Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
7telelatino...DW.apk
android-9-x86
7IJMDal.data
windows7-x64
3IJMDal.data
windows10-2004-x64
3InteGration_4.5.6.ttf
windows7-x64
3InteGration_4.5.6.ttf
windows10-2004-x64
7af.bin
windows7-x64
3af.bin
windows10-2004-x64
3alaunchec.dat
windows7-x64
3alaunchec.dat
windows10-2004-x64
3alauncher.dat
windows7-x64
3alauncher.dat
windows10-2004-x64
3bicon.dat
windows7-x64
3bicon.dat
windows10-2004-x64
3icon_max_d...yy.png
windows7-x64
3icon_max_d...yy.png
windows10-2004-x64
3icon_titl_...ed.png
windows7-x64
3icon_titl_...ed.png
windows10-2004-x64
3ijiami.ajm
windows7-x64
3ijiami.ajm
windows10-2004-x64
3ijiami.dat
windows7-x64
3ijiami.dat
windows10-2004-x64
3image_icon...ed.png
windows7-x64
3image_icon...ed.png
windows10-2004-x64
3libijmData...ion.so
debian-9-armhf
1libijmData...x86.so
ubuntu-18.04-amd64
1localinfo.png
windows7-x64
3localinfo.png
windows10-2004-x64
3sign_verify.png
windows7-x64
3sign_verify.png
windows10-2004-x64
3signed.bin
windows7-x64
3signed.bin
windows10-2004-x64
3tiktok_data
windows7-x64
1Analysis
-
max time kernel
269s -
max time network
274s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
12/06/2023, 02:26
Static task
static1
Behavioral task
behavioral1
Sample
telelatinomobile_TVNDW.apk
Resource
android-x86-arm-20220823-en
Behavioral task
behavioral2
Sample
IJMDal.data
Resource
win7-20230220-en
Behavioral task
behavioral3
Sample
IJMDal.data
Resource
win10v2004-20230220-en
Behavioral task
behavioral4
Sample
InteGration_4.5.6.ttf
Resource
win7-20230220-en
Behavioral task
behavioral5
Sample
InteGration_4.5.6.ttf
Resource
win10v2004-20230220-en
Behavioral task
behavioral6
Sample
af.bin
Resource
win7-20230220-en
Behavioral task
behavioral7
Sample
af.bin
Resource
win10v2004-20230221-en
Behavioral task
behavioral8
Sample
alaunchec.dat
Resource
win7-20230220-en
Behavioral task
behavioral9
Sample
alaunchec.dat
Resource
win10v2004-20230220-en
Behavioral task
behavioral10
Sample
alauncher.dat
Resource
win7-20230220-en
Behavioral task
behavioral11
Sample
alauncher.dat
Resource
win10v2004-20230220-en
Behavioral task
behavioral12
Sample
bicon.dat
Resource
win7-20230220-en
Behavioral task
behavioral13
Sample
bicon.dat
Resource
win10v2004-20230220-en
Behavioral task
behavioral14
Sample
icon_max_data_encrypted_xxxyyy.png
Resource
win7-20230220-en
Behavioral task
behavioral15
Sample
icon_max_data_encrypted_xxxyyy.png
Resource
win10v2004-20230220-en
Behavioral task
behavioral16
Sample
icon_titl_last_encrypted.png
Resource
win7-20230220-en
Behavioral task
behavioral17
Sample
icon_titl_last_encrypted.png
Resource
win10v2004-20230221-en
Behavioral task
behavioral18
Sample
ijiami.ajm
Resource
win7-20230220-en
Behavioral task
behavioral19
Sample
ijiami.ajm
Resource
win10v2004-20230220-en
Behavioral task
behavioral20
Sample
ijiami.dat
Resource
win7-20230220-en
Behavioral task
behavioral21
Sample
ijiami.dat
Resource
win10v2004-20230220-en
Behavioral task
behavioral22
Sample
image_icon_constructor_encrypted.png
Resource
win7-20230220-en
Behavioral task
behavioral23
Sample
image_icon_constructor_encrypted.png
Resource
win10v2004-20230221-en
Behavioral task
behavioral24
Sample
libijmDataEncryption.so
Resource
debian9-armhf-20221125-en
Behavioral task
behavioral25
Sample
libijmDataEncryption_x86.so
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral26
Sample
localinfo.png
Resource
win7-20230220-en
Behavioral task
behavioral27
Sample
localinfo.png
Resource
win10v2004-20230220-en
Behavioral task
behavioral28
Sample
sign_verify.png
Resource
win7-20230220-en
Behavioral task
behavioral29
Sample
sign_verify.png
Resource
win10v2004-20230220-en
Behavioral task
behavioral30
Sample
signed.bin
Resource
win7-20230220-en
Behavioral task
behavioral31
Sample
signed.bin
Resource
win10v2004-20230220-en
Behavioral task
behavioral32
Sample
tiktok_data
Resource
win7-20230220-en
General
-
Target
InteGration_4.5.6.ttf
-
Size
3B
-
MD5
ea20a043c08f5168d4409ff4144f32e2
-
SHA1
47ab9979443fb7ed1c193d06773333ba7876094f
-
SHA256
13715f6c8b48ed1b00f509ca29bc826bd04fd6f1ce8d8ebe27fb286312ce3ba1
-
SHA512
54f608707022db0a0901468b26edbf56d29424e11ee67762ee86c58547dc4bfe6b82d5a2d4cae03053f1fed8122bfc3d274994ec2b5e5838cd70abd2e783f3a4
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings cmd.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 5052 wrote to memory of 1080 5052 cmd.exe 85 PID 5052 wrote to memory of 1080 5052 cmd.exe 85
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\InteGration_4.5.6.ttf1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Windows\System32\fontview.exe"C:\Windows\System32\fontview.exe" C:\Users\Admin\AppData\Local\Temp\InteGration_4.5.6.ttf2⤵PID:1080
-