Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
3pvz-road-trip.zip
windows7-x64
1pvz-road-trip.zip
windows10-2004-x64
1PvZ Road Trip.dat
windows7-x64
3PvZ Road Trip.dat
windows10-2004-x64
3PvZ Road Trip.exe
windows7-x64
3PvZ Road Trip.exe
windows10-2004-x64
3PvZRT_Data...nd.dll
windows7-x64
1PvZRT_Data...nd.dll
windows10-2004-x64
1PvZRT_Data...se.dll
windows7-x64
1PvZRT_Data...se.dll
windows10-2004-x64
1PvZRT_Data...ic.dll
windows7-x64
1PvZRT_Data...ic.dll
windows10-2004-x64
1PvZRT_Data/DRPC.dll
windows7-x64
1PvZRT_Data/DRPC.dll
windows10-2004-x64
1PvZRT_Data/Get.dll
windows7-x64
1PvZRT_Data/Get.dll
windows10-2004-x64
1PvZRT_Data...ay.mfx
windows7-x64
3PvZRT_Data...ay.mfx
windows10-2004-x64
3PvZRT_Data/KcBoxA.dll
windows7-x64
1PvZRT_Data/KcBoxA.dll
windows10-2004-x64
1PvZRT_Data...on.dll
windows7-x64
1PvZRT_Data...on.dll
windows10-2004-x64
1PvZRT_Data/Layer.dll
windows7-x64
1PvZRT_Data/Layer.dll
windows10-2004-x64
1PvZRT_Data...ad.dll
windows7-x64
1PvZRT_Data...ad.dll
windows10-2004-x64
1PvZRT_Data...ck.dll
windows7-x64
1PvZRT_Data...ck.dll
windows10-2004-x64
1PvZRT_Data/kcedit.mfx
windows7-x64
3PvZRT_Data/kcedit.mfx
windows10-2004-x64
3PvZRT_Data/kcfile.dll
windows7-x64
1PvZRT_Data/kcfile.dll
windows10-2004-x64
1Analysis
-
max time kernel
208s -
max time network
260s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
17/05/2023, 04:26
Static task
static1
Behavioral task
behavioral1
Sample
pvz-road-trip.zip
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
pvz-road-trip.zip
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
PvZ Road Trip.dat
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
PvZ Road Trip.dat
Resource
win10v2004-20230221-en
Behavioral task
behavioral5
Sample
PvZ Road Trip.exe
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
PvZ Road Trip.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
PvZRT_Data/Box2DBackground.dll
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
PvZRT_Data/Box2DBackground.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
PvZRT_Data/Box2DBase.dll
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
PvZRT_Data/Box2DBase.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
PvZRT_Data/Box2DStatic.dll
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
PvZRT_Data/Box2DStatic.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
PvZRT_Data/DRPC.dll
Resource
win7-20230220-en
Behavioral task
behavioral14
Sample
PvZRT_Data/DRPC.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral15
Sample
PvZRT_Data/Get.dll
Resource
win7-20230220-en
Behavioral task
behavioral16
Sample
PvZRT_Data/Get.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral17
Sample
PvZRT_Data/KcArray.mfx
Resource
win7-20230220-en
Behavioral task
behavioral18
Sample
PvZRT_Data/KcArray.mfx
Resource
win10v2004-20230220-en
Behavioral task
behavioral19
Sample
PvZRT_Data/KcBoxA.dll
Resource
win7-20230220-en
Behavioral task
behavioral20
Sample
PvZRT_Data/KcBoxA.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral21
Sample
PvZRT_Data/KcButton.dll
Resource
win7-20230220-en
Behavioral task
behavioral22
Sample
PvZRT_Data/KcButton.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral23
Sample
PvZRT_Data/Layer.dll
Resource
win7-20230220-en
Behavioral task
behavioral24
Sample
PvZRT_Data/Layer.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral25
Sample
PvZRT_Data/XBOXGamepad.dll
Resource
win7-20230220-en
Behavioral task
behavioral26
Sample
PvZRT_Data/XBOXGamepad.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral27
Sample
PvZRT_Data/kcclock.dll
Resource
win7-20230220-en
Behavioral task
behavioral28
Sample
PvZRT_Data/kcclock.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral29
Sample
PvZRT_Data/kcedit.mfx
Resource
win7-20230220-en
Behavioral task
behavioral30
Sample
PvZRT_Data/kcedit.mfx
Resource
win10v2004-20230220-en
Behavioral task
behavioral31
Sample
PvZRT_Data/kcfile.dll
Resource
win7-20230220-en
Behavioral task
behavioral32
Sample
PvZRT_Data/kcfile.dll
Resource
win10v2004-20230220-en
General
-
Target
PvZ Road Trip.exe
-
Size
936KB
-
MD5
a99bb2d4387ad643ffc9a2d8d3a65b0d
-
SHA1
c4d9ccfb1a1a45a66cf7432d6a2cb80fae74580a
-
SHA256
9a884c29643a5eeef591855bebb1f687222fddbf46b76d225231bdecce9eb1aa
-
SHA512
cde8196b92508c2aafdf6e0225e8a4acfd3c8e289d8fa9e4b0a551973e165f426fde002b1389dcd61201e65bcb7087a24d1fd4957792428689149b7c4c51b2c8
-
SSDEEP
12288:g6LMFY+X+LJPgawU31s1YyN6HNAaWz+yFvbfZ2XhfDf+1G:g6LMdlCyNyA1FvjZ2I1G
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\discord-756532409352192059\shell PvZ Road Trip.exe Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\discord-756532409352192059\shell\open PvZ Road Trip.exe Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\discord-756532409352192059 PvZ Road Trip.exe Set value (str) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\discord-756532409352192059\URL Protocol PvZ Road Trip.exe Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\discord-756532409352192059\shell\open\command PvZ Road Trip.exe Set value (str) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\discord-756532409352192059\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PvZ Road Trip.exe" PvZ Road Trip.exe Set value (str) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\discord-756532409352192059\ = "URL:Run game 756532409352192059 protocol" PvZ Road Trip.exe Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\discord-756532409352192059\DefaultIcon PvZ Road Trip.exe Set value (str) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\discord-756532409352192059\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PvZ Road Trip.exe" PvZ Road Trip.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4424 PvZ Road Trip.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 2812 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2812 AUDIODG.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4424 PvZ Road Trip.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PvZ Road Trip.exe"C:\Users\Admin\AppData\Local\Temp\PvZ Road Trip.exe"1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4424
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x33c 0x3fc1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2812
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
212B
MD52a301390e6e75b04082c02cfafc409cf
SHA109b55028c765f818c3a44e7cec18a948dc338c96
SHA2569d8461db6643a4a59b7f0420156b8cea7809cde30268032363cebe5726d23fa2
SHA5124f6f1f278c41cbfca4c3ff8cc8139d521248510a2c31a24f51cec8db3c0fd901b0b28bbf8c02b447e903864afb76e5ac8633df486831e947b0997be89bedfb82
-
Filesize
223B
MD5448b04833bce568dab5b9e10bdd68938
SHA1f8c1a9e67a6b9934f590854e23a21c73497a31e2
SHA256d0c2e68e8bb73868bddba164345ff3c84a78955b6cf609ccb5d50cf66858e3a1
SHA512cdc0db649429431b20303e42a0fe958900f23242e29c5898f008186f28ef0acfad9b609b82400814340242a33383b99dec5e408b09d08310107d918f7167cac5