Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
8Static
static
3Dump/dump1.exe
windows7-x64
3Dump/dump1.exe
windows10-2004-x64
3Original/9...6f.exe
windows7-x64
7Original/9...6f.exe
windows10-2004-x64
7Original/D...12.scr
windows7-x64
7Original/D...12.scr
windows10-2004-x64
7Original/b...12.exe
windows7-x64
7Original/b...12.exe
windows10-2004-x64
7Original/chqpl.exe
windows7-x64
7Original/chqpl.exe
windows10-2004-x64
7Original/d...4a.exe
windows7-x64
7Original/d...4a.exe
windows10-2004-x64
7Original/f...14.exe
windows7-x64
7Original/f...14.exe
windows10-2004-x64
7Original/l...25.exe
windows7-x64
7Original/l...25.exe
windows10-2004-x64
3Original/p...b9.dll
windows7-x64
8Original/p...b9.dll
windows10-2004-x64
8Unpacked/D...ed.exe
windows7-x64
7Unpacked/D...ed.exe
windows10-2004-x64
7Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
13/07/2023, 23:11
Static task
static1
Behavioral task
behavioral1
Sample
Dump/dump1.exe
Resource
win7-20230712-en
windows7-x64
Behavioral task
behavioral2
Sample
Dump/dump1.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Original/999bc5e16312db6abff5f6c9e54c546f.exe
Resource
win7-20230712-en
windows7-x64
Behavioral task
behavioral4
Sample
Original/999bc5e16312db6abff5f6c9e54c546f.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Original/Document-772976_829712.scr
Resource
win7-20230712-en
windows7-x64
Behavioral task
behavioral6
Sample
Original/Document-772976_829712.scr
Resource
win10v2004-20230703-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Original/b44634d90a9ff2ed8a9d0304c11bf612.exe
Resource
win7-20230712-en
windows7-x64
Behavioral task
behavioral8
Sample
Original/b44634d90a9ff2ed8a9d0304c11bf612.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Original/chqpl.exe
Resource
win7-20230712-en
windows7-x64
Behavioral task
behavioral10
Sample
Original/chqpl.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Original/dd207384b31d118745ebc83203a4b04a.exe
Resource
win7-20230712-en
windows7-x64
Behavioral task
behavioral12
Sample
Original/dd207384b31d118745ebc83203a4b04a.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Original/fax_390392029_072514.exe
Resource
win7-20230712-en
windows7-x64
Behavioral task
behavioral14
Sample
Original/fax_390392029_072514.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
Original/loader_9b313e9c79921b22b488a11344b280d4cec9dd09c2201f9e5aaf08a115650b25.exe
Resource
win7-20230712-en
windows7-x64
Behavioral task
behavioral16
Sample
Original/loader_9b313e9c79921b22b488a11344b280d4cec9dd09c2201f9e5aaf08a115650b25.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
Original/payload_f8eccfebda8a1e0caabbe23a8b94d7ced980353a9b3673a4173e24958a3bdbb9.dll
Resource
win7-20230712-en
windows7-x64
Behavioral task
behavioral18
Sample
Original/payload_f8eccfebda8a1e0caabbe23a8b94d7ced980353a9b3673a4173e24958a3bdbb9.dll
Resource
win10v2004-20230703-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
Unpacked/Dyre_Unpacked.exe
Resource
win7-20230712-en
windows7-x64
Behavioral task
behavioral20
Sample
Unpacked/Dyre_Unpacked.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
General
-
Target
Original/chqpl.exe
-
Size
255KB
-
MD5
c6315a09e06e2ba775e5be0979d23755
-
SHA1
68abb2c430eebcad865157b4ef3e25f23ec5daca
-
SHA256
0e2706d24d9aaf93a2c9181a892367bb6094cf658c97b237d336f0651f35ff5b
-
SHA512
6895a0dd192ce95a4a9c2ce51cc7e0cfcdcc5a024e6e83e39528f10b835b7eb329deebc72b258c25968291f4c06f27e1a7d06007ee785f684ba920d097e7cb5a
-
SSDEEP
6144:E9kZ+d0Wm7M5MyYzWteHu4HCRdfKgvaY:E9OnWm7S26eAf5iY
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2172 googleupdaterr.exe -
Executes dropped EXE 1 IoCs
pid Process 2172 googleupdaterr.exe -
Loads dropped DLL 1 IoCs
pid Process 2252 chqpl.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Windows\CurrentVersion\Run googleupdaterr.exe Set value (str) \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Windows\CurrentVersion\Run\GoogleUpdate = "C:\\Users\\Admin\\AppData\\Local\\googleupdaterr.exe" googleupdaterr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2172 googleupdaterr.exe 2172 googleupdaterr.exe 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found 1364 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1364 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2172 googleupdaterr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1364 Process not Found -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2252 wrote to memory of 2172 2252 chqpl.exe 28 PID 2252 wrote to memory of 2172 2252 chqpl.exe 28 PID 2252 wrote to memory of 2172 2252 chqpl.exe 28 PID 2252 wrote to memory of 2172 2252 chqpl.exe 28 PID 2252 wrote to memory of 2172 2252 chqpl.exe 28 PID 2252 wrote to memory of 2172 2252 chqpl.exe 28 PID 2252 wrote to memory of 2172 2252 chqpl.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\Original\chqpl.exe"C:\Users\Admin\AppData\Local\Temp\Original\chqpl.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\googleupdaterr.exeC:\Users\Admin\AppData\Local\Temp\Original\chqpl.exe2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2172
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD5c6315a09e06e2ba775e5be0979d23755
SHA168abb2c430eebcad865157b4ef3e25f23ec5daca
SHA2560e2706d24d9aaf93a2c9181a892367bb6094cf658c97b237d336f0651f35ff5b
SHA5126895a0dd192ce95a4a9c2ce51cc7e0cfcdcc5a024e6e83e39528f10b835b7eb329deebc72b258c25968291f4c06f27e1a7d06007ee785f684ba920d097e7cb5a
-
Filesize
255KB
MD5c6315a09e06e2ba775e5be0979d23755
SHA168abb2c430eebcad865157b4ef3e25f23ec5daca
SHA2560e2706d24d9aaf93a2c9181a892367bb6094cf658c97b237d336f0651f35ff5b
SHA5126895a0dd192ce95a4a9c2ce51cc7e0cfcdcc5a024e6e83e39528f10b835b7eb329deebc72b258c25968291f4c06f27e1a7d06007ee785f684ba920d097e7cb5a