50N.exe

  • Size

    241KB

  • MD5

    81581c33dfd8c0267f75451889578b50

  • SHA1

    1ca0a6b3a8a7c0fb81f2442dfb9ff4c64c183b65

  • SHA256

    54efb30e5161634a4fa82764ac3e3e79df8ea317601396e845343851190bfeb3

  • SHA512

    9f4986c412ee792ebd0993b59d8315e27f835906d20f9e175bfa6886573524e4c93cb820f0beae16ad2116e52b5815fa6f79dac7fdb2e2080c71a57831d548db

  • SSDEEP

    6144:jfL+oqZk4pr2A+O/LE11c7ojuZUvyejrR3:jfLikHR11GojuHefR3

Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 44 IoCs
  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\81581c33dfd8c0267f75451889578b50N.exe
    "C:\Users\Admin\AppData\Local\Temp\81581c33dfd8c0267f75451889578b50N.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2852
    • C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\aspartate.exe
      "C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\aspartate.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:2680
    • C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\aspartate.exe
      "C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\aspartate.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:3044
    • C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\remoter.exe
      "C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\remoter.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2564
    • C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\remoter.exe
      "C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\remoter.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2596
    • C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\aspartate.exe
      "C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\aspartate.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:320
    • C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\aspartate.exe
      "C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\aspartate.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:3000
    • C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\remoter.exe
      "C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\remoter.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:592
    • C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\remoter.exe
      "C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\remoter.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2872
    • C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\aspartate.exe
      "C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\aspartate.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:2900
    • C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\aspartate.exe
      "C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\aspartate.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:1040
    • C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\remoter.exe
      "C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\remoter.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:496
    • C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\remoter.exe
      "C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\remoter.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2640
    • C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\aspartate.exe
      "C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\aspartate.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:2096
    • C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\aspartate.exe
      "C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\aspartate.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:2076
    • C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\remoter.exe
      "C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\remoter.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:1484
    • C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\remoter.exe
      "C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\remoter.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:696
    • C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\aspartate.exe
      "C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\aspartate.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:556
    • C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\aspartate.exe
      "C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\aspartate.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:1336
    • C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\remoter.exe
      "C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\remoter.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:1628
    • C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\remoter.exe
      "C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\remoter.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2428
    • C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\aspartate.exe
      "C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\aspartate.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:1728
    • C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\aspartate.exe
      "C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\aspartate.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:1156
    • C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\remoter.exe
      "C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\remoter.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:900
    • C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\remoter.exe
      "C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\remoter.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1568
    • C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\aspartate.exe
      "C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\aspartate.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      PID:2796
    • C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\aspartate.exe
      "C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\aspartate.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      PID:2780
    • C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\remoter.exe
      "C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\remoter.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2776
    • C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\remoter.exe
      "C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\remoter.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2536
    • C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\aspartate.exe
      "C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\aspartate.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      PID:668
    • C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\aspartate.exe
      "C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\aspartate.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      PID:1956
    • C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\remoter.exe
      "C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\remoter.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1224
    • C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\remoter.exe
      "C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\remoter.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:836
    • C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\aspartate.exe
      "C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\aspartate.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      PID:2920
    • C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\aspartate.exe
      "C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\aspartate.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      PID:1540
    • C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\remoter.exe
      "C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\remoter.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2908
    • C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\remoter.exe
      "C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\remoter.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:448
    • C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\aspartate.exe
      "C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\aspartate.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      PID:2964
    • C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\aspartate.exe
      "C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\aspartate.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      PID:772
    • C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\remoter.exe
      "C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\remoter.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1932
    • C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\remoter.exe
      "C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\remoter.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2052
    • C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\aspartate.exe
      "C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\aspartate.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      PID:2328
    • C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\aspartate.exe
      "C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\aspartate.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      PID:3036
    • C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\remoter.exe
      "C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\remoter.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:992
    • C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\remoter.exe
      "C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\remoter.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1604

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nse1AB3.tmp\aspartate.exe
    Filesize

    189KB

    MD5

    9101a7f1e09281d413ece6d825020d92

    SHA1

    9df34287601a77e65cec58843474108dd0309f54

    SHA256

    781c6b118a97dd0301788d1882b18242d2768ad40752cb622f70e80d7e3a0a88

    SHA512

    8f3e5068f47817593ddd3eeb48848a1a49ffbb62fbc935c3d90757625ab3aec2e19f34d45b583dbe39dbd5cad11e00e0eb888dda6ffa9952b0851d0ada616425

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nse1AB3.tmp\System.dll
    Filesize

    12KB

    MD5

    4add245d4ba34b04f213409bfe504c07

    SHA1

    ef756d6581d70e87d58cc4982e3f4d18e0ea5b09

    SHA256

    9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706

    SHA512

    1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nse1AB3.tmp\remoter.exe
    Filesize

    139KB

    MD5

    fda656c75b581d0dce6537d159052bcd

    SHA1

    a06523896f54e51a1a7269356634cc0bbb069edd

    SHA256

    4ce66c1b06bab37a85a93c5e7d7c9ba6f79da608fab33a00c44b8b0a9443309d

    SHA512

    8e7928c0e0439da880b7f2b036aa4f89cabb365bfe83c17184336580101c96d3b1f2c2ddc254a99a73d7cd0e203c40a1b22f68ad803070d2537c82fb95718106

    Download Submit