Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
130s -
max time network
87s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
03/01/2023, 01:36
General
-
Target
Setup - Extravi's ReShade-Preset.exe
-
Size
1.9MB
-
MD5
34d7a50686bff4cc31569af93d734561
-
SHA1
98c3b64a64ef7b608412f0bbbb1e606fda77e0b6
-
SHA256
e106dc57418b5286dac7ee1921920c7c6617c4480a6c983c274ab025ec31cc7b
-
SHA512
1874c502649cad7c61dd2261b12c6609780c554496ad233f0cdfb50280c4fe21753ccd8a3f73000a96f18b057a2971c7cd52f4ab852bfd3a0de6f38a3afe0cf3
-
SSDEEP
49152:3R6cGVgvztCtGe+sbLAChFbIzR7S0OzHl+vMTNTtC9:3RVGVYz4LXrzA77Oz40TRc9
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL 15 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies Internet Explorer settings 1 TTPs 18 IoCs
-
Modifies registry class 36 IoCs
-
Modifies system certificate store 2 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 60 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup - Extravi's ReShade-Preset.exe"C:\Users\Admin\AppData\Local\Temp\Setup - Extravi's ReShade-Preset.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Extravi's ReShade-Preset\RobloxPlayerLauncher.exe"C:\Users\Admin\AppData\Local\Extravi's ReShade-Preset\RobloxPlayerLauncher.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Extravi's ReShade-Preset\RobloxPlayerLauncher.exe"C:\Users\Admin\AppData\Local\Extravi's ReShade-Preset\RobloxPlayerLauncher.exe" --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=142432bbee131ec1e680ff4280b83f65c7d4b91b --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x5c8,0x5cc,0x5d0,0x5a4,0x5e0,0xe50af4,0xe50b04,0xe50b143⤵
- Executes dropped EXE
- Modifies system certificate store
-
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
-
C:\Windows\System32\control.exe"C:\Windows\System32\control.exe" SYSTEM1⤵
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5441⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5ef1445b7eb848cdf5da9727ee6398adc
SHA17a4fd9f16b37af87aa00ea5b8cd03926275d1c7f
SHA256c1ad0ea5a9ef9dca2957928b6b74954b7bd144b9dc49d7c0705a1b41feee4bb9
SHA5120b1803249cede717e42ac8cc17f410f2713a901a211d0ebf0972d40461287b8353b131dbe8ab770523581a1905ae1c9a69da93272b1a1ec0b0e1bc0b6d65c6fc
-
Filesize
61KB
MD5fc4666cbca561e864e7fdf883a9e6661
SHA12f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5
SHA25610f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b
SHA512c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d
-
Filesize
471B
MD570b57201620f585da8e35958af06faac
SHA1cd7620b5c1c2cf91064b014e4aef4a1f9680b951
SHA256399108d2a8e97ddf2d55704bdc951c6bc4400554ec0f78b187c801ecb39085b3
