Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
1yyy.zip
windows7-x64
1yyy.zip
windows10-2004-x64
1HTCTL32.dll
windows7-x64
3HTCTL32.dll
windows10-2004-x64
3NSM.lic
windows7-x64
3NSM.lic
windows10-2004-x64
3NSM.ini
windows7-x64
1NSM.ini
windows10-2004-x64
1PCICHEK.dll
windows7-x64
3PCICHEK.dll
windows10-2004-x64
3PCICL32.dll
windows7-x64
3PCICL32.dll
windows10-2004-x64
3TCCTL32.dll
windows7-x64
3TCCTL32.dll
windows10-2004-x64
3client32.exe
windows7-x64
10client32.exe
windows10-2004-x64
10client32.ini
windows7-x64
1client32.ini
windows10-2004-x64
1install_state.json
windows7-x64
3install_state.json
windows10-2004-x64
3msvcr100.dll
windows7-x64
3msvcr100.dll
windows10-2004-x64
3nskbfltr.inf
windows7-x64
1nskbfltr.inf
windows10-2004-x64
1nsm_vpro.ini
windows7-x64
1nsm_vpro.ini
windows10-2004-x64
1pcicapi.dll
windows7-x64
3pcicapi.dll
windows10-2004-x64
3remcmdstub.exe
windows7-x64
3remcmdstub.exe
windows10-2004-x64
3temp/ie_to...ho.dll
windows10-2004-x64
3temp/ie_to...64.dll
windows10-2004-x64
1Analysis
-
max time kernel
18s -
max time network
21s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29/12/2024, 23:30
Static task
static1
Behavioral task
behavioral1
Sample
yyy.zip
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
yyy.zip
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
HTCTL32.dll
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
HTCTL32.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
NSM.lic
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
NSM.lic
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
NSM.ini
Resource
win7-20241023-en
Behavioral task
behavioral8
Sample
NSM.ini
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
PCICHEK.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
PCICHEK.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
PCICL32.dll
Resource
win7-20241010-en
Behavioral task
behavioral12
Sample
PCICL32.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
TCCTL32.dll
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
TCCTL32.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
client32.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
client32.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
client32.ini
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
client32.ini
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
install_state.json
Resource
win7-20241023-en
Behavioral task
behavioral20
Sample
install_state.json
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
msvcr100.dll
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
msvcr100.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
nskbfltr.inf
Resource
win7-20241010-en
Behavioral task
behavioral24
Sample
nskbfltr.inf
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
nsm_vpro.ini
Resource
win7-20241010-en
Behavioral task
behavioral26
Sample
nsm_vpro.ini
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
pcicapi.dll
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
pcicapi.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
remcmdstub.exe
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
remcmdstub.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
temp/ie_to_edge_bho.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral32
Sample
temp/ie_to_edge_bho_64.dll
Resource
win10v2004-20241007-en
General
-
Target
NSM.lic
-
Size
195B
-
MD5
e9609072de9c29dc1963be208948ba44
-
SHA1
03bbe27d0d1ba651ff43363587d3d6d2e170060f
-
SHA256
dc6a52ad6d637eb407cc060e98dfeedcca1167e7f62688fb1c18580dd1d05747
-
SHA512
f0e26aa63b0c7f1b31074b9d6eef88d0cfbc467f86b12205cb539a45b0352e77ce2f99f29baeab58960a197714e72289744143ba17975699d058fe75d978dfd0
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_Classes\Local Settings rundll32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2748 AcroRd32.exe 2748 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1984 wrote to memory of 2320 1984 cmd.exe 31 PID 1984 wrote to memory of 2320 1984 cmd.exe 31 PID 1984 wrote to memory of 2320 1984 cmd.exe 31 PID 2320 wrote to memory of 2748 2320 rundll32.exe 32 PID 2320 wrote to memory of 2748 2320 rundll32.exe 32 PID 2320 wrote to memory of 2748 2320 rundll32.exe 32 PID 2320 wrote to memory of 2748 2320 rundll32.exe 32
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\NSM.lic1⤵
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\NSM.lic2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\NSM.lic"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2748
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD542554c7ed8249476cc06c93f3da63f46
SHA1bcc8b5915d5cc420416980ede67d87d4ab056f1a
SHA25697f500064fcba2506fc7f21278bba2cd95dc224e4c4b9077b06cfe5e14cc598d
SHA51263daf949f76f042a82d26e11af879b23bbd0ffe6c43707dbf95d9f65598467360da22866494d5bc45b885cab36746c2acabe07a8632b5d8f6d5f792f3f1019c4