Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    03/10/2024, 14:06

General

  • Target

    sogou_pinyin_6.5.8.9174.exe

  • Size

    29.3MB

  • MD5

    1d4a0b5c0b191bf012ee6c2ca86d230f

  • SHA1

    ed00f7053ba90e7a8bbcd739bd41e71d4c233574

  • SHA256

    a6caa9b7336584e69a5be197fc8861fb1251ffdb39709a91bd43b485ecf3a85f

  • SHA512

    8c0dcf4711f6ec4fca069d63d3bb73cf1b481c07ce77a5904590488c0f554acdaffcbf2b268b4cf8225abca23ff7bd48b90df02bb9e0e002f4469724bb58a2fe

  • SSDEEP

    786432:idthn4NSbYcWorHVnTd+xWeMP/Etn3A2Gk7K:idthnTbnWorHVnTd+xWZstna

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_6.5.8.9174.exe
    "C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_6.5.8.9174.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    PID:2952

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\nso456.tmp\SetupLib.dll

    Filesize

    793KB

    MD5

    b151f73aa29acf29d322b2e2b9998a32

    SHA1

    a519063b54a612d3e405917ad001b38164a5347d

    SHA256

    a93d0a27a3dc33d9f2f467b1801e5d7d834a2c9a9e9bbeb9a43191593993c438

    SHA512

    ddc4cb3f3f698972871ae3ccad48e2bb3e51c3b6b3016382ef4205a9900a608af9fed6f073fc7c1fe2d8b0da3f3c13bc39476f244cf2d8e588e5c250eb8abee1

  • memory/2952-0-0x0000000000400000-0x00000000005FC000-memory.dmp

    Filesize

    2.0MB

  • memory/2952-9-0x000000006FFF0000-0x0000000070000000-memory.dmp

    Filesize

    64KB

  • memory/2952-11-0x0000000000400000-0x00000000005FC000-memory.dmp

    Filesize

    2.0MB