SHA5122211f1bca562a0df04ad1fbde9d9ad1c234b75a43612d9bac292a60424107855599615292792482adb1ff078b2f0ba5e4208310a21ead5c1dec90b2bee4649a9
-
Filesize
1KB
MD5b57d2f4b55606d727fa17a6fe9c4c417
SHA17a25fa51ef3a0c8763f8826514b8d2fba8742f96
SHA256833782e2bcb61222ba8d8a79eaaca1f6f43f526a072308dc400bc6c26d23f3c3
SHA51235246d2cca4d20c1c089fa82cced4ed8b9ef0136126c8bcfb36515cec0dcf60cf218b43652b4cae09f0c1b74bc65e6a755570ddc2c9f5c8d941051ff8fc162ec
-
Filesize
450B
MD5f2fea3fa0fcf95194f6a83bbd44ce5ae
SHA13d62b1ad4fc3b6f1f66c19f9e007eb9897e7e464
SHA256f5962c922476a34f26996c1b2955a4877a73e05d9cd902ab427c84efc3f48a21
SHA5125f6119c8073b4915de28faa84c686bd78eacae39b356a97aa966f8d642d8d29853a7853bac1f5e8b2f84357756a1ff93a53dc82d2fd3c45b43b1c169031f6d21
-
Filesize
340B
MD5172235b469538aaab021a73417b85bf4
SHA164731234e258d74b5effcde49806fe2b5679a0f6
SHA2569bb127c9e1f34f28287ea5827cee4896e5747002a91631917ac9e0288703a638
SHA512d894f7a0013474092990ae96f0cbc2f73581b212fb99286a06bcab3e2fd018be024b8ba5e4f1b00d6207f4bcbdc6c533bbad52aedd5836e6383435a499e23739
-
Filesize
304B
MD5f193bf682ab3a91fe2df10830c738bf2
SHA1bff979468bcf9d49f60a245b653f86e9a1d189ab
SHA256c83a75f3c5eba6137449cd753df39a305305bb72a3d8fda5b501edb71e47e2d4
SHA512395f645c2f6c2efb21f616ede3efecb7b6a9341f6847250950535be6ec64b278f2c0f876ed2e38eb4a5d6c7dc48c10ebb8f59beed723bf746583cfd879fb194c
-
Filesize
430B
MD5dd7315b9c0ae4ae12e29246fad16c99a
SHA1793ac40dd5f02e224a89b6759319533b0dad5030
SHA2569e24def1ea4352dd7ff1938fc73e17c0d98692d39b054a4988803be00ba21299
SHA512f01c832b39188b9911fb03103d342f7dbc9649d8b49bc7be2574283d84a7986dbbb395905f14530f06f1f560b31db99ba2168960428e43b9b4df325dbd31d43e
-
Filesize
458B
MD5924d771cf2d1f309bfd81d67200ff0d9
SHA1d06de281f6436f053f3a6c6e9c0c8b50222e6a21
SHA2565cb83cef2cbecc6a8c958e4b8ecf62ad379c00f45ee7122e241fefc960ad3a37
SHA512b6f23801804f50f7fb3c264a189f96eeacc3171fdfa5254b5c3f3c6810430453aefb6b27377bbe26de5181161e7092fd84e271a9c795cad4e731255925604fb0
-
Filesize
2.0MB
MD588e64ec3895db7e1dadeb7e28a149642
SHA1b566a1a6b0ee3b43488143c8ec3c69f4ca15d05c
SHA2566408dbd08796f501baf4a67f98c859a6a581a41b1909a987b15e60d06f27fe26
SHA512f723ab2546b6e91e0e3de90cc2bc0c32983fd9f307676a00caccadebdfab372f6889f0fca75d70a3dd39d875c0f2e40ee5a6d3b6130f99961d1f7b207a8b8fbb
-
Filesize
2.0MB
MD588e64ec3895db7e1dadeb7e28a149642
SHA1b566a1a6b0ee3b43488143c8ec3c69f4ca15d05c
SHA2566408dbd08796f501baf4a67f98c859a6a581a41b1909a987b15e60d06f27fe26
SHA512f723ab2546b6e91e0e3de90cc2bc0c32983fd9f307676a00caccadebdfab372f6889f0fca75d70a3dd39d875c0f2e40ee5a6d3b6130f99961d1f7b207a8b8fbb
-
Filesize
2.0MB
MD588e64ec3895db7e1dadeb7e28a149642
SHA1b566a1a6b0ee3b43488143c8ec3c69f4ca15d05c
SHA2566408dbd08796f501baf4a67f98c859a6a581a41b1909a987b15e60d06f27fe26
