Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    101s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    07/08/2024, 08:09

General

  • Target

    $0/uninstall.exe

  • Size

    78KB

  • MD5

    34166b45c2acef07ab15b95a16beaca2

  • SHA1

    3e691cc27c0e5949c8cab8c9cd3582ba5fb43ed5

  • SHA256

    11775363c88b507158086a80b3acb4dc33d17aca2a114c9da7b6de80fb904ad0

  • SHA512

    889cdbf9420b0c733292ae75fb8431a3ff3638c91f99ba066d9d74ff97d46f35451b6da5bd6359d1cb04d4e9c979a2d9b64caa9aa33d0c80b6510cf2f030b1a5

  • SSDEEP

    1536:PEkjY1zy214Qay0DGkJ7qAELVigJYJScpxVJlCd2/Dv:8kjAJ4dDGkJ+AI0HlJl/7

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • NSIS installer 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\$0\uninstall.exe
    "C:\Users\Admin\AppData\Local\Temp\$0\uninstall.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2352
    • C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
      "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\$0\
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: GetForegroundWindowSpam
      PID:2736

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nseF3F1.tmp\ioSpecial.ini

    Filesize

    691B

    MD5

    7589d52c6f6dcd39ea48c736d3221f09

    SHA1

    373f3057d04851ee21f5101c2d777f549312f995

    SHA256

    1609f9de066eccfd63b4fbd54b6909d80a5a3c3cf52fbfa20012151a85dff519

    SHA512

    a551839a672c43ca29e73b9eebf860d89d0076faa1c059d661e502fcb86b2b29c4362e18b699702aa89166c05770289570a7720f7c06233dd7b1faa4ad052e84

  • \Users\Admin\AppData\Local\Temp\nseF3F1.tmp\InstallOptions.dll

    Filesize

    13KB

    MD5

    d765c492c21689e3d9d61634371fd861

    SHA1

    ac200933671ae52c9d5544d0e2e8e9144d286c83

    SHA256

    551e6042dd494ea01549555ffc194ab9729da09058ec714eb368dd06642c9bbc

    SHA512

    9919a9e848c8f1e26c75d0d29207571e4b86a4140bd554743d2c1f8bd7f386fe4919345b163d89a5d907fb165e435ba0ac5f6b1101713636141f156a420e2e0f

  • \Users\Admin\AppData\Local\Temp\nseF3F1.tmp\System.dll

    Filesize

    10KB

    MD5

    fe24766ba314f620d57d0cf7339103c0

    SHA1

    8641545f03f03ff07485d6ec4d7b41cbb898c269

    SHA256

    802ef71440f662f456bed6283a5ff78066af016897fe6bfd29cac6edc2967bbd

    SHA512

    60d36959895cebf29c4e7713e6d414980139c7aa4ed1c8c96fefb672c1263af0ce909fb409534355895649c0e8056635112efb0da2ba05694446aec2ca77e2e3

  • \Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

    Filesize

    78KB

    MD5

    34166b45c2acef07ab15b95a16beaca2

    SHA1

    3e691cc27c0e5949c8cab8c9cd3582ba5fb43ed5

    SHA256

    11775363c88b507158086a80b3acb4dc33d17aca2a114c9da7b6de80fb904ad0

    SHA512

    889cdbf9420b0c733292ae75fb8431a3ff3638c91f99ba066d9d74ff97d46f35451b6da5bd6359d1cb04d4e9c979a2d9b64caa9aa33d0c80b6510cf2f030b1a5