Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
34s -
max time network
35s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
04/09/2024, 19:15 UTC
General
-
Target
Setup NANI v2.0.0.exe
-
Size
8.3MB
-
MD5
8deac3b42768ad22d58c4be22453d53f
-
SHA1
325d1310b4efcd07f3d26f940b55c18871316ba4
-
SHA256
0f50639167a19bffd3fbf0ada44aeb35598678937e90b11dcbbcda224877e671
-
SHA512
c2e1d88750511b62b3d031c95994d750500238ff7d50a69c4130362cb3f2a4fc62e0e766aa64fde50ff8bea8a248fdd42395195243878b677ae40ff24c8ae174
-
SSDEEP
196608:ozu8QRNGoWJ+UdxOqtzsUA5dE8e9KMGkf1YwsNhvFvGJLE:cDQYoMFxVe1dK9KMGkf1YzFu5E
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 5 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup NANI v2.0.0.exe"C:\Users\Admin\AppData\Local\Temp\Setup NANI v2.0.0.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-460V9.tmp\Setup NANI v2.0.0.tmp"C:\Users\Admin\AppData\Local\Temp\is-460V9.tmp\Setup NANI v2.0.0.tmp" /SL5="$60092,8347982,121344,C:\Users\Admin\AppData\Local\Temp\Setup NANI v2.0.0.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
Network
-
DNS8.8.8.8.in-addr.arpaRemote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle -
DNS228.249.119.40.in-addr.arpaRemote address:8.8.8.8:53Request228.249.119.40.in-addr.arpaIN PTRResponse
-
DNS240.221.184.93.in-addr.arpaRemote address:8.8.8.8:53Request240.221.184.93.in-addr.arpaIN PTRResponse
-
DNS95.221.229.192.in-addr.arpaRemote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
DNS71.159.190.20.in-addr.arpaRemote address:8.8.8.8:53Request71.159.190.20.in-addr.arpaIN PTRResponse
-
DNS196.249.167.52.in-addr.arpaRemote address:8.8.8.8:53Request196.249.167.52.in-addr.arpaIN PTRResponse
-
DNS50.23.12.20.in-addr.arpaRemote address:8.8.8.8:53Request50.23.12.20.in-addr.arpaIN PTRResponse
-
DNS171.39.242.20.in-addr.arpaRemote address:8.8.8.8:53Request171.39.242.20.in-addr.arpaIN PTRResponse
-
DNS18.134.221.88.in-addr.arpaRemote address:8.8.8.8:53Request18.134.221.88.in-addr.arpaIN PTRResponse18.134.221.88.in-addr.arpaIN PTRa88-221-134-18deploystaticakamaitechnologiescom
-
8.8.8.8:538.8.8.8.in-addr.arpadns
DNS Request
8.8.8.8.in-addr.arpa
-
8.8.8.8:53228.249.119.40.in-addr.arpadns
DNS Request
228.249.119.40.in-addr.arpa
-
8.8.8.8:53240.221.184.93.in-addr.arpadns
DNS Request
240.221.184.93.in-addr.arpa
-
8.8.8.8:5395.221.229.192.in-addr.arpadns
DNS Request
95.221.229.192.in-addr.arpa
-
8.8.8.8:5371.159.190.20.in-addr.arpadns
DNS Request
71.159.190.20.in-addr.arpa
-
8.8.8.8:53196.249.167.52.in-addr.arpadns
DNS Request
196.249.167.52.in-addr.arpa
-
8.8.8.8:5350.23.12.20.in-addr.arpadns
DNS Request
50.23.12.20.in-addr.arpa
-
8.8.8.8:53171.39.242.20.in-addr.arpadns
DNS Request
171.39.242.20.in-addr.arpa
-
8.8.8.8:5318.134.221.88.in-addr.arpadns
DNS Request
18.134.221.88.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
357KB
MD5f30afccd6fafc1cad4567ada824c9358
SHA160a65b72f208563f90fba0da6af013a36707caa9
SHA256e28d16fad16bca8198c47d7dd44acfd362dd6ba1654f700add8aaf2c0732622d
SHA51259b199085ed4b59ef2b385a09d0901ff2efde7b344db1e900684a425fc2df8e2010ca73d2f2bffa547040cb1dd4c8938b175c463ccc5e39a840a19f9aa301a6c
-
Filesize
4KB
MD5fe369a9470426cf1570198224f8922b0
SHA182cf9e81262feaa0648b20c90c88b53c9d1e9e01
SHA25675e01c305e8e28eea25dea2b4b83c3d230ee6ec4ae4fe017bc7b52292e27b961
SHA512fb31b0a0dd982f1e25f68027ae39ab2eeaeb53d570b0f60204fa058d356773c70d56fa420c12a4ee8cfaf6040be320304e16f6a8343b4b70ae231dbb3291570f
-
Filesize
813KB
MD55f87caf3f7cf63dde8e6af53bdf31289
SHA1a2c3cc3d9d831acd797155b667db59a32000d7a8
SHA2564731982b02b067d3f5a5a7518279a9265a49fb0f7b3f8dc3d61b82a5359d4940
SHA5124875298d82037ef1fff1ee3c58a9059d8480274326c862729fcc56664ecb49e2692c3838948c66dc8336e4050469d831cbf1fbd79b66565ab673d2a67765109d
-
Filesize
1.1MB
MD534acc2bdb45a9c436181426828c4cb49
SHA15adaa1ac822e6128b8d4b59a54d19901880452ae
SHA2569c81817acd4982632d8c7f1df3898fca1477577738184265d735f49fc5480f07
SHA512134ff4022571efd46f7a62e99b857ebe834e9916c786345908010f9e1fb90be226b740ddee16ae9290fe45c86be7238c4555e422abe66a461d11545e19734beb
-
Filesize
388KB
-
Filesize
700KB
-
Filesize
464KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
908KB
-
Filesize
388KB
-
Filesize
5.7MB
-
Filesize
464KB
-
Filesize
388KB
-
Filesize
5.7MB
-
Filesize
388KB
-
Filesize
1.1MB
-
Filesize
464KB
-
Filesize
2.1MB
-
Filesize
700KB
-
Filesize
5.7MB
-
Filesize
908KB
-
Filesize
880KB
-
Filesize
1.1MB
-
Filesize
2.1MB
-
Filesize
700KB
-
Filesize
5.7MB
-
Filesize
388KB
-
Filesize
1.1MB
-
Filesize
464KB
-
Filesize
148KB
-
Filesize
2.1MB
-
Filesize
700KB
-
Filesize
5.7MB
-
Filesize
1.2MB
-
Filesize
1.1MB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
388KB
-
Filesize
1.1MB
-
Filesize
464KB
-
Filesize
2.1MB
-
Filesize
700KB
-
Filesize
2.1MB
-
Filesize
908KB
-
Filesize
880KB
-
Filesize
388KB
-
Filesize
1.1MB
-
Filesize
2.1MB
-
Filesize
700KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
148KB
-
Filesize
388KB
-
Filesize
488KB
-
Filesize
192KB
-
Filesize
148KB
-
Filesize
148KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
68KB
-
Filesize
160KB