SHA512f723ab2546b6e91e0e3de90cc2bc0c32983fd9f307676a00caccadebdfab372f6889f0fca75d70a3dd39d875c0f2e40ee5a6d3b6130f99961d1f7b207a8b8fbb
-
Filesize
2KB
MD55f6a61a8cb63e4900c9025b62a91e249
SHA1da234df3682bdc17ed5781f92b05cb643793c379
SHA2569324c2c947454f1e0e8c250c7cdeca59f745a03fc03c6710e7f951404e34b5ea
SHA51262b9e2e5fa2b0989cae320722228a1bfe409b82917112bcbe8e07de9668e2deff8e1e4ab2c0ee376af2770c15aa602a3f5da589575d1958010168264b4444b68
-
Filesize
40B
MD5f6784fcbb4db1a9ae3256db7ed99e1de
SHA1e1fafa63278a803894a1caaa20741a5cf17d7383
SHA25604668587a359f95ff9c72050ee31a5953e0006e20f694c654e07294cb1b5f4c0
SHA512ba261108132dee6cb17b1cba2d35dc0a2359f72b23032217281216ccefb25984c94166cf54e0bec9ba531fdfde59a3e89490f2615afa7a95874022caf2183869
-
Filesize
2.0MB
MD5eb1a2bc52160cfbe07fee32865f43902
SHA175fb41506d11057bfaa2d6f83f2d1fe1267286b4
SHA2569be6907ffba895e95a1aaadd9e23dcea5f29e87d23e96f07ddbe3239326f0b4a
SHA51219a38a95a750a0e3681e96f29b4fe7b8b0fe42f19f0261241b64f0be879575258a351c08a8fff7f60440b5ee5d391d4a33994a442aa254d5f0fae7913b87b010
-
Filesize
2.0MB
MD5eb1a2bc52160cfbe07fee32865f43902
SHA175fb41506d11057bfaa2d6f83f2d1fe1267286b4
SHA2569be6907ffba895e95a1aaadd9e23dcea5f29e87d23e96f07ddbe3239326f0b4a
SHA51219a38a95a750a0e3681e96f29b4fe7b8b0fe42f19f0261241b64f0be879575258a351c08a8fff7f60440b5ee5d391d4a33994a442aa254d5f0fae7913b87b010
-
Filesize
2.0MB
MD5eb1a2bc52160cfbe07fee32865f43902
SHA175fb41506d11057bfaa2d6f83f2d1fe1267286b4
SHA2569be6907ffba895e95a1aaadd9e23dcea5f29e87d23e96f07ddbe3239326f0b4a
SHA51219a38a95a750a0e3681e96f29b4fe7b8b0fe42f19f0261241b64f0be879575258a351c08a8fff7f60440b5ee5d391d4a33994a442aa254d5f0fae7913b87b010
-
Filesize
57.3MB
MD5a2b4587af8afdc7411ee49d85156dbb1
SHA1151c8cdb437ac305a49d82ef18207e0ffd17745e
SHA25622f5f7156a4adc3e237b8fa415cabc89cd60e9e00db287a2b2111ab489aa4263
SHA5123e877b74ef9266aba29cd45b5a3c7b04ac54bb523c9b929150dfa7a0e3311b3430ad368de6cfbb0b7839082f8196c64d227b070bed0a1199a25388216f49f9fd
-
Filesize
57.3MB
MD5a2b4587af8afdc7411ee49d85156dbb1
SHA1151c8cdb437ac305a49d82ef18207e0ffd17745e
SHA25622f5f7156a4adc3e237b8fa415cabc89cd60e9e00db287a2b2111ab489aa4263
SHA5123e877b74ef9266aba29cd45b5a3c7b04ac54bb523c9b929150dfa7a0e3311b3430ad368de6cfbb0b7839082f8196c64d227b070bed0a1199a25388216f49f9fd
-
Filesize
2.0MB
MD588e64ec3895db7e1dadeb7e28a149642
SHA1b566a1a6b0ee3b43488143c8ec3c69f4ca15d05c
SHA2566408dbd08796f501baf4a67f98c859a6a581a41b1909a987b15e60d06f27fe26
SHA512f723ab2546b6e91e0e3de90cc2bc0c32983fd9f307676a00caccadebdfab372f6889f0fca75d70a3dd39d875c0f2e40ee5a6d3b6130f99961d1f7b207a8b8fbb
-
Filesize
2.0MB
MD588e64ec3895db7e1dadeb7e28a149642
SHA1b566a1a6b0ee3b43488143c8ec3c69f4ca15d05c
