Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    04/10/2024, 19:29

General

  • Target

    setup.exe

  • Size

    995KB

  • MD5

    cdf558ffaa5c202a5084cc198300d975

  • SHA1

    2caa8287fa7a817c2529c185fbde29c8da6728da

  • SHA256

    c64b3021b4190b508c350ba2538207d418945d0014a5467d1aec1ca76b3e9e91

  • SHA512

    4643ec7cd89b98e16a8512f9c59301b27bfaf38037745c08d60858fe04e1bb7136b2dc54bbf846ab54c8b6fe3f10c5e7251f02fe934025811d7277685aeed469

  • SSDEEP

    12288:ZHXfdUgIC+kZhpKiCQo4wqLWgg85A09ijarEnxJy+3kZuHGMzvPjkiW1:Z3mgIC+QvtlzRtTsjaQnxoHwmMb7

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\setup.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: GetForegroundWindowSpam
    PID:2692

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsoF1CF.tmp\ioSpecial.ini

    Filesize

    720B

    MD5

    fc879be670fac960315759a24a91db84

    SHA1

    7b5cacfa0fe70f0cf6500065efaf169af5ec6573

    SHA256

    502d3aaa0a4c2abca08ccc7b413b4cc8b833075bc1747a09f2e42a2129f192b3

    SHA512

    8d515ed72cc30a162a0341fbf753d2600f60fbf4ec98e6a24df5ecc00e626b818e556825a33c27a23dca793308f7839d7e6f10c40ac1badd3a4d2afd93e8a41a

  • \Users\Admin\AppData\Local\Temp\nsoF1CF.tmp\InstallOptions.dll

    Filesize

    12KB

    MD5

    f407939127208a009b9a825cb77ed3c7

    SHA1

    051d7fccf3fb544acaa8ab6be590bb4bc79cef82

    SHA256

    191fab998e58b66a2416873b06062166b547eb3ba06b1326a4a785a566aaf76d

    SHA512

    d45d08823ac7667f071b21d238b7fda43115db3195a442cb17d880d147e8a930374403c970afc31f676f01a83fb9c63e3be047de7e16718a08a1fdbe4b690901

  • \Users\Admin\AppData\Local\Temp\nsoF1CF.tmp\StartMenu.dll

    Filesize

    6KB

    MD5

    740bd475a180892e4cb98acc14cd360b

    SHA1

    f71ea3c855d3a0f96c3dd1a2776d21fa273833c6

    SHA256

    adf51f6f088f3bed7d88350cc77812d9c19a575ec0d477bbe6d744dd9cea06cc

    SHA512

    b8a51cd72acfdc3e589f5baa941537d4e51cfb6f73572f228651208aa89bcfd737beb7a8675e235fd0327a19516dbcd393fb8e6c5faee5a879cca28f46da840b