Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    85s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    03/09/2024, 10:20

General

  • Target

    c161f5826a69c4844b4c9cf8e3975070N.exe

  • Size

    292KB

  • MD5

    c161f5826a69c4844b4c9cf8e3975070

  • SHA1

    8f1c4a1894292fc7e8cdbf90eb16d1aaf7a1e67f

  • SHA256

    afb48e01d2b3315ca103644db00e6c9c1ab57b831e151fd777052bdfb3ce5e29

  • SHA512

    9b038e5713110273ea44450fd35d2ae881aea07caf477a9048f6055a2ec315a233fbe671029f437c625fb6296b5bb2e9b69f53722b24b2e43619f51a6917660e

  • SSDEEP

    6144:iQ3NtLnM3DoFFjuvf/toNQ8dqLuJoU0U7Hd8CntQOHHM+HFFTjXdpNnT2rJ:NtLnM3D0Fw/tN8dkmLtpHHHrh7

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\c161f5826a69c4844b4c9cf8e3975070N.exe
    "C:\Users\Admin\AppData\Local\Temp\c161f5826a69c4844b4c9cf8e3975070N.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    PID:2376

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\nsdCED4.tmp\System.dll

    Filesize

    10KB

    MD5

    7fbda5b7be6256996d4e59e5f6949918

    SHA1

    2d36c0e0bfbe450675c6ed044e715abaa85a252a

    SHA256

    9bb31f7f02231e3166bf52385d804c06da9740e9c6f0bda807b01052ae9fdcd4

    SHA512

    bc0d36aa6f50041bad05cf48d909ed5a387bff5b111f657591161a288c1be5c20b8c5d69e557b5ea395726d91601b9e6303da81555e053090cfcbf5d44be7f82

  • \Users\Admin\AppData\Local\Temp\nsdCED4.tmp\inetc.dll

    Filesize

    20KB

    MD5

    e541458cfe66ef95ffbea40eaaa07289

    SHA1

    caec1233f841ee72004231a3027b13cdeb13274c

    SHA256

    3bce87b66d9272c82421920c34b0216e12c57a437d1955c36f23c74c1a01d420

    SHA512

    0bf6313e4cb7bbdcfba828fb791540b630adc58c43aa4b5ba77790367d0f34f76077cd84cc62e2a2c98c788a88547f32a11e549873d172c5aa2753124847cd0c