Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
6Static
static
32022 Setting File.zip
windows10-2004-x64
1Setting Fi...ry.dll
windows10-2004-x64
1Setting Fi...ry.pdb
windows10-2004-x64
3Setting Fi...cation
windows10-2004-x64
1Setting Fi...rd.exe
windows10-2004-x64
1Setting Fi...xe.xml
windows10-2004-x64
3Setting Fi...nifest
windows10-2004-x64
3Setting Fi...rd.pdb
windows10-2004-x64
3Setting Fi...re.dll
windows10-2004-x64
1Setting Fi...rd.exe
windows10-2004-x64
3Setting Fi...es.dll
windows10-2004-x64
1Setting Fi...es.dll
windows10-2004-x64
1Setting Fi...er.mp4
windows10-2004-x64
6Setting Fi...ng.mp4
windows10-2004-x64
6Setting Fi...+D.mp4
windows10-2004-x64
6Setting Fi...up.mp4
windows10-2004-x64
6Setting Fi...ng.mp4
windows10-2004-x64
6Setting Fi...ng.mp4
windows10-2004-x64
6Setting Fi...ng.mp4
windows10-2004-x64
6Setting Fi...eo.mp4
windows10-2004-x64
6Setting Fi...d.docx
windows10-2004-x64
1Setting Fi...l.docx
windows10-2004-x64
1Analysis
-
max time kernel
142s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
15/08/2023, 13:21
Static task
static1
Behavioral task
behavioral1
Sample
2022 Setting File.zip
Resource
win10v2004-20230703-en
Behavioral task
behavioral2
Sample
Setting File/MINI KeyBoard/MINI KeyBoard-英文/HidLibrary.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral3
Sample
Setting File/MINI KeyBoard/MINI KeyBoard-英文/HidLibrary.pdb
Resource
win10v2004-20230703-en
Behavioral task
behavioral4
Sample
Setting File/MINI KeyBoard/MINI KeyBoard-英文/MINI KeyBoard.application
Resource
win10v2004-20230703-en
Behavioral task
behavioral5
Sample
Setting File/MINI KeyBoard/MINI KeyBoard-英文/MINI KeyBoard.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral6
Sample
Setting File/MINI KeyBoard/MINI KeyBoard-英文/MINI KeyBoard.exe.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral7
Sample
Setting File/MINI KeyBoard/MINI KeyBoard-英文/MINI KeyBoard.exe.manifest
Resource
win10v2004-20230703-en
Behavioral task
behavioral8
Sample
Setting File/MINI KeyBoard/MINI KeyBoard-英文/MINI KeyBoard.pdb
Resource
win10v2004-20230703-en
Behavioral task
behavioral9
Sample
Setting File/MINI KeyBoard/MINI KeyBoard-英文/Theraot.Core.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral10
Sample
Setting File/MINI KeyBoard/MINI KeyBoard-英文/app.publish/MINI KeyBoard.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral11
Sample
Setting File/MINI KeyBoard/MINI KeyBoard-英文/en-US/MINI KeyBoard.resources.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral12
Sample
Setting File/MINI KeyBoard/MINI KeyBoard-英文/zh-CN/MINI KeyBoard.resources.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral13
Sample
Setting File/Operating Video/Bluetooth layer.mp4
Resource
win10v2004-20230703-en
Behavioral task
behavioral14
Sample
Setting File/Operating Video/Ctrl Shift Wheelup Wheeldown Setting.mp4
Resource
win10v2004-20230703-en
Behavioral task
behavioral15
Sample
Setting File/Operating Video/Ctrl+C Ctrl+V Win+D.mp4
Resource
win10v2004-20230703-en
Behavioral task
behavioral16
Sample
Setting File/Operating Video/Ctrl+Shift+Pageup.mp4
Resource
win10v2004-20230703-en
Behavioral task
behavioral17
Sample
Setting File/Operating Video/Knob setting.mp4
Resource
win10v2004-20230703-en
Behavioral task
behavioral18
Sample
Setting File/Operating Video/Led Setting.mp4
Resource
win10v2004-20230703-en
Behavioral task
behavioral19
Sample
Setting File/Operating Video/Letter A setting.mp4
Resource
win10v2004-20230703-en
Behavioral task
behavioral20
Sample
Setting File/Operating Video/Setting Video.mp4
Resource
win10v2004-20230703-en
Behavioral task
behavioral21
Sample
Setting File/Q&A For macro keyboard.docx
Resource
win10v2004-20230703-en
Behavioral task
behavioral22
Sample
Setting File/Romoral User Manual.docx
Resource
win10v2004-20230703-en
General
-
Target
Setting File/MINI KeyBoard/MINI KeyBoard-英文/MINI KeyBoard.application
-
Size
1KB
-
MD5
df840e8107552617ca9c2625e8865b88
-
SHA1
d8e089ec6c1087ea563e14a7c1b97a32e09b381b
-
SHA256
50a1a15cd4c355233f421f1443f9c4186f745e7e7d97201e74a351ea9a10412e
-
SHA512
155108e4d5768417de501f0b0bc5d9e3c9ccf34e000885a9c515224b8396a82e24ca541d8421ef8dc10a45ceee1a2bdc9e1725fe17a464082ff456ab1d0008e5
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 220 wrote to memory of 1856 220 rundll32.exe 81 PID 220 wrote to memory of 1856 220 rundll32.exe 81
Processes
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\dfshim.dll",ShOpenVerbApplication "C:\Users\Admin\AppData\Local\Temp\Setting File\MINI KeyBoard\MINI KeyