Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10up.zip
windows7-x64
1up.zip
windows10-2004-x64
1Cloakedbgf...so.iso
windows7-x64
3Cloakedbgf...so.iso
windows10-2004-x64
3Information.lnk
windows7-x64
3Information.lnk
windows10-2004-x64
6_
windows7-x64
1_
windows10-2004-x64
1agenda.exe
windows7-x64
1agenda.exe
windows10-2004-x64
6vcruntime140.dll
windows7-x64
1vcruntime140.dll
windows10-2004-x64
8vctool140.dll
windows7-x64
1vctool140.dll
windows10-2004-x64
8Guloaderbg...so.iso
windows7-x64
3Guloaderbg...so.iso
windows10-2004-x64
3Iisbgfhaci...ll.dll
windows7-x64
3Iisbgfhaci...ll.dll
windows10-2004-x64
3Iranbggaia...xe.exe
windows7-x64
7Iranbggaia...xe.exe
windows10-2004-x64
7Knotweedbg...ll.dll
windows7-x64
1Knotweedbg...ll.dll
windows10-2004-x64
1Magicratbg...xe.exe
windows7-x64
10Magicratbg...xe.exe
windows10-2004-x64
10Newcoppers...xe.exe
windows7-x64
4Newcoppers...xe.exe
windows10-2004-x64
4Newlogfors...xe.exe
windows7-x64
4Newlogfors...xe.exe
windows10-2004-x64
4Purecrypte...xe.dll
windows7-x64
1Purecrypte...xe.dll
windows10-2004-x64
1Purecrypte...xe.dll
windows7-x64
1Purecrypte...xe.dll
windows10-2004-x64
1Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
01/08/2023, 19:38
Behavioral task
behavioral1
Sample
up.zip
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
up.zip
Resource
win10v2004-20230703-en
Behavioral task
behavioral3
Sample
Cloakedbgfjfjjaea5_browsingIso.iso
Resource
win7-20230712-en
Behavioral task
behavioral4
Sample
Cloakedbgfjfjjaea5_browsingIso.iso
Resource
win10v2004-20230703-en
Behavioral task
behavioral5
Sample
Information.lnk
Resource
win7-20230712-en
Behavioral task
behavioral6
Sample
Information.lnk
Resource
win10v2004-20230703-en
Behavioral task
behavioral7
Sample
_
Resource
win7-20230712-en
Behavioral task
behavioral8
Sample
_
Resource
win10v2004-20230703-en
Behavioral task
behavioral9
Sample
agenda.exe
Resource
win7-20230712-en
Behavioral task
behavioral10
Sample
agenda.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral11
Sample
vcruntime140.dll
Resource
win7-20230712-en
Behavioral task
behavioral12
Sample
vcruntime140.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral13
Sample
vctool140.dll
Resource
win7-20230712-en
Behavioral task
behavioral14
Sample
vctool140.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral15
Sample
Guloaderbgghjjdjcc1_browsingIso.iso
Resource
win7-20230712-en
Behavioral task
behavioral16
Sample
Guloaderbgghjjdjcc1_browsingIso.iso
Resource
win10v2004-20230703-en
Behavioral task
behavioral17
Sample
Iisbgfhaciadc2_browsingDll.dll
Resource
win7-20230712-en
Behavioral task
behavioral18
Sample
Iisbgfhaciadc2_browsingDll.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral19
Sample
Iranbggaiajfbi13_browsingExe.exe
Resource
win7-20230712-en
Behavioral task
behavioral20
Sample
Iranbggaiajfbi13_browsingExe.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral21
Sample
Knotweedbgfjcfhafh13_browsingDll.dll
Resource
win7-20230712-en
Behavioral task
behavioral22
Sample
Knotweedbgfjcfhafh13_browsingDll.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral23
Sample
Magicratbggdhgejff1_browsingExe.exe
Resource
win7-20230712-en
Behavioral task
behavioral24
Sample
Magicratbggdhgejff1_browsingExe.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral25
Sample
Newcopperstealer10_browsingExe.exe
Resource
win7-20230712-en
Behavioral task
behavioral26
Sample
Newcopperstealer10_browsingExe.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral27
Sample
Newlogforshell18_browsingExe.exe
Resource
win7-20230712-en
Behavioral task
behavioral28
Sample
Newlogforshell18_browsingExe.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral29
Sample
Purecrypter12_browsingExe.dll
Resource
win7-20230712-en
Behavioral task
behavioral30
Sample
Purecrypter12_browsingExe.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral31
Sample
Purecrypter16_browsingExe.dll
Resource
win7-20230712-en
Behavioral task
behavioral32
Sample
Purecrypter16_browsingExe.dll
Resource
win10v2004-20230703-en
General
-
Target
Guloaderbgghjjdjcc1_browsingIso.iso
-
Size
1.2MB
-
MD5
8666360d274893b9280f687ff76b57a3
-
SHA1
39eecf28d874493ed44d6bf5f72417ee745cc313
-
SHA256
fb8e52ec2e9d21a30d7b4dee8721d890a4fbec48103a021e9c04dfb897b71060
-
SHA512
c1efa42e1f80d43723ef020b28eb8a2ab9430063ced03f79686b4387394aa7d63af704c9ff785b592db5a85d1b376d2e7965a0213fb2bb7220b2e24c4e3864c9
-
SSDEEP
1536:BiH28X0mHEealzoOjMXjX7nE9ougnacvwXIs1ue560ZS3ARBBGHzm0nt96aDBF:MHYmHEeeMgYjXYRgnaBB560Aw+TnjX
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2988 isoburn.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2760 wrote to memory of 2988 2760 cmd.exe 29 PID 2760 wrote to memory of 2988 2760 cmd.exe 29 PID 2760 wrote to memory of 2988 2760 cmd.exe 29
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Guloaderbgghjjdjcc1_browsingIso.iso1⤵
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\System32\isoburn.exe"C:\Windows\System32\isoburn.exe" "C:\Users\Admin\AppData\Local\Temp\Guloaderbgghjjdjcc1_browsingIso.iso"2⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2988
-