Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/09/2024, 16:37

General

  • Target

    mpcrmsetup.exe

  • Size

    14.2MB

  • MD5

    b189394200422149548f16da9814e41c

  • SHA1

    f855b1eda0ce4b26c8cbb4fc1df09155a8db5836

  • SHA256

    c92af932733eefbd0f0fc25d1ab85e7e50cf637c19e9fc769aefa052b7875d8f

  • SHA512

    6d9684fac0ad63b2f4b4b07e58a3f5c0d8d6ea05986617e09a707a38fc3922f241ab5bb11506c75770c22f1e17d95ef0b88730a1012bb30e642edc72cb6e02b8

  • SSDEEP

    393216:mpIhf4YtQ6p7F1OT1JEc4BHSAqbUB5tOblzyi:mWhVtQc1OT1JAyAIbdyi

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\mpcrmsetup.exe
    "C:\Users\Admin\AppData\Local\Temp\mpcrmsetup.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    PID:1252

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsvA191.tmp\InstallOptions.dll

    Filesize

    12KB

    MD5

    4c7d97d0786ff08b20d0e8315b5fc3cb

    SHA1

    bb6f475e867b2bf55e4cd214bd4ef68e26d70f6c

    SHA256

    75e20f4c5eb00e9e5cb610273023e9d2c36392fa3b664c264b736c7cc2d1ac84

    SHA512

    f37093fd5cdda74d8f7376c60a05b442f884e9d370347c7c39d84eca88f23fbea6221da2e57197acd78c817a74703c49fb28b89d41c3e34817cc9301b0b6485a

  • C:\Users\Admin\AppData\Local\Temp\nsvA191.tmp\advsplash.dll

    Filesize

    5KB

    MD5

    ca60ae514320a0bfc4991c1fca3dc4ce

    SHA1

    c0d7db92c979d75233db185f18dee0c9518dd8ae

    SHA256

    08d2283396141ae8222c6959a0e1b4f75a75a3f2643b33d6d1c9b90d0669c606

    SHA512

    8e2d00909828b2f527bed1d2dae39e991142091cda8e80fb512ef2790fdd8146e6222dc1a98730af864b1437eab9f0e881e9adc3aad4e6c67f840dc3c4115a3b

  • C:\Users\Admin\AppData\Local\Temp\nsvA191.tmp\ioSpecial.ini

    Filesize

    728B

    MD5

    f31984de1e461523f5c6a0753c71efef

    SHA1

    0a49e2566a3e88cf3e340b4adbcc37458c8beb3d

    SHA256

    a20119929d8256ba16f79b8ce3c8c918ee53a9f316d83aef6f549678e4889a22

    SHA512

    1b7ca45918fa1a45f98a6cc018c5f9fcc85ff762e07096d534b1356a33de364a999c3845a922f2cd3aadffc21c9e85f6da3c836bdfb91090d821edb9c22a7496