Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
8Static
static
3Dump/dump1.exe
windows7-x64
3Dump/dump1.exe
windows10-2004-x64
3Original/9...6f.exe
windows7-x64
7Original/9...6f.exe
windows10-2004-x64
7Original/D...12.scr
windows7-x64
7Original/D...12.scr
windows10-2004-x64
7Original/b...12.exe
windows7-x64
7Original/b...12.exe
windows10-2004-x64
7Original/chqpl.exe
windows7-x64
7Original/chqpl.exe
windows10-2004-x64
7Original/d...4a.exe
windows7-x64
7Original/d...4a.exe
windows10-2004-x64
7Original/f...14.exe
windows7-x64
7Original/f...14.exe
windows10-2004-x64
7Original/l...25.exe
windows7-x64
7Original/l...25.exe
windows10-2004-x64
3Original/p...b9.dll
windows7-x64
8Original/p...b9.dll
windows10-2004-x64
8Unpacked/D...ed.exe
windows7-x64
7Unpacked/D...ed.exe
windows10-2004-x64
7Analysis
-
max time kernel
150s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
13/07/2023, 23:11
Static task
static1
Behavioral task
behavioral1
Sample
Dump/dump1.exe
Resource
win7-20230712-en
windows7-x64
Behavioral task
behavioral2
Sample
Dump/dump1.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Original/999bc5e16312db6abff5f6c9e54c546f.exe
Resource
win7-20230712-en
windows7-x64
Behavioral task
behavioral4
Sample
Original/999bc5e16312db6abff5f6c9e54c546f.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Original/Document-772976_829712.scr
Resource
win7-20230712-en
windows7-x64
Behavioral task
behavioral6
Sample
Original/Document-772976_829712.scr
Resource
win10v2004-20230703-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Original/b44634d90a9ff2ed8a9d0304c11bf612.exe
Resource
win7-20230712-en
windows7-x64
Behavioral task
behavioral8
Sample
Original/b44634d90a9ff2ed8a9d0304c11bf612.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Original/chqpl.exe
Resource
win7-20230712-en
windows7-x64
Behavioral task
behavioral10
Sample
Original/chqpl.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Original/dd207384b31d118745ebc83203a4b04a.exe
Resource
win7-20230712-en
windows7-x64
Behavioral task
behavioral12
Sample
Original/dd207384b31d118745ebc83203a4b04a.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Original/fax_390392029_072514.exe
Resource
win7-20230712-en
windows7-x64
Behavioral task
behavioral14
Sample
Original/fax_390392029_072514.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
Original/loader_9b313e9c79921b22b488a11344b280d4cec9dd09c2201f9e5aaf08a115650b25.exe
Resource
win7-20230712-en
windows7-x64
Behavioral task
behavioral16
Sample
Original/loader_9b313e9c79921b22b488a11344b280d4cec9dd09c2201f9e5aaf08a115650b25.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
Original/payload_f8eccfebda8a1e0caabbe23a8b94d7ced980353a9b3673a4173e24958a3bdbb9.dll
Resource
win7-20230712-en
windows7-x64
Behavioral task
behavioral18
Sample
Original/payload_f8eccfebda8a1e0caabbe23a8b94d7ced980353a9b3673a4173e24958a3bdbb9.dll
Resource
win10v2004-20230703-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
Unpacked/Dyre_Unpacked.exe
Resource
win7-20230712-en
windows7-x64
Behavioral task
behavioral20
Sample
Unpacked/Dyre_Unpacked.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
General
-
Target
Unpacked/Dyre_Unpacked.exe
-
Size
1.0MB
-
MD5
4d1d43789e038c6a03c07083ca0b0809
-
SHA1
8c4d87363a4a2352847923091b9ddfa6891f2807
-
SHA256
05edcc3e5679ee254c78058c4f446e195544d3ff3374bd141c1895e7ed6a410b
-
SHA512
32de7891671af7049b22f8384735fbd342413b2dcafc1c3d94cfa773079e10a006fe21af730558a2839c1b07deb1edd3462b07bed777a5f306863991b9709710
-
SSDEEP
6144:rj7W89i5WWwR7A7XJfZ4FFhDhMWwR7A7XJVgNgG7:rjntWqA7X5Z+NMWqA7XOgG
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2508 googleupdaterr.exe -
Executes dropped EXE 1 IoCs
pid Process 2508 googleupdaterr.exe -
Loads dropped DLL 1 IoCs
pid Process 2092 Dyre_Unpacked.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Windows\CurrentVersion\Run googleupdaterr.exe Set value (str) \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Windows\CurrentVersion\Run\GoogleUpdate = "C:\\Users\\Admin\\AppData\\Local\\googleupdaterr.exe" googleupdaterr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2508 googleupdaterr.exe 2508 googleupdaterr.exe 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1256 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2508 googleupdaterr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1256 Process not Found -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2092 wrote to memory of 2508 2092 Dyre_Unpacked.exe 28 PID 2092 wrote to memory of 2508 2092 Dyre_Unpacked.exe 28 PID 2092 wrote to memory of 2508 2092 Dyre_Unpacked.exe 28 PID 2092 wrote to memory of 2508 2092 Dyre_Unpacked.exe 28 PID 2092 wrote to memory of 2508 2092 Dyre_Unpacked.exe 28 PID 2092 wrote to memory of 2508 2092 Dyre_Unpacked.exe 28 PID 2092 wrote to memory of 2508 2092 Dyre_Unpacked.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\Unpacked\Dyre_Unpacked.exe"C:\Users\Admin\AppData\Local\Temp\Unpacked\Dyre_Unpacked.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\googleupdaterr.exeC:\Users\Admin\AppData\Local\Temp\Unpacked\Dyre_Unpacked.exe2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2508
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD54d1d43789e038c6a03c07083ca0b0809
SHA18c4d87363a4a2352847923091b9ddfa6891f2807
SHA25605edcc3e5679ee254c78058c4f446e195544d3ff3374bd141c1895e7ed6a410b
SHA51232de7891671af7049b22f8384735fbd342413b2dcafc1c3d94cfa773079e10a006fe21af730558a2839c1b07deb1edd3462b07bed777a5f306863991b9709710
-
Filesize
1.0MB
MD54d1d43789e038c6a03c07083ca0b0809
SHA18c4d87363a4a2352847923091b9ddfa6891f2807
SHA25605edcc3e5679ee254c78058c4f446e195544d3ff3374bd141c1895e7ed6a410b
SHA51232de7891671af7049b22f8384735fbd342413b2dcafc1c3d94cfa773079e10a006fe21af730558a2839c1b07deb1edd3462b07bed777a5f306863991b9709710