Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3Paint tool...ai.exe
windows7-x64
6Paint tool...ai.exe
windows10-2004-x64
6Paint tool...e.conf
windows7-x64
3Paint tool...e.conf
windows10-2004-x64
3Paint tool...sc.ini
windows7-x64
1Paint tool...sc.ini
windows10-2004-x64
1Paint tool...x.conf
windows7-x64
3Paint tool...x.conf
windows10-2004-x64
3Paint tool... A.bmp
windows7-x64
1Paint tool... A.bmp
windows10-2004-x64
7Paint tool... B.bmp
windows7-x64
1Paint tool... B.bmp
windows10-2004-x64
7Paint tool...as.bmp
windows7-x64
1Paint tool...as.bmp
windows10-2004-x64
7Paint tool...zo.bmp
windows7-x64
1Paint tool...zo.bmp
windows10-2004-x64
7Paint tool...el.bmp
windows7-x64
1Paint tool...el.bmp
windows10-2004-x64
7Paint tool...er.bmp
windows7-x64
1Paint tool...er.bmp
windows10-2004-x64
7Paint tool... A.bmp
windows7-x64
1Paint tool... A.bmp
windows10-2004-x64
7Paint tool... B.bmp
windows7-x64
1Paint tool... B.bmp
windows10-2004-x64
7Paint tool...e.conf
windows7-x64
3Paint tool...e.conf
windows10-2004-x64
3Paint tool...ai.sda
windows7-x64
3Paint tool...ai.sda
windows10-2004-x64
3Paint tool...ai.ssd
windows7-x64
3Paint tool...ai.ssd
windows10-2004-x64
3Paint tool...fl.dll
windows7-x64
3Paint tool...fl.dll
windows10-2004-x64
3Analysis
-
max time kernel
598s -
max time network
397s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
01/06/2023, 22:46
Static task
static1
Behavioral task
behavioral1
Sample
Paint tool Sai Angel Drawin/Paint Tool SAI/Sai.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Paint tool Sai Angel Drawin/Paint Tool SAI/Sai.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
Paint tool Sai Angel Drawin/Paint Tool SAI/language.conf
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
Paint tool Sai Angel Drawin/Paint Tool SAI/language.conf
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
Paint tool Sai Angel Drawin/Paint Tool SAI/misc.ini
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
Paint tool Sai Angel Drawin/Paint Tool SAI/misc.ini
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
Paint tool Sai Angel Drawin/Paint Tool SAI/papertex.conf
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
Paint tool Sai Angel Drawin/Paint Tool SAI/papertex.conf
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
Paint tool Sai Angel Drawin/Paint Tool SAI/papertex/Al Agua A.bmp
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
Paint tool Sai Angel Drawin/Paint Tool SAI/papertex/Al Agua A.bmp
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
Paint tool Sai Angel Drawin/Paint Tool SAI/papertex/Al Agua B.bmp
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
Paint tool Sai Angel Drawin/Paint Tool SAI/papertex/Al Agua B.bmp
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
Paint tool Sai Angel Drawin/Paint Tool SAI/papertex/Canvas.bmp
Resource
win7-20230220-en
Behavioral task
behavioral14
Sample
Paint tool Sai Angel Drawin/Paint Tool SAI/papertex/Canvas.bmp
Resource
win10v2004-20230220-en
Behavioral task
behavioral15
Sample
Paint tool Sai Angel Drawin/Paint Tool SAI/papertex/Lienzo.bmp
Resource
win7-20230220-en
Behavioral task
behavioral16
Sample
Paint tool Sai Angel Drawin/Paint Tool SAI/papertex/Lienzo.bmp
Resource
win10v2004-20230220-en
Behavioral task
behavioral17
Sample
Paint tool Sai Angel Drawin/Paint Tool SAI/papertex/Papel.bmp
Resource
win7-20230220-en
Behavioral task
behavioral18
Sample
Paint tool Sai Angel Drawin/Paint Tool SAI/papertex/Papel.bmp
Resource
win10v2004-20230220-en
Behavioral task
behavioral19
Sample