SHA2566408dbd08796f501baf4a67f98c859a6a581a41b1909a987b15e60d06f27fe26
SHA512f723ab2546b6e91e0e3de90cc2bc0c32983fd9f307676a00caccadebdfab372f6889f0fca75d70a3dd39d875c0f2e40ee5a6d3b6130f99961d1f7b207a8b8fbb
-
Filesize
2.0MB
MD588e64ec3895db7e1dadeb7e28a149642
SHA1b566a1a6b0ee3b43488143c8ec3c69f4ca15d05c
SHA2566408dbd08796f501baf4a67f98c859a6a581a41b1909a987b15e60d06f27fe26
SHA512f723ab2546b6e91e0e3de90cc2bc0c32983fd9f307676a00caccadebdfab372f6889f0fca75d70a3dd39d875c0f2e40ee5a6d3b6130f99961d1f7b207a8b8fbb
-
Filesize
2.0MB
MD588e64ec3895db7e1dadeb7e28a149642
SHA1b566a1a6b0ee3b43488143c8ec3c69f4ca15d05c
SHA2566408dbd08796f501baf4a67f98c859a6a581a41b1909a987b15e60d06f27fe26
SHA512f723ab2546b6e91e0e3de90cc2bc0c32983fd9f307676a00caccadebdfab372f6889f0fca75d70a3dd39d875c0f2e40ee5a6d3b6130f99961d1f7b207a8b8fbb
-
Filesize
2.0MB
MD588e64ec3895db7e1dadeb7e28a149642
SHA1b566a1a6b0ee3b43488143c8ec3c69f4ca15d05c
SHA2566408dbd08796f501baf4a67f98c859a6a581a41b1909a987b15e60d06f27fe26
SHA512f723ab2546b6e91e0e3de90cc2bc0c32983fd9f307676a00caccadebdfab372f6889f0fca75d70a3dd39d875c0f2e40ee5a6d3b6130f99961d1f7b207a8b8fbb
-
Filesize
2.0MB
MD588e64ec3895db7e1dadeb7e28a149642
SHA1b566a1a6b0ee3b43488143c8ec3c69f4ca15d05c
SHA2566408dbd08796f501baf4a67f98c859a6a581a41b1909a987b15e60d06f27fe26
SHA512f723ab2546b6e91e0e3de90cc2bc0c32983fd9f307676a00caccadebdfab372f6889f0fca75d70a3dd39d875c0f2e40ee5a6d3b6130f99961d1f7b207a8b8fbb
-
Filesize
2.0MB
MD588e64ec3895db7e1dadeb7e28a149642
SHA1b566a1a6b0ee3b43488143c8ec3c69f4ca15d05c
SHA2566408dbd08796f501baf4a67f98c859a6a581a41b1909a987b15e60d06f27fe26
SHA512f723ab2546b6e91e0e3de90cc2bc0c32983fd9f307676a00caccadebdfab372f6889f0fca75d70a3dd39d875c0f2e40ee5a6d3b6130f99961d1f7b207a8b8fbb
-
Filesize
2.0MB
MD588e64ec3895db7e1dadeb7e28a149642
SHA1b566a1a6b0ee3b43488143c8ec3c69f4ca15d05c
SHA2566408dbd08796f501baf4a67f98c859a6a581a41b1909a987b15e60d06f27fe26
SHA512f723ab2546b6e91e0e3de90cc2bc0c32983fd9f307676a00caccadebdfab372f6889f0fca75d70a3dd39d875c0f2e40ee5a6d3b6130f99961d1f7b207a8b8fbb
-
Filesize
2.0MB
MD588e64ec3895db7e1dadeb7e28a149642
SHA1b566a1a6b0ee3b43488143c8ec3c69f4ca15d05c
SHA2566408dbd08796f501baf4a67f98c859a6a581a41b1909a987b15e60d06f27fe26
SHA512f723ab2546b6e91e0e3de90cc2bc0c32983fd9f307676a00caccadebdfab372f6889f0fca75d70a3dd39d875c0f2e40ee5a6d3b6130f99961d1f7b207a8b8fbb
-
Filesize
3.6MB
MD5aaeb8f600472be5a576dd6650ef095dc
SHA1289dcb90640dedf59c4d71b020eec8198f459619
SHA2568c354ef302075c1b07a713b0b3ab833d8549e61e5c22132fe6e3d1d11647e60e
SHA512888376bf44d61477bd24b68947f2ae21c79bcbb2fb778c898fff04e6d85073d650e370c8af70867ab8f6a956ed434acb03c01e663993f1de98e7622928b852d2
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB