Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
7Plugins/32...et.dll
windows7-x64
1Plugins/32...et.dll
windows10-2004-x64
1Plugins/32...ht.dll
windows7-x64
1Plugins/32...ht.dll
windows10-2004-x64
1Plugins/32...ve.dll
windows7-x64
1Plugins/32...ve.dll
windows10-2004-x64
1Plugins/32...or.dll
windows7-x64
1Plugins/32...or.dll
windows10-2004-x64
1Plugins/32...FO.dll
windows7-x64
1Plugins/32...FO.dll
windows10-2004-x64
1Plugins/32...ey.dll
windows7-x64
1Plugins/32...ey.dll
windows10-2004-x64
1Plugins/32...se.dll
windows7-x64
1Plugins/32...se.dll
windows10-2004-x64
1Plugins/64...et.dll
windows7-x64
1Plugins/64...et.dll
windows10-2004-x64
1Plugins/64...ht.dll
windows7-x64
1Plugins/64...ht.dll
windows10-2004-x64
1Plugins/64...ve.dll
windows7-x64
1Plugins/64...ve.dll
windows10-2004-x64
1Plugins/64...or.dll
windows7-x64
1Plugins/64...or.dll
windows10-2004-x64
1Plugins/64...FO.dll
windows7-x64
1Plugins/64...FO.dll
windows10-2004-x64
1Plugins/64...ey.dll
windows7-x64
1Plugins/64...ey.dll
windows10-2004-x64
1Plugins/64...se.dll
windows7-x64
1Plugins/64...se.dll
windows10-2004-x64
1Skins/Sond...er.exe
windows7-x64
7Skins/Sond...er.exe
windows10-2004-x64
7Skins/Sond...th.ps1
windows7-x64
1Skins/Sond...th.ps1
windows10-2004-x64
1Analysis
-
max time kernel
151s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
12/04/2023, 19:52
Behavioral task
behavioral1
Sample
Plugins/32bit/ActiveNet.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Plugins/32bit/ActiveNet.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
Plugins/32bit/Backlight.dll
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
Plugins/32bit/Backlight.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
Plugins/32bit/ConfigActive.dll
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
Plugins/32bit/ConfigActive.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
Plugins/32bit/CursorColor.dll
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
Plugins/32bit/CursorColor.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
Plugins/32bit/HWiNFO.dll
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
Plugins/32bit/HWiNFO.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral11
Sample
Plugins/32bit/HotKey.dll
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
Plugins/32bit/HotKey.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
Plugins/32bit/Mouse.dll
Resource
win7-20230220-en
Behavioral task
behavioral14
Sample
Plugins/32bit/Mouse.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral15
Sample
Plugins/64bit/ActiveNet.dll
Resource
win7-20230220-en
Behavioral task
behavioral16
Sample
Plugins/64bit/ActiveNet.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral17
Sample
Plugins/64bit/Backlight.dll
Resource
win7-20230220-en
Behavioral task
behavioral18
Sample
Plugins/64bit/Backlight.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral19
Sample
Plugins/64bit/ConfigActive.dll
Resource
win7-20230220-en
Behavioral task
behavioral20
Sample
Plugins/64bit/ConfigActive.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral21
Sample
Plugins/64bit/CursorColor.dll
Resource
win7-20230220-en
Behavioral task
behavioral22
Sample
Plugins/64bit/CursorColor.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral23
Sample
Plugins/64bit/HWiNFO.dll
Resource
win7-20230220-en
Behavioral task
behavioral24
Sample
Plugins/64bit/HWiNFO.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral25
Sample
Plugins/64bit/HotKey.dll
Resource
win7-20230220-en
Behavioral task
behavioral26
Sample
Plugins/64bit/HotKey.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral27
Sample
Plugins/64bit/Mouse.dll
Resource
win7-20230220-en
Behavioral task
behavioral28
Sample
Plugins/64bit/Mouse.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral29
Sample
Skins/Sonder/@Resources/Addons/HWiNFO/HWiNFOSharedMemoryViewer.exe
Resource
win7-20230220-en
Behavioral task
behavioral30
Sample
Skins/Sonder/@Resources/Addons/HWiNFO/HWiNFOSharedMemoryViewer.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral31
Sample
Skins/Sonder/@Resources/Bluetooth/batch/bluetooth.ps1
Resource
win7-20230220-en
Behavioral task
behavioral32
Sample
Skins/Sonder/@Resources/Bluetooth/batch/bluetooth.ps1
Resource
win10v2004-20230220-en
General
-
Target
Skins/Sonder/@Resources/Addons/HWiNFO/HWiNFOSharedMemoryViewer.exe
-
Size
921KB
-
MD5
eb2761fab3333a02410e8e15c5f9ca8c
-
SHA1
2bed21db3c29401cf92d92baa5e2273427d57472
-
SHA256
9ea52f792679a83534a0503e44817140ff0c991e7d7e41fc150e405685457e61
-
SHA512
ec99b307220cd05cdefdfdb04f19f87c816622aba03297ecb552bc94dddd71217c45769f3bf168b23c66b00565ab259d114a2e5354a8ad9e922cc669662211f1
-
SSDEEP
24576:cceIkb+lgkrGhZPD7h0Ul0Q0aqNE4p64:cHV6lgkahF90ex0JNls
Malware Config
Signatures
-
resource yara_rule behavioral29/memory/1664-54-0x0000000000B00000-0x0000000000D64000-memory.dmp upx behavioral29/memory/1664-55-0x0000000000B00000-0x0000000000D64000-memory.dmp upx behavioral29/memory/1664-61-0x0000000000B00000-0x0000000000D64000-memory.dmp upx -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1664 HWiNFOSharedMemoryViewer.exe 1664 HWiNFOSharedMemoryViewer.exe