Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

Setup - Ex...et.exe

windows7-x64

8

Setup - Ex...et.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/01/2023, 01:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Setup - Extravi's ReShade-Preset.exe

  • Size

    1.9MB

  • MD5

    34d7a50686bff4cc31569af93d734561

  • SHA1

    98c3b64a64ef7b608412f0bbbb1e606fda77e0b6

  • SHA256

    e106dc57418b5286dac7ee1921920c7c6617c4480a6c983c274ab025ec31cc7b

  • SHA512

    1874c502649cad7c61dd2261b12c6609780c554496ad233f0cdfb50280c4fe21753ccd8a3f73000a96f18b057a2971c7cd52f4ab852bfd3a0de6f38a3afe0cf3

  • SSDEEP

    49152:3R6cGVgvztCtGe+sbLAChFbIzR7S0OzHl+vMTNTtC9:3RVGVYz4LXrzA77Oz40TRc9

Score
8/10
discoveryevasionspywarestealertrojan

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies registry class 9 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Setup - Extravi's ReShade-Preset.exe
    "C:\Users\Admin\AppData\Local\Temp\Setup - Extravi's ReShade-Preset.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:5020
    • C:\Users\Admin\AppData\Local\Extravi's ReShade-Preset\RobloxPlayerLauncher.exe
      "C:\Users\Admin\AppData\Local\Extravi's ReShade-Preset\RobloxPlayerLauncher.exe"
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Checks whether UAC is enabled
      • Drops file in Program Files directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3504
      • C:\Users\Admin\AppData\Local\Extravi's ReShade-Preset\RobloxPlayerLauncher.exe
        "C:\Users\Admin\AppData\Local\Extravi's ReShade-Preset\RobloxPlayerLauncher.exe" --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=142432bbee131ec1e680ff4280b83f65c7d4b91b --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x79c,0x7a0,0x7a4,0x798,0x6e4,0x11e0af4,0x11e0b04,0x11e0b14
        3⤵
        • Executes dropped EXE
        PID:348

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Extravi's ReShade-Preset\RobloxPlayerLauncher.exe
    Filesize

    2.0MB

    MD5

    88e64ec3895db7e1dadeb7e28a149642

    SHA1

    b566a1a6b0ee3b43488143c8ec3c69f4ca15d05c

    SHA256

    6408dbd08796f501baf4a67f98c859a6a581a41b1909a987b15e60d06f27fe26

    SHA512

    f723ab2546b6e91e0e3de90cc2bc0c32983fd9f307676a00caccadebdfab372f6889f0fca75d70a3dd39d875c0f2e40ee5a6d3b6130f99961d1f7b207a8b8fbb

    Download Submit

  • C:\Users\Admin\AppData\Local\Extravi's ReShade-Preset\RobloxPlayerLauncher.exe
    Filesize

    2.0MB

    MD5

    88e64ec3895db7e1dadeb7e28a149642

    SHA1

    b566a1a6b0ee3b43488143c8ec3c69f4ca15d05c

    SHA256

    6408dbd08796f501baf4a67f98c859a6a581a41b1909a987b15e60d06f27fe26

    SHA512

    f723ab2546b6e91e0e3de90cc2bc0c32983fd9f307676a00caccadebdfab372f6889f0fca75d70a3dd39d875c0f2e40ee5a6d3b6130f99961d1f7b207a8b8fbb

    Download Submit

  • C:\Users\Admin\AppData\Local\Extravi's ReShade-Preset\RobloxPlayerLauncher.exe
    Filesize

    2.0MB

    MD5

    88e64ec3895db7e1dadeb7e28a149642

    SHA1

    b566a1a6b0ee3b43488143c8ec3c69f4ca15d05c

    SHA256

    6408dbd08796f501baf4a67f98c859a6a581a41b1909a987b15e60d06f27fe26

    SHA512

    f723ab2546b6e91e0e3de90cc2bc0c32983fd9f307676a00caccadebdfab372f6889f0fca75d70a3dd39d875c0f2e40ee5a6d3b6130f99961d1f7b207a8b8fbb

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1TQVPNOO\PCClientBootstrapper[1].json
    Filesize

    2KB

    MD5

    5f6a61a8cb63e4900c9025b62a91e249

    SHA1

    da234df3682bdc17ed5781f92b05cb643793c379

    SHA256

    9324c2c947454f1e0e8c250c7cdeca59f745a03fc03c6710e7f951404e34b5ea

    SHA512

    62b9e2e5fa2b0989cae320722228a1bfe409b82917112bcbe8e07de9668e2deff8e1e4ab2c0ee376af2770c15aa602a3f5da589575d1958010168264b4444b68

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\crashpad_roblox\settings.dat
    Filesize

    40B

    MD5

    2cc99096230ee1caa1c85bb1800e16b3

    SHA1

    7ee969fe53b681e62fd58b538de390818b3b7f81

    SHA256

    f248735bd8776604f4a7050affc62f0cace23af93f27a11b34e9b7b3f1c2ef0f

    SHA512

    7b1d72a86ae9e2dc6486435b6836b485df1cda271bfd0bc6781958a1de87a5ac884f8cdf69b860daa8ea57d3e720ebe0b5d657e3a2e43b1c78a335039063a483

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsd9DCC.tmp\NScurl.dll
    Filesize

    3.6MB

    MD5

    aaeb8f600472be5a576dd6650ef095dc

    SHA1

    289dcb90640dedf59c4d71b020eec8198f459619

    SHA256

    8c354ef302075c1b07a713b0b3ab833d8549e61e5c22132fe6e3d1d11647e60e

    SHA512

    888376bf44d61477bd24b68947f2ae21c79bcbb2fb778c898fff04e6d85073d650e370c8af70867ab8f6a956ed434acb03c01e663993f1de98e7622928b852d2

    Download Submit