Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
72d0145493f...5f.zip
windows7-x64
12d0145493f...5f.zip
windows10-2004-x64
12d0145493f...5f.apk
android-9-x86
1.jgapp
windows7-x64
3.jgapp
windows10-2004-x64
3GoogleSans...ar.ttf
windows7-x64
3GoogleSans...ar.ttf
windows10-2004-x64
7config.json
windows7-x64
3config.json
windows10-2004-x64
3easyagent.apk
android-9-x86
1easyagent.apk
android-10-x64
1easyagent.apk
android-11-x64
1ectemplate
windows7-x64
1ectemplate
windows10-2004-x64
1ecurl.dat
windows7-x64
3ecurl.dat
windows10-2004-x64
3index.html
windows7-x64
1index.html
windows10-2004-x64
1libjiagu.so
debian-9-armhf
1supplierconfig.json
windows7-x64
3supplierconfig.json
windows10-2004-x64
3vers.dat
windows7-x64
3vers.dat
windows10-2004-x64
3Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
24/07/2023, 07:40
Static task
static1
Behavioral task
behavioral1
Sample
2d0145493ff634b9a1430bdd0c7e6a6abe6f853609086c07d2bcfbec4d0abe5f.zip
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
2d0145493ff634b9a1430bdd0c7e6a6abe6f853609086c07d2bcfbec4d0abe5f.zip
Resource
win10v2004-20230703-en
Behavioral task
behavioral3
Sample
2d0145493ff634b9a1430bdd0c7e6a6abe6f853609086c07d2bcfbec4d0abe5f.apk
Resource
android-x86-arm-20230621-en
Behavioral task
behavioral4
Sample
.jgapp
Resource
win7-20230712-en
Behavioral task
behavioral5
Sample
.jgapp
Resource
win10v2004-20230703-en
Behavioral task
behavioral6
Sample
GoogleSans-Regular.ttf
Resource
win7-20230712-en
Behavioral task
behavioral7
Sample
GoogleSans-Regular.ttf
Resource
win10v2004-20230703-en
Behavioral task
behavioral8
Sample
config.json
Resource
win7-20230712-en
Behavioral task
behavioral9
Sample
config.json
Resource
win10v2004-20230703-en
Behavioral task
behavioral10
Sample
easyagent.apk
Resource
android-x86-arm-20230621-en
Behavioral task
behavioral11
Sample
easyagent.apk
Resource
android-x64-20230621-en
Behavioral task
behavioral12
Sample
easyagent.apk
Resource
android-x64-arm64-20230621-en
Behavioral task
behavioral13
Sample
ectemplate
Resource
win7-20230712-en
Behavioral task
behavioral14
Sample
ectemplate
Resource
win10v2004-20230703-en
Behavioral task
behavioral15
Sample
ecurl.dat
Resource
win7-20230712-en
Behavioral task
behavioral16
Sample
ecurl.dat
Resource
win10v2004-20230703-en
Behavioral task
behavioral17
Sample
index.html
Resource
win7-20230712-en
Behavioral task
behavioral18
Sample
index.html
Resource
win10v2004-20230703-en
Behavioral task
behavioral19
Sample
libjiagu.so
Resource
debian9-armhf-en-20211208
Behavioral task
behavioral20
Sample
supplierconfig.json
Resource
win7-20230712-en
Behavioral task
behavioral21
Sample
supplierconfig.json
Resource
win10v2004-20230703-en
Behavioral task
behavioral22
Sample
vers.dat
Resource
win7-20230712-en
Behavioral task
behavioral23
Sample
vers.dat
Resource
win10v2004-20230703-en
General
-
Target
config.json
-
Size
764B
-
MD5
cb695f656db409f0296206e269d94a11
-
SHA1
a3abb12a7cf8ce7cd7a3904c9ce7e24bb1b6638f
-
SHA256
af455711345a8a2dd7cb46999e68d4fe3a6bf44e2a835246f1d83ee5e030a20d
-
SHA512
edff1ea2284b6259bb8966e156fcd86afe617f7a85fd573ae28764aa4c162f188bcda180fdcb148296fb625d92b19975c1ccebc6f03872b70e3376dbfa1895a3
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_Classes\Local Settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\json_auto_file\ rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\.json\ = "json_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\json_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\json_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\json_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\.json rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\json_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1740 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1740 AcroRd32.exe 1740 AcroRd32.exe 1740 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2820 wrote to memory of 2524 2820 cmd.exe 29 PID 2820 wrote to memory of 2524 2820 cmd.exe 29 PID 2820 wrote to memory of 2524 2820 cmd.exe 29 PID 2524 wrote to memory of 1740 2524 rundll32.exe 30 PID 2524 wrote to memory of 1740 2524 rundll32.exe 30 PID 2524 wrote to memory of 1740 2524 rundll32.exe 30 PID 2524 wrote to memory of 1740 2524 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\config.json1⤵
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\config.json2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\config.json"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1740
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD523b02b5d4e3de81c7cf053ab8d2b2a46
SHA12a2782f7836a2e304bbc61e18e42ab8288de512e
SHA2562f22507f655c646137f43f00bf68aa74bf5c3209869753cbb2aca57dda21eeaf
SHA5127024dda8f7057f95465087bbcdebb083640b03064df95ca4be3f5e6f00d26fb03d0cfe5d8b204a6f7c8dcecab6ae41c22d07769544bd1169be5f0df4eeab1513