Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
1infinst.exe
windows10-1703-x64
4infinst.exe
windows10-2004-x64
4x3daudio1_1.dll
windows10-1703-x64
1x3daudio1_1.dll
windows10-2004-x64
3xactengine2_7.dll
windows10-1703-x64
7xactengine2_7.dll
windows10-2004-x64
7AutoPlay/D...UP.dll
windows10-1703-x64
4AutoPlay/D...UP.dll
windows10-2004-x64
4AutoPlay/D...UP.exe
windows10-1703-x64
4AutoPlay/D...UP.exe
windows10-2004-x64
4AutoPlay/D...S.pptx
windows10-1703-x64
1AutoPlay/D...S.pptx
windows10-2004-x64
1AutoPlay/D...er.exe
windows10-1703-x64
7AutoPlay/D...er.exe
windows10-2004-x64
7AutoPlay/D...32.dll
windows10-1703-x64
4AutoPlay/D...32.dll
windows10-2004-x64
4AutoPlay/D...up.exe
windows10-1703-x64
7AutoPlay/D...up.exe
windows10-2004-x64
7autorun.exe
windows10-1703-x64
3autorun.exe
windows10-2004-x64
3lua5.1.dll
windows10-1703-x64
3lua5.1.dll
windows10-2004-x64
3lua51.dll
windows10-1703-x64
3lua51.dll
windows10-2004-x64
3Analysis
-
max time kernel
387s -
max time network
1819s -
platform
windows10-1703_x64 -
resource
win10-20220812-es -
resource tags
arch:x64arch:x86image:win10-20220812-eslocale:es-esos:windows10-1703-x64systemwindows -
submitted
15/02/2023, 04:45
Static task
static1
Behavioral task
behavioral1
Sample
infinst.exe
Resource
win10-20220812-es
Behavioral task
behavioral2
Sample
infinst.exe
Resource
win10v2004-20220812-es
Behavioral task
behavioral3
Sample
x3daudio1_1.dll
Resource
win10-20220901-es
Behavioral task
behavioral4
Sample
x3daudio1_1.dll
Resource
win10v2004-20221111-es
Behavioral task
behavioral5
Sample
xactengine2_7.dll
Resource
win10-20220812-es
Behavioral task
behavioral6
Sample
xactengine2_7.dll
Resource
win10v2004-20221111-es
Behavioral task
behavioral7
Sample
AutoPlay/Docs/DSETUP.dll
Resource
win10-20220812-es
Behavioral task
behavioral8
Sample
AutoPlay/Docs/DSETUP.dll
Resource
win10v2004-20221111-es
Behavioral task
behavioral9
Sample
AutoPlay/Docs/DXSETUP.exe
Resource
win10-20220901-es
Behavioral task
behavioral10
Sample
AutoPlay/Docs/DXSETUP.exe
Resource
win10v2004-20220812-es
Behavioral task
behavioral11
Sample
AutoPlay/Docs/DirectX_11_Technology_Update_US.pptx
Resource
win10-20220812-es
Behavioral task
behavioral12
Sample
AutoPlay/Docs/DirectX_11_Technology_Update_US.pptx
Resource
win10v2004-20221111-es
Behavioral task
behavioral13
Sample
AutoPlay/Docs/VC_RedistInstaller.exe
Resource
win10-20220901-es
Behavioral task
behavioral14
Sample
AutoPlay/Docs/VC_RedistInstaller.exe
Resource
win10v2004-20221111-es
Behavioral task
behavioral15
Sample
AutoPlay/Docs/dsetup32.dll
Resource
win10-20220812-es
Behavioral task
behavioral16
Sample
AutoPlay/Docs/dsetup32.dll
Resource
win10v2004-20221111-es
Behavioral task
behavioral17
Sample
AutoPlay/Docs/setup.exe
Resource
win10-20220812-es
Behavioral task
behavioral18
Sample
AutoPlay/Docs/setup.exe
Resource
win10v2004-20221111-es
Behavioral task
behavioral19
Sample
autorun.exe
Resource
win10-20220812-es
Behavioral task
behavioral20
Sample
autorun.exe
Resource
win10v2004-20221111-es
Behavioral task
behavioral21
Sample
lua5.1.dll
Resource
win10-20220901-es
Behavioral task
behavioral22
Sample
lua5.1.dll
Resource
win10v2004-20221111-es
Behavioral task
behavioral23
Sample
lua51.dll
Resource
win10-20220812-es
Behavioral task
behavioral24
Sample
lua51.dll
Resource
win10v2004-20220812-es
General
-
Target
AutoPlay/Docs/DirectX_11_Technology_Update_US.pptx
-
Size
1.9MB
-
MD5
73d9d38fb66e5b3c983d6dbf7cd0512d
-
SHA1
5941fd7d4787e2badde251e56682b531e8c930d5
-
SHA256
2a7146dbcefb6dd674e6cfbc65c2c817641d690519c05b8d624529e79079ce0b
-
SHA512
2e37fb898dcb17900a130ccbf832b87bcd3ccea32ac86dc0082bfd40356fdb5c291b7cf9f8383da647ad572c8630c0f1a0f69f1ed09836b992655b4752cdb969
-
SSDEEP
24576:MnM2AgG1qx48vOnbYWv0EJzqcowkaSGE0uwad7oOVdlRXeMNHcOx3nrhxyl212:7P82nbYWckqconPMadXykHcG7hxUp
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz POWERPNT.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString POWERPNT.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 POWERPNT.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily POWERPNT.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU POWERPNT.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS POWERPNT.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4684 POWERPNT.EXE -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 4684 POWERPNT.EXE 4684 POWERPNT.EXE 4684 POWERPNT.EXE 4684 POWERPNT.EXE 4684 POWERPNT.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\AutoPlay\Docs\DirectX_11_Technology_Update_US.pptx" /ou ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4684