Paint tool Sai Angel Drawin/Paint Tool SAI/papertex/Paper.bmp
Resource
win7-20230220-en
Behavioral task
behavioral20
Sample
Paint tool Sai Angel Drawin/Paint Tool SAI/papertex/Paper.bmp
Resource
win10v2004-20230221-en
Behavioral task
behavioral21
Sample
Paint tool Sai Angel Drawin/Paint Tool SAI/papertex/Watercolor A.bmp
Resource
win7-20230220-en
Behavioral task
behavioral22
Sample
Paint tool Sai Angel Drawin/Paint Tool SAI/papertex/Watercolor A.bmp
Resource
win10v2004-20230220-en
Behavioral task
behavioral23
Sample
Paint tool Sai Angel Drawin/Paint Tool SAI/papertex/Watercolor B.bmp
Resource
win7-20230220-en
Behavioral task
behavioral24
Sample
Paint tool Sai Angel Drawin/Paint Tool SAI/papertex/Watercolor B.bmp
Resource
win10v2004-20230220-en
Behavioral task
behavioral25
Sample
Paint tool Sai Angel Drawin/Paint Tool SAI/presetcvsize.conf
Resource
win7-20230220-en
Behavioral task
behavioral26
Sample
Paint tool Sai Angel Drawin/Paint Tool SAI/presetcvsize.conf
Resource
win10v2004-20230220-en
Behavioral task
behavioral27
Sample
Paint tool Sai Angel Drawin/Paint Tool SAI/sai.sda
Resource
win7-20230220-en
Behavioral task
behavioral28
Sample
Paint tool Sai Angel Drawin/Paint Tool SAI/sai.sda
Resource
win10v2004-20230220-en
Behavioral task
behavioral29
Sample
Paint tool Sai Angel Drawin/Paint Tool SAI/sai.ssd
Resource
win7-20230220-en
Behavioral task
behavioral30
Sample
Paint tool Sai Angel Drawin/Paint Tool SAI/sai.ssd
Resource
win10v2004-20230220-en
Behavioral task
behavioral31
Sample
Paint tool Sai Angel Drawin/Paint Tool SAI/sfl.dll
Resource
win7-20230220-en
Behavioral task
behavioral32
Sample
Paint tool Sai Angel Drawin/Paint Tool SAI/sfl.dll
Resource
win10v2004-20230220-en
General
-
Target
Paint tool Sai Angel Drawin/Paint Tool SAI/presetcvsize.conf
-
Size
1KB
-
MD5
6adc176c6caf3d298a81848d6172a316
-
SHA1
b5b9bcfabbf5567bc39ec38644b7a2e7fd71196b
-
SHA256
2e85080e6184ed8a818d535c74992f965a8ea719e657facba86031cde370ec95
-
SHA512
de2e623050a79f31d33e8277a43b0bace406ce22707026c39b5133619b057897a377142cb9c420deef9d94a1d7bcc7e184cc4cfc04547941a8141079a97671ad
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\.conf rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\.conf\ = "conf_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\conf_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\conf_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\conf_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\conf_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\conf_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\conf_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache rundll32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1740 AcroRd32.exe 1740 AcroRd32.exe 1740 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1444 wrote to memory of 1236 1444 cmd.exe 28 PID 1444 wrote to memory of 1236 1444 cmd.exe 28 PID 1444 wrote to memory of 1236 1444 cmd.exe 28 PID 1236 wrote to memory of 1740 1236 rundll32.exe 29 PID 1236 wrote to memory of 1740 1236 rundll32.exe 29 PID 1236 wrote to memory of 1740 1236 rundll32.exe 29 PID 1236 wrote to memory of 1740 1236 rundll32.exe 29
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Paint tool Sai Angel Drawin\Paint Tool SAI\presetcvsize.conf"1⤵
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Paint tool Sai Angel Drawin\Paint Tool SAI\presetcvsize.conf2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Paint tool Sai Angel Drawin\Paint Tool SAI\presetcvsize.conf"3⤵
- Suspicious use of SetWindowsHookEx
PID:1740
-
-