Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

81581c33df...0N.exe

windows7-x64

7

81581c33df...0N.exe

windows10-2004-x64

7

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...te.exe

windows7-x64

1

$PLUGINSDI...te.exe

windows10-2004-x64

1

$PLUGINSDI...er.exe

windows7-x64

3

$PLUGINSDI...er.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    120s
  • max time network
    106s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/07/2024, 05:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    81581c33dfd8c0267f75451889578b50N.exe

  • Size

    241KB

  • MD5

    81581c33dfd8c0267f75451889578b50

  • SHA1

    1ca0a6b3a8a7c0fb81f2442dfb9ff4c64c183b65

  • SHA256

    54efb30e5161634a4fa82764ac3e3e79df8ea317601396e845343851190bfeb3

  • SHA512

    9f4986c412ee792ebd0993b59d8315e27f835906d20f9e175bfa6886573524e4c93cb820f0beae16ad2116e52b5815fa6f79dac7fdb2e2080c71a57831d548db

  • SSDEEP

    6144:jfL+oqZk4pr2A+O/LE11c7ojuZUvyejrR3:jfLikHR11GojuHefR3

Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 42 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\81581c33dfd8c0267f75451889578b50N.exe
    "C:\Users\Admin\AppData\Local\Temp\81581c33dfd8c0267f75451889578b50N.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1168
    • C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\aspartate.exe
      "C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\aspartate.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:3164
    • C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\aspartate.exe
      "C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\aspartate.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:3708
    • C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\remoter.exe
      "C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\remoter.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:4224
    • C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\remoter.exe
      "C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\remoter.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:4164
    • C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\aspartate.exe
      "C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\aspartate.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:2032
    • C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\aspartate.exe
      "C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\aspartate.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:4628
    • C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\remoter.exe
      "C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\remoter.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:4892
    • C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\remoter.exe
      "C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\remoter.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:4504
    • C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\aspartate.exe
      "C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\aspartate.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:556
    • C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\aspartate.exe
      "C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\aspartate.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:2256
    • C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\remoter.exe
      "C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\remoter.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:744
    • C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\remoter.exe
      "C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\remoter.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:4832
    • C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\aspartate.exe
      "C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\aspartate.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:3716
    • C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\aspartate.exe
      "C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\aspartate.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:2288
    • C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\remoter.exe
      "C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\remoter.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:4288
    • C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\remoter.exe
      "C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\remoter.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:4204
    • C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\aspartate.exe
      "C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\aspartate.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      PID:3304
    • C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\aspartate.exe
      "C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\aspartate.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      PID:4308
    • C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\remoter.exe
      "C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\remoter.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3240
    • C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\remoter.exe
      "C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\remoter.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2996
    • C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\aspartate.exe
      "C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\aspartate.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      PID:2084
    • C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\aspartate.exe
      "C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\aspartate.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      PID:3436
    • C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\remoter.exe
      "C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\remoter.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3272
    • C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\remoter.exe
      "C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\remoter.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4388
    • C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\aspartate.exe
      "C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\aspartate.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      PID:4760
    • C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\aspartate.exe
      "C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\aspartate.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      PID:4432
    • C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\remoter.exe
      "C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\remoter.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:432
    • C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\remoter.exe
      "C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\remoter.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3764
    • C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\aspartate.exe
      "C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\aspartate.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      PID:2328
    • C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\aspartate.exe
      "C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\aspartate.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      PID:3268
    • C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\remoter.exe
      "C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\remoter.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3612
    • C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\remoter.exe
      "C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\remoter.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3368
    • C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\aspartate.exe
      "C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\aspartate.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      PID:2324
    • C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\aspartate.exe
      "C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\aspartate.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      PID:3944
    • C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\remoter.exe
      "C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\remoter.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1508
    • C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\remoter.exe
      "C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\remoter.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3860
    • C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\aspartate.exe
      "C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\aspartate.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      PID:1824
    • C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\aspartate.exe
      "C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\aspartate.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      PID:4268
    • C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\remoter.exe
      "C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\remoter.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3552
    • C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\remoter.exe
      "C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\remoter.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:396
    • C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\aspartate.exe
      "C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\aspartate.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      PID:752
    • C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\aspartate.exe
      "C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\aspartate.exe" /mute "Microsoft Edge WebView2"
      2⤵
      • Executes dropped EXE
      PID:624
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x4ec 0x240
    1⤵
      PID:2624

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\System.dll
      Filesize

      12KB

      MD5

      4add245d4ba34b04f213409bfe504c07

      SHA1

      ef756d6581d70e87d58cc4982e3f4d18e0ea5b09

      SHA256

      9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706

      SHA512

      1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\aspartate.exe
      Filesize

      189KB

      MD5

      9101a7f1e09281d413ece6d825020d92

      SHA1

      9df34287601a77e65cec58843474108dd0309f54

      SHA256

      781c6b118a97dd0301788d1882b18242d2768ad40752cb622f70e80d7e3a0a88

      SHA512

      8f3e5068f47817593ddd3eeb48848a1a49ffbb62fbc935c3d90757625ab3aec2e19f34d45b583dbe39dbd5cad11e00e0eb888dda6ffa9952b0851d0ada616425

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\nsm7E97.tmp\remoter.exe
      Filesize

      139KB

      MD5

      fda656c75b581d0dce6537d159052bcd

      SHA1

      a06523896f54e51a1a7269356634cc0bbb069edd

      SHA256

      4ce66c1b06bab37a85a93c5e7d7c9ba6f79da608fab33a00c44b8b0a9443309d

      SHA512

      8e7928c0e0439da880b7f2b036aa4f89cabb365bfe83c17184336580101c96d3b1f2c2ddc254a99a73d7cd0e203c40a1b22f68ad803070d2537c82fb95718106

      Download Submit