Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    07/09/2024, 19:34

General

  • Target

    au.exe

  • Size

    4.1MB

  • MD5

    fb50ca23df24621edbde4e30ce4981d9

  • SHA1

    08c350054db878397361257c96bb17e911e96f9f

  • SHA256

    499fe526f58d8558a8836d1f3f24ea036edc367107f824c8a2745ade54635867

  • SHA512

    a73837e0ae511b9a24ff39d02f91d98704ffeb4c08dde7643c1fa229a37720902225668737f2d500d2cce026a541cb382e89475682030e4608cf6dc4c099ddd7

  • SSDEEP

    98304:q8172C7HzW3x1/u/ZBgdjDAY9B8FFlzHnVG5yyD4:p1BzzqiRBrhzHVG5yD

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\au.exe
    "C:\Users\Admin\AppData\Local\Temp\au.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: GetForegroundWindowSpam
    PID:1744

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsd8DA1.tmp\ioSpecial.ini

    Filesize

    739B

    MD5

    0fe8dd8b9aa774d196eae791d4d27c8f

    SHA1

    05da14a2c2a7db4ad5aac7d65d7c05c5a00d93fe

    SHA256

    5a3936469559d7e0781a6af06d703e60e6eb9e5367b016d57f45278c7287e8d7

    SHA512

    34014a3aa971a39f9867ef1162aeb1002e6950fe78b92a8a498416e943834eaa284214340c4860f55a54dfe61b921e48b493d93b0993075b68df6ed6ce77ac47

  • \Users\Admin\AppData\Local\Temp\nsd8DA1.tmp\InstallOptions.dll

    Filesize

    14KB

    MD5

    0dc0cc7a6d9db685bf05a7e5f3ea4781

    SHA1

    5d8b6268eeec9d8d904bc9d988a4b588b392213f

    SHA256

    8e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c

    SHA512

    814dd17ebb434f4a3356f716c783ab7f569f9ee34ce5274fa50392526925f044798f8006198ac7afe3d1c2ca83a2ca8c472ca53fec5f12bbfbbe0707abacd6b0

  • \Users\Admin\AppData\Local\Temp\nsd8DA1.tmp\System.dll

    Filesize

    11KB

    MD5

    00a0194c20ee912257df53bfe258ee4a

    SHA1

    d7b4e319bc5119024690dc8230b9cc919b1b86b2

    SHA256

    dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

    SHA512

    3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667