Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
Use_50505_...rd.rar
windows10-2004-x64
Setup.exe
windows10-2004-x64
5langs/Croatian.ini
windows10-2004-x64
1langs/Danish.ini
windows10-2004-x64
1langs/English.ini
windows10-2004-x64
1langs/Finnish.ini
windows10-2004-x64
1langs/Hebrew.ini
windows10-2004-x64
1langs/Hungarian.ps1
windows10-2004-x64
1langs/Indonesian.ini
windows10-2004-x64
1langs/Japanese.ini
windows10-2004-x64
1langs/Kazakh.ini
windows10-2004-x64
1langs/Korean.ps1
windows10-2004-x64
1langs/Kurdish.ini
windows10-2004-x64
1langs/Norwegian.ini
windows10-2004-x64
1langs/SimpChinese.ini
windows10-2004-x64
1langs/Sinhala.ini
windows10-2004-x64
1langs/Slovak.ini
windows10-2004-x64
1langs/Swedish.ini
windows10-2004-x64
1langs/Thai.ini
windows10-2004-x64
1langs/TradChinese.ini
windows10-2004-x64
1langs/Ukrainian.ini
windows10-2004-x64
1langs/UyghurLatin.ini
windows10-2004-x64
1langs/Uzbek.ini
windows10-2004-x64
1langs/Vietnamese.ini
windows10-2004-x64
1General
-
Target
Use_50505_As_Passw0rd.rar
-
Size
1.5MB
-
Sample
221226-y4nlrsdg47
-
MD5
eb448a6e6f0ad5d08bac4ef38278aa36
-
SHA1
f3c92f9459f56e9db825721e25b8df076c37f0d1
-
SHA256
aa5889a3857f90179a40a1c61635c43f0d7133d18eab9c564d36d075e355de43
-
SHA512
a2e80829c78a204eff594ca01c413c3b65d3cebad772512e8e308f1d4623301511795670c385d0aee741a6d14bca6e5b0c8592bf3643288e381f9fd39bff1551
-
SSDEEP
24576:MbUtT8g9bPtJKf6cssILnoBvL5ov+wphRE7GBppg+NAPC0MdyYKF7H:MbcTtJt8fYsEoBD53dGBnpAPSdfU7H
Static task
static1
Behavioral task
behavioral1
Sample
Use_50505_As_Passw0rd.rar
Resource
win10v2004-20221111-en
Behavioral task
behavioral2
Sample
Setup.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
langs/Croatian.ini
Resource
win10v2004-20220901-en
Behavioral task
behavioral4
Sample
langs/Danish.ini
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
langs/English.ini
Resource
win10v2004-20221111-en
Behavioral task
behavioral6
Sample
langs/Finnish.ini
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
langs/Hebrew.ini
Resource
win10v2004-20220812-en
Behavioral task
behavioral8
Sample
langs/Hungarian.ps1
Resource
win10v2004-20221111-en
Behavioral task
behavioral9
Sample
langs/Indonesian.ini
Resource
win10v2004-20221111-en
Behavioral task
behavioral10
Sample
langs/Japanese.ini
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
langs/Kazakh.ini
Resource
win10v2004-20221111-en
Behavioral task
behavioral12
Sample
langs/Korean.ps1
