Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    132s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/08/2024, 14:59

General

  • Target

    PremiumBoosterInstall.exe

  • Size

    4.8MB

  • MD5

    0d46d831e46bdf83593e88e7068ce7fd

  • SHA1

    4af9c523316fc367c9cd303d9598f9ae4789ba47

  • SHA256

    73534ccf487ed7cd17eb2f36bec70a39d3fed2942c29c7c5df71f3f596d851b7

  • SHA512

    c176c8434ee981a8cc8b0f248902e3791a5b7ad9430f7b446c81ee2f9e08041830c28327422b84e1974257360dee5bef27419bce8978e7f65dde01e659647040

  • SSDEEP

    98304:RYQQOUrkZcI84/4rpyL2OLA1C0cHa8uSFtuY0v3G2YIPS0+eOV:RYQQOUrk2IPL2O8C6DCIky1+e6

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\PremiumBoosterInstall.exe
    "C:\Users\Admin\AppData\Local\Temp\PremiumBoosterInstall.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    PID:864

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsh7263.tmp\InstallOptions.dll

    Filesize

    14KB

    MD5

    271b5d1043c4402f08ddeae383f6979c

    SHA1

    2b88c58aa27bfb4979239579cd65d4c6c67a5295

    SHA256

    90485cb175686c3e97b32ebf99daa939c1a6f46e7031f71b72b81cd114fd5b51

    SHA512

    f8bd4b316726f05647162bb52a2aeb4a6cf5ee976fdb7817a3d25b868b83fb482c38d078f01d3a629afb0d6fa6ce409b2b3404398563137e22010074f529c11b

  • C:\Users\Admin\AppData\Local\Temp\nsh7263.tmp\LangDLL.dll

    Filesize

    5KB

    MD5

    efc45bb93d44b05c9b4ab8f7ba367f34

    SHA1

    22aea2c2236532ecbe66f54d439e161eba2ca2ae

    SHA256

    d4192b8ed924e4a7706f36a411242392e5292e522698122ebb396dcc94e29750

    SHA512

    04ff1141e9d0114658d237657b988f800d254f15e5c7158d194c015b848d6b1997d5d2d0bebe366c33b772d2abe80678510f8d7f2aa76ebe06f49bc5011642db

  • C:\Users\Admin\AppData\Local\Temp\nsh7263.tmp\ioSpecial.ini

    Filesize

    722B

    MD5

    a5b272b17fda75638ad63b7cb9c1ac3f

    SHA1

    53dd12ea095f2ff2095ca6aad5ba380288ea501a

    SHA256

    748d12f53dc97457c61413314f1a9f4598415e544c7229a5bf918845b188e217

    SHA512

    190a485a27caf4d3b70917aaf0a2443241195363062d818dfe60a61e8eb1816f21e88823760f7d4890282d3078fd3a985dbbfac2160f8dc678a918fb104d1367