Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
10/10/2024, 13:49
General
-
Target
uninst.exe
-
Size
331KB
-
MD5
0778f66f3f44bd46a06190f9ef6ce1fd
-
SHA1
b9e70388f2a25192575da94b8ed1ccbe25e103e9
-
SHA256
47ceb78f7f36aa428987ab001446ea738283570936624b6a935e049b4224bbf4
-
SHA512
d5901d958957e68664427944166670a5969073aef60a1ee9547cd4721ba21e8050ac08a417d6e78d6afcca9bd69f41fdee592801f4845706324c7a41ccd8801d
-
SSDEEP
3072:TqBFJLzgOJJHwEn4JuFsQOe5zlll+lllSllllllllllallll5llll/lllllllllk:+PdZzhsuNovfvFoEtRIuE7
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
NSIS installer 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\uninst.exe"C:\Users\Admin\AppData\Local\Temp\uninst.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\2⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD58614c450637267afacad1645e23ba24a
SHA1e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2
SHA2560fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758
SHA512af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b
-
Filesize
14KB
MD5254f13dfd61c5b7d2119eb2550491e1d
SHA15083f6804ee3475f3698ab9e68611b0128e22fd6
SHA256fd0e8be2135f3d326b65520383a3468c3983fa32c9c93594d986b16709d80f28
SHA512fcef8ac5bd0ee6e316dbbc128a223ba18c8bf85a8d253e0c0877af6a4f686a20b08d34e5a426e2be5045962b391b8073769253a4d9b18616febc8133ccf654f7
-
Filesize
11KB
MD500a0194c20ee912257df53bfe258ee4a
SHA1d7b4e319bc5119024690dc8230b9cc919b1b86b2
SHA256dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
SHA5123b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
-
Filesize
331KB
MD50778f66f3f44bd46a06190f9ef6ce1fd
SHA1b9e70388f2a25192575da94b8ed1ccbe25e103e9
SHA25647ceb78f7f36aa428987ab001446ea738283570936624b6a935e049b4224bbf4
SHA512d5901d958957e68664427944166670a5969073aef60a1ee9547cd4721ba21e8050ac08a417d6e78d6afcca9bd69f41fdee592801f4845706324c7a41ccd8801d
-
Filesize
12KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
4KB
-
Filesize
12KB
-
Filesize
4KB
-
Filesize
12KB