Resource
win10v2004-20220901-en
Behavioral task
behavioral13
Sample
langs/Kurdish.ini
Resource
win10v2004-20220812-en
Behavioral task
behavioral14
Sample
langs/Norwegian.ini
Resource
win10v2004-20221111-en
Behavioral task
behavioral15
Sample
langs/SimpChinese.ini
Resource
win10v2004-20220812-en
Behavioral task
behavioral16
Sample
langs/Sinhala.ini
Resource
win10v2004-20220812-en
Behavioral task
behavioral17
Sample
langs/Slovak.ini
Resource
win10v2004-20221111-en
Behavioral task
behavioral18
Sample
langs/Swedish.ini
Resource
win10v2004-20221111-en
Behavioral task
behavioral19
Sample
langs/Thai.ini
Resource
win10v2004-20220901-en
Behavioral task
behavioral20
Sample
langs/TradChinese.ini
Resource
win10v2004-20221111-en
Behavioral task
behavioral21
Sample
langs/Ukrainian.ini
Resource
win10v2004-20220812-en
Behavioral task
behavioral22
Sample
langs/UyghurLatin.ini
Resource
win10v2004-20221111-en
Behavioral task
behavioral23
Sample
langs/Uzbek.ini
Resource
win10v2004-20220812-en
Behavioral task
behavioral24
Sample
langs/Vietnamese.ini
Resource
win10v2004-20221111-en
Malware Config
Extracted
C:\Program Files\WinRAR\Rar.txt
Extracted
C:\Program Files\WinRAR\WhatsNew.txt
https
http
http://weirdsgn.com
http://icondesignlab.com
https://rarlab.com/themes/WinRAR_Classic_48x36.theme.rar
Targets
-
-
Target
Use_50505_As_Passw0rd.rar
-
Size
1.5MB
-
MD5
eb448a6e6f0ad5d08bac4ef38278aa36
-
SHA1
f3c92f9459f56e9db825721e25b8df076c37f0d1
-
SHA256
aa5889a3857f90179a40a1c61635c43f0d7133d18eab9c564d36d075e355de43
-
SHA512
a2e80829c78a204eff594ca01c413c3b65d3cebad772512e8e308f1d4623301511795670c385d0aee741a6d14bca6e5b0c8592bf3643288e381f9fd39bff1551
-
SSDEEP
24576:MbUtT8g9bPtJKf6cssILnoBvL5ov+wphRE7GBppg+NAPC0MdyYKF7H:MbcTtJt8fYsEoBD53dGBnpAPSdfU7H
Score10/10-
Modifies system executable filetype association
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Registers COM server for autorun
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-
-
-
Target
Setup.exe
-
Size
413.9MB
-
MD5
af15e6423b24652d4a41311e26b96f28
-
SHA1
585757a832d6e923ea3fc7051eb7412b62c34ad6
-
SHA256
2727709123d4fd26090c227402a09e5779cec516d615d27e02faf1f346c9d895
-
SHA512
bc666bd4fecb39590c199b933e7dfec345a01e5db44a8c8e636d7727378b6471a00e14f3c81d93bb82e22aea695bf71acae6f576e77b370f620dc290aed6075b
-
SSDEEP
24576:PnP39FKtLH3nq6WEs6dW8VX5+nfO5dTzNYMhSl4:vP3cuo1SfO5hzxhSl4
Score5/10-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-
