Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    110s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    09/09/2024, 00:30

General

  • Target

    8462dc4bccc101e5fb88c78cddf36ec0N.exe

  • Size

    207KB

  • MD5

    8462dc4bccc101e5fb88c78cddf36ec0

  • SHA1

    79cd10028e44f7ec01553368efa0fd29a52868a4

  • SHA256

    611eafb176c5e29c167223ceb0ec388b7622f0b8b0735ca8dd7fb162aff40894

  • SHA512

    5f5939c5106f0c532da47687b12635f9bebc2bbf1dd80b9dd1bc1ebdfdda5da8c36fc1a6eb85d76b72b4a9070eea89e8292e4455f2a18371975eaa23b4f9e2cd

  • SSDEEP

    3072:5cgjTfMpY1GJDhxY2lVjoSdoxx4KcWmjRrzyAyAtWgoJSWYVo2ASOvojoS:PHfwY2lVjj+VPj92d62ASOwj

Score
10/10

Malware Config

Signatures

  • Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 4 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 8 IoCs
  • Drops file in System32 directory 6 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 9 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8462dc4bccc101e5fb88c78cddf36ec0N.exe
    "C:\Users\Admin\AppData\Local\Temp\8462dc4bccc101e5fb88c78cddf36ec0N.exe"
    1⤵
    • Adds autorun key to be loaded by Explorer.exe on startup
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2728
    • C:\Windows\SysWOW64\Niikceid.exe
      C:\Windows\system32\Niikceid.exe
      2⤵
      • Adds autorun key to be loaded by Explorer.exe on startup
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2936
      • C:\Windows\SysWOW64\Nlhgoqhh.exe
        C:\Windows\system32\Nlhgoqhh.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2892
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2892 -s 140
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:2628

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Windows\SysWOW64\Niikceid.exe

    Filesize

    207KB

    MD5

    77b5beb76133b2a67a9227655e997939

    SHA1

    4889b0310db2ed408609e8a30d8af3a7b5de307d

    SHA256

    f603ee6143e7a3c8bf1af0fa920b95c3dcf5af80ed2eaec8e28fe76e55bd6da4

    SHA512

    ea932438218c6ae44043e77a8016dc1ae16d0bfeb0e6aab4d0ee5b2228149a14891a095f20790d8a78093cd8d15cd0beefe7b082eb2cae3e178c250b4936b048

  • \Windows\SysWOW64\Nlhgoqhh.exe

    Filesize

    207KB

    MD5

    e501c8e91e3bd8e42f34a05c748b1fcf

    SHA1

    6289c032bf1a39fd8920b778ec05f01f9fc098ec

    SHA256

    0f15981b9f1800f32b7ac7f8932c0319ef5d32eee5d4504c3714cfd73bf3f525

    SHA512

    ad908035013f653fd3ca779e917687c2c7411da7c6ce0fa32770370eb5293a8b2187cf90acc2157e7c79a08d453e4a077591f8e002fcacf2babfc05a5882bc20

  • memory/2728-0-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/2728-17-0x0000000000250000-0x00000000002AB000-memory.dmp

    Filesize

    364KB

  • memory/2728-41-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/2892-26-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/2936-18-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/2936-43-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB