Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
8Static
static
3Dump/dump1.exe
windows7-x64
3Dump/dump1.exe
windows10-2004-x64
3Original/9...6f.exe
windows7-x64
7Original/9...6f.exe
windows10-2004-x64
7Original/D...12.scr
windows7-x64
7Original/D...12.scr
windows10-2004-x64
7Original/b...12.exe
windows7-x64
7Original/b...12.exe
windows10-2004-x64
7Original/chqpl.exe
windows7-x64
7Original/chqpl.exe
windows10-2004-x64
7Original/d...4a.exe
windows7-x64
7Original/d...4a.exe
windows10-2004-x64
7Original/f...14.exe
windows7-x64
7Original/f...14.exe
windows10-2004-x64
7Original/l...25.exe
windows7-x64
7Original/l...25.exe
windows10-2004-x64
3Original/p...b9.dll
windows7-x64
8Original/p...b9.dll
windows10-2004-x64
8Unpacked/D...ed.exe
windows7-x64
7Unpacked/D...ed.exe
windows10-2004-x64
7Analysis
-
max time kernel
151s -
max time network
158s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
13/07/2023, 23:11
Static task
static1
Behavioral task
behavioral1
Sample
Dump/dump1.exe
Resource
win7-20230712-en
windows7-x64
Behavioral task
behavioral2
Sample
Dump/dump1.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Original/999bc5e16312db6abff5f6c9e54c546f.exe
Resource
win7-20230712-en
windows7-x64
Behavioral task
behavioral4
Sample
Original/999bc5e16312db6abff5f6c9e54c546f.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Original/Document-772976_829712.scr
Resource
win7-20230712-en
windows7-x64
Behavioral task
behavioral6
Sample
Original/Document-772976_829712.scr
Resource
win10v2004-20230703-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Original/b44634d90a9ff2ed8a9d0304c11bf612.exe
Resource
win7-20230712-en
windows7-x64
Behavioral task
behavioral8
Sample
Original/b44634d90a9ff2ed8a9d0304c11bf612.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Original/chqpl.exe
Resource
win7-20230712-en
windows7-x64
Behavioral task
behavioral10
Sample
Original/chqpl.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Original/dd207384b31d118745ebc83203a4b04a.exe
Resource
win7-20230712-en
windows7-x64
Behavioral task
behavioral12
Sample
Original/dd207384b31d118745ebc83203a4b04a.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Original/fax_390392029_072514.exe
Resource
win7-20230712-en
windows7-x64
Behavioral task
behavioral14
Sample
Original/fax_390392029_072514.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
Original/loader_9b313e9c79921b22b488a11344b280d4cec9dd09c2201f9e5aaf08a115650b25.exe
Resource
win7-20230712-en
windows7-x64
Behavioral task
behavioral16
Sample
Original/loader_9b313e9c79921b22b488a11344b280d4cec9dd09c2201f9e5aaf08a115650b25.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
Original/payload_f8eccfebda8a1e0caabbe23a8b94d7ced980353a9b3673a4173e24958a3bdbb9.dll
Resource
win7-20230712-en
windows7-x64
Behavioral task
behavioral18
Sample
Original/payload_f8eccfebda8a1e0caabbe23a8b94d7ced980353a9b3673a4173e24958a3bdbb9.dll
Resource
win10v2004-20230703-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
Unpacked/Dyre_Unpacked.exe
Resource
win7-20230712-en
windows7-x64
Behavioral task
behavioral20
Sample
Unpacked/Dyre_Unpacked.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
General
-
Target
Original/Document-772976_829712.scr
-
Size
241KB
-
MD5
c2d73485095efdbd7ab625e469affb11
-
SHA1
a0a7b943b46979cc593474b94f14f2451b8ac3c0
-
SHA256
523b9e8057ef0905e2c7d51b742d4be9374cf2eee5a810f05d987604847c549d
-
SHA512
ceafd283a2ce95ae5288871fe1732f97b600a4e08981b044fda925e15cfed120a37015c633de4daabfccdd3716dc9e0f4865468f647d8bd627339815d5bcf131
-
SSDEEP
6144:/GpBEWJvXcs5eyOfevIUdy/ZV6u2nf0+8aq:/GkEEJy3IUdy/ZVrifqaq
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2652 googleupdaterr.exe -
Executes dropped EXE 1 IoCs
pid Process 2652 googleupdaterr.exe -
Loads dropped DLL 1 IoCs
pid Process 2644 Document-772976_829712.scr -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Windows\CurrentVersion\Run googleupdaterr.exe Set value (str) \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Windows\CurrentVersion\Run\GoogleUpdate = "C:\\Users\\Admin\\AppData\\Local\\googleupdaterr.exe" googleupdaterr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2652 googleupdaterr.exe 2652 googleupdaterr.exe 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1236 Process not Found -
Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 2644 Document-772976_829712.scr 2652 googleupdaterr.exe 2652 googleupdaterr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1236 Process not Found -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1236 Process not Found 1236 Process not Found -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1236 Process not Found 1236 Process not Found -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2644 Document-772976_829712.scr 2644 Document-772976_829712.scr 2652 googleupdaterr.exe 2652 googleupdaterr.exe -
Suspicious use of UnmapMainImage 3 IoCs
pid Process 2644 Document-772976_829712.scr 2652 googleupdaterr.exe 1236 Process not Found -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2644 wrote to memory of 2652 2644 Document-772976_829712.scr 28 PID 2644 wrote to memory of 2652 2644 Document-772976_829712.scr 28 PID 2644 wrote to memory of 2652 2644 Document-772976_829712.scr 28 PID 2644 wrote to memory of 2652 2644 Document-772976_829712.scr 28 PID 2644 wrote to memory of 2652 2644 Document-772976_829712.scr 28 PID 2644 wrote to memory of 2652 2644 Document-772976_829712.scr 28 PID 2644 wrote to memory of 2652 2644 Document-772976_829712.scr 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\Original\Document-772976_829712.scr"C:\Users\Admin\AppData\Local\Temp\Original\Document-772976_829712.scr" /S1⤵
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\googleupdaterr.exeC:\Users\Admin\AppData\Local\Temp\Original\Document-772976_829712.scr2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
PID:2652
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
241KB
MD5c2d73485095efdbd7ab625e469affb11
SHA1a0a7b943b46979cc593474b94f14f2451b8ac3c0
SHA256523b9e8057ef0905e2c7d51b742d4be9374cf2eee5a810f05d987604847c549d
SHA512ceafd283a2ce95ae5288871fe1732f97b600a4e08981b044fda925e15cfed120a37015c633de4daabfccdd3716dc9e0f4865468f647d8bd627339815d5bcf131
-
Filesize
241KB
MD5c2d73485095efdbd7ab625e469affb11
SHA1a0a7b943b46979cc593474b94f14f2451b8ac3c0
SHA256523b9e8057ef0905e2c7d51b742d4be9374cf2eee5a810f05d987604847c549d
SHA512ceafd283a2ce95ae5288871fe1732f97b600a4e08981b044fda925e15cfed120a37015c633de4daabfccdd3716dc9e0f4865468f647d8bd627339815d5bcf131