-
-
Target
langs/Croatian.ini
-
Size
105KB
-
MD5
8477123868f12632d652c6da5df683c2
-
SHA1
23dbeba17e366e1bb5e7d7be156a9be309c9555d
-
SHA256
5bf2b70edb78073f3ce4fe6d809a3a25c982cb2840b8ebaf4367ebc42f16bd3e
-
SHA512
b785f8d680f22211c01cfa59cdf86f1bfdeca0446c1c26fc2c144e3018773d22e4050c95cd513d60df9b226df31dc504b5059db168977b3949dbcc428a7ff30d
-
SSDEEP
768:w0VnpiuM0pY1HIlw1VoIGRweBLUab7Fno8wBtA1yR4IY52t9RM8wE4c+Tyb3TRr2:VdpiuM0pY1olaEZLUYg4c+7wvO60ll
Score1/10 -
-
-
Target
langs/Danish.ini
-
Size
107KB
-
MD5
5f50b22de0efb245cd3b8f2fb50a6d3d
-
SHA1
be369ffd0c47ff92b3aa5c259ab9f4d40807b687
-
SHA256
59df77a75aca7c0a8574f6d4b5be5632908c4fea8634f4748e36ff6fee40e317
-
SHA512
f3fec19409ea564bd68f4bd1253297ed8bcbe86554422a22891c61ee237f581f95f6976512e53bcabc5cafe3411343e660d3fb8f398f95f9c1efcec8eaa4367a
-
SSDEEP
1536:gmGRkLzUJnbfeKzcqt5G+qX59CcZEY9dHbm/c4C1CgqfRG:gmGRbnbfNRt5G+qX59CcNdX47G
Score1/10 -
-
-
Target
langs/English.ini
-
Size
107KB
-
MD5
525ce1c02ca53f9c63cb697ed3aae899
-
SHA1
9ddc2763d9dd663f3cb0febf0d580e21c52c2f18
-
SHA256
0f9d467f6bb6f682c0d1351b26038950c73720f2bfc0741ec1c7bfab2046d75f
-
SHA512
734d599d839b1266c42f340e044243ae30d1859d314eed7738f72f59201d19359f1ac6ee0cac8bfef4a0a2b8f2232a4f1f33336770c8c43f929c1bef162d2317
-
SSDEEP
1536:5S5Ybl8/lKlXiF3y24FMuRvV5I7BohUT1:xxXiVQV5uJ1
Score1/10 -
-
-
Target
langs/Finnish.ini
-
Size
106KB
-
MD5
09abf1d7277a388b362c7c94012c9655
-
SHA1
85b3a52814c0a4bc9b0c39550e920340f4fb2ac2
-
SHA256
eb6cd045c3899f7ca4a7ecd4e8211478720206b3e607ab21c22e164f4c684510
-
SHA512
c531f18b5516a5cd32733bd2c00be746d580805a1178971ac57316befcdd0216e906e2283690157c622f217743a10d09e1e78b82558301a95aeb80f2278d4cb0
-
SSDEEP
1536:+0X4yMypD2b6/lXRYpc1maOK+RJh5enKT2e2ULv387G:fMyYL5/fgG2e2UL4G
Score1/10 -
-
-
Target
langs/Hebrew.ini
-
Size
97KB
-
MD5
dbf6973ac46a0adcae8500a16cce4e48
-
SHA1
eae986788b33ad048f08ba722fd4eb7354212e63
-
SHA256
42ba655e5b635698995a588f4dd39147be867a0c4b45fd49edc65982b12b9531
-
SHA512
7a59fe15ac9c10caf3b3abed60201f008583684dfa476cbb9f8ad4c3f5e93d34f31dec859019f1f36d92129b2298272df5eec15be59e367cdcb77d5e89b46549
-
SSDEEP
768:w2kJwh+FrSb7UJTvsjkhsRGn6PqwKJTDv69ZUtiGn5Eq5lBQAjV8WEdtWfSZu/JR:zkJwh+FrScvs6Eq5uWpfSZ6KlThAd+C
Score1/10 -
-
-
Target
langs/Hungarian.ini
-
Size
107KB
-
MD5
7591df7fae4342cbc7a0706e1b28e87b
-
SHA1
825e88ad498e8713522f5aef3b21ee01d6fa8b41
-
SHA256
fe9997629d296908247a2e82da6c369e2ea7eb4c87b12fc7c8d3ecb3e6fc320d
-
SHA512
8f58c6fbaf5ea140a3ecbbc88cbf4bdd0e0ba3fbdf169f4b7cb831094a47a6ead103f89fc07748f91d1396ebd13c7ebcc90a316f0eb203ff4c86a50be5cd3ca4
-
SSDEEP
3072:UaKBsDgGod8NAH4iyf8kXrLfKgL6YhL+L3yGU:73X
Score1/10 -
-
-
Target
langs/Indonesian.ini
-
Size
105KB
-
MD5
d944d8a3551719a176db4da31733ab75
-
SHA1
6cf51cb43dbd7ca84334389076adbabe407d95b8
-
SHA256
9e52e0b1f7ec39a36e2edd0231dc98865de8524a651fcf6b1b948a575e35fd0f
-
SHA512
b9077bdeb69e07894c995bd519ebab594016c8077a213b29264a8040370c9841f1ad6dada2d0af595a596a3875f9c9989dc30af8e7c7b981b420cf1382d5c9a6
-
SSDEEP
768:wbWt5bTJA+NtkooQG+Wioa6lBT8IwUzCc0qfcLVUWf1RzVARBBfxP7KLVoeY4z9v:9bT+atkwR2AIheY4pMOy0F8gx
Score1/10 -
-
-
Target
langs/Japanese.ini
-
Size
91KB
-
MD5
36d47bfae8d0d48d56b7b1feb3b317e7
-
SHA1
1d8d59aa40f765319fcb70a9f49e997aca305b89
-
SHA256
9077b41d743ed6af51cd9b8aedaebb6d1e0e6217825635a1aa9451994efaff0f
-
SHA512
b510a5b17e52778b87f58aaa61f222f11c6190a988440789d1d40591aebdcc7311f7bb3bee9621ab8d971dc2de1ec6ed4d52598b3808dd689f693c3e5897f938
-
SSDEEP
768:wPZoCIywqTgXCaNnWYjV6UDFlv0Gaf9xS7ua6PE0FtrqGv0ZQkxKQRTM94DGNWdN:1CIywqTKnWKV5GAQkxHKUfxJYNeNx
Score1/10 -
-
-
Target
langs/Kazakh.ini
-
Size
105KB
-
MD5
fe2b5687f2de60cb55629fd7f0ca9a21
-
SHA1
5299f36a7b8c5a0b59e3603b8517cb1b3e0f2160
-
SHA256
1fde00989b3baeb67e6b1f8654cd2fc7216a40a4c5a5a9a64d03d47ee95e76be
-
SHA512
ebda06bfb42a56ed71915a1f42d84edb795927697eae51fa98bcdbac76ce6dd224c7e7610743050f45649f2d756aea82e47af3ef6ad929ddc9593d8044e3334d
-
SSDEEP
1536:UdBOtqJCnhr189gDXrbF3h14FMuRv5RI7EhUv1:isH/VG5Rm1
Score1/10 -
-
-
Target
langs/Korean.ini
-
Size
91KB
-
MD5
efae0c78be2abe2920c78b9d4785ab45
-
SHA1
8c0799fb68852cb071bbe260deb4ab357bd5f4ed
-
SHA256
ad556989f6e4a683d9668e41d2d7175b7b46847c2eef26188b9075fc600d0132
-
SHA512
44737be4d4bd0f93ca3e986c89102612932f3749b8e9b89446a567cff60ceb856b4bd7380da7fe3f1809579e6ec2162d0cdd4a217935a4961c6b36a482dd4ac8
-
SSDEEP
768:wPYhkzQl6qE7rY+xuPAsyKVmq8Ag8lyWqFk5ziCfsg8S+EZNlWJ7lxyBiCWfbMav:HSzQlc7siCmq8AFlBmLfbNA2Nt7osVP
Score1/10 -
-
-
Target
langs/Kurdish.ini
-
Size
106KB
-
MD5
af61b416403963d653f5008aaba82e03
-
SHA1
b1ab14d6ee43e1230cfcc5acfc4de27ab2a6f6b3
-
SHA256
94ac43cb7eb95277db44616a53b23e9174415377b4b3b98a1bdfc98d06a40a4b
-
SHA512
a65a21d5d9f7085acf0a96701d4577bf5fbfc0ebcb4f188ff39139b135570f95d76677e6470261aef022b75378898342ab3105704228029f90b8998f414603ab
-
SSDEEP
1536:rESqStTfwl/lmie4rC3DA3f1wjF7af0/KkmwL3mnJ/6BD1I:lbTNC
Score1/10 -
-
-
Target
langs/Norwegian.ini
-
Size
104KB
-
MD5
5cf9c294bd9d233d95e54e198bd8b4ab
-
SHA1
670de196a831bc9b0d503694b594524ccfb77b04
-
SHA256
1c99b7b06af0d5ac5582f00447fbe04e2325e173666cba8ce2d18678f7b31e3b
-
SHA512
bea2be5e1dab1854cbb83fc221f392793aa7b67a1ba1ee521c4ad0aaea671bbbda868d57b3b226cc713eaf9f90bd9fc05b3166353d78c532a43111349159ac7c
-
SSDEEP
3072:/Tu1PWiYzr8Z2GIBpLkQXtgpE7ZrB2kyC+3HX:0
Score1/10 -
-
-
Target
langs/SimpChinese.ini
-
Size
86KB
-
MD5
7aad044a68d89d8bb5a202f8bc69d87c
-
SHA1
e20ca69d6f4d1612dc4457612a4b5e4808470bf3
-
SHA256
1bfa864f7012e64f5c1656fc5636ea29e87e2a45b5eb2c31a3b20643fdd8ad4d
-
SHA512
1fe22968bcba141229d8a4d36f8a7d300e44e76ea701d6a07430854567d15c8b8ebaaacb646d038a89273414c5b2a48562407ca31ac9c75e1e22fece73686625
-
SSDEEP
1536:SXm7cLrzWFubvgkOvAbGCgjhRrERD+0xs3sqPHGUt471J2BZIn:8FKNPHGVt
Score1/10 -
-
-
Target
langs/Sinhala.ini
-
Size
106KB
-
MD5
318ee9a93c4620940f88052b904f05ce
-
SHA1
a5574f778537ce085d53c3fc52299b3049da2371
-
SHA256
b6fad3bf2adba7c77641ee1a17ff4cd9e5e9b14bac1b855346c91a286e517504
-
SHA512
054c1e0322a170b83273a5c253eeb9ffc107056c555ca470d19dbdefc7d68c822d67576fd9333cf5b17357878dc6147a3d1367219db48b2b10e9bd915e806e52
-
SSDEEP
1536:Run1VCXWZTr/lOPoMHjYMgr5xU1Jdr/pSnE8EtwO5vrzAKnUs2:RungtoMHjYMgrgJqE8EqOxzus2
Score1/10 -
-
-
Target
langs/Slovak.ini
-
Size
109KB
-
MD5
fcba4d2df72a46575ca828c807224431
-
SHA1
265e34f895f4b2fbe98a39b960c385be7309dfaa
-
SHA256
b5b2f7fc1c62f1c8161ec59af79cf5e8f12cb0070264703087dcc5cb58e7352a
-
SHA512
6edf1e1484225455b76a1deb6c9f02857433a941bc0aececb916f0aede4398a4f22e70e9c152bd6a78ba2f02f11237a6ee92fb05b21374d250f680b56c6a5cc1
-
SSDEEP
3072:2ykd4BlB1wCoG9Yhgt8VQcGlW2Jw/6ro5pw9v6Nv83diJoTNfaRlnCoUjZ5bYtZr:P1wCnyNYpCaAWK
Score1/10 -
-
-
Target
langs/Swedish.ini
-
Size
104KB
-
MD5
d0280eb9ebf7e5f9b91dc0e405bd7178
-
SHA1
e0425673213109f140f8f9b7474029a0326cdab4
-
SHA256
f1ee3b2de54ee588813a7dbffca7e7607bbb769c763cdf73ccd600e06346fe1d
-
SHA512
0102a9b215d169b5cad039bbf80ef9882ad6eea7933ccb47e6ac204451456c50baabaeca43dd477a36d2db3eda317f4d59979e5387e169fbedf1c13494dc87e2
-
SSDEEP
3072:lMgTj95UgiNg1TdyjQxx3Ho7wAM65CB9mptXse6/3/GbBJsXdFg9FNX:w
Score1/10 -
-
-
Target
langs/Thai.ini
-
Size
103KB
-
MD5
b193d9eacf4afac3199e11b4f4cb6572
-
SHA1
9b3f47c3674b11e16df5ba6d5d29d2698a3e1694
-
SHA256
172276c875a496c173b349e24f7dec66ddda24f6a424120a13de73ef5e70ba07
-
SHA512
11a6971e4ba3c03822de4a46bd9854f2a1525b5380000afac9eddb5d644ba4af0308454413016c859960ce4cf49efe0dbea4a59651b6127d643d1c7eaec34f32
-
SSDEEP
1536:5fJMD1fKNP5/l3X8vruiFDKn+0PRs5jWY+APLR2lw:xy
Score1/10 -
-
-
Target
langs/TradChinese.ini
-
Size
85KB
-
MD5
dc01555f89e044192a9ad584b62e41a7
-
SHA1
e830a3012e610b2c8775c993ff504f6f3e5628ee
-
SHA256
eb8fc39f2551834010f3748d81e5f842a1b4e27adb87e425b764bb9152b55cb1
-
SHA512
954582efc17a2ffb29ba462d3d670576682211066a67de11daae4e5b2f283e055bb3119ce6aab1f40fbf8e629d7e0562c5059455ae420741558484f3c464bcca
-
SSDEEP
768:wRZh4e4gX/LtXW2DhVaajeVbWFcqnxCjDvUkkIRNQz+q8wbXrFtUkFhBaQagVQlz:yZGgX/LtXW2Dhk1bWF5dhBa00uZNfsi+
Score1/10 -
-
-
Target
langs/Ukrainian.ini
-
Size
106KB
-
MD5
9482109e20bf801180bbe11e0603c972
-
SHA1
bafe4b7daa5529a5bd7b708482cfcdab95273959
-
SHA256
f1f0c46ed4c136149fd57d9cae512242a023e14dd13d7c633bb4f7bf9ed71343
-
SHA512
b06df7881df5f79fd246e4c95edbe8c2072dbb9a6a02a7f66886b1a41c6928cf9b7d544b0c238ff2ddcb77fdb7f9ed8764ecd32fb46aa05f7bc6a5e167fded1e
-
SSDEEP
1536:iziJtNQr3yk2oKLNzPOcGC+Be6fJzFmXZ:sPcGC+Be6fO
Score1/10 -
-
-
Target
langs/UyghurLatin.ini
-
Size
108KB
-
MD5
98eb38cef87e8fa6e6d2619577d4265f
-
SHA1
205d6e9147c1f935612423bb9716fa402efa3e57
-
SHA256
d517f3322a43292dbb241597353ad01013ee3be86d666c83d87c0eda4f56f926
-
SHA512
4e85b523bd819d41ab1032534ef1ca38e841a0d80c2fc672b21a9f2dfa846384ccedd4cea9745ef7ccf127c98378bba913057b0dd716fd620e4a7d2bcf9e75ae
-
SSDEEP
1536:mJ05+SP/l0iI5XYIUicOFCWsvzqUSS0XZqISnFhKoMfyLd9:dI5oEcOAqUSS0XZqIWMfyLd9
Score1/10 -
-
-
Target
langs/Uzbek.ini
-
Size
77KB
-
MD5
29dc4e77b361bbce2780610edf092861
-
SHA1
5edc783102a4f213e876d70599e0155387ca7429
-
SHA256
af11b0cbdcb67ddc024272d45d098cf1da8a21661fe9f6fb7a0239d0c6684531
-
SHA512
ad87a926748c607773dad37b1a9fcdd47a87dde0defb36aadf6c8b043561e57b5c420e517d7ae3283f098b661c49e5d8a3ae6f3a348824780ef9d5435be828a9
-
SSDEEP
768:wR2Wh/kX5yUYBW0nbEwiW8S9LZU0xqXKhTVT2EogXcZILi2LAUTVxlWRumLFE0DZ:DcBW0nbEnMUMlWRRr+Wntr
Score1/10 -
-
-
Target
langs/Vietnamese.ini
-
Size
105KB
-
MD5
9ee05121e1a02efeec015669d96161eb
-
SHA1
28d253a23000f4ca1cba851410cec9b1b02b52c0
-
SHA256
7b939fb24a88a01b1e45b37427dccb8a319cead04fd012136551f36b4363e887
-
SHA512
0f31ccc9b86661ca679258b309ab846608145c8366225e95aa61691c5b42323a50a1631f645ab58483dcf26331239b677e97d04106029c67aa3c67367fbfbca6
-
SSDEEP
768:wVna1qkfNk1220z8aypq/EJDPU35BL8kDgavFij+I7Cs3L+LnL80Tj3DSHPoH1ag:5qkf+12SFU/bnP3DSE1swQg5
Score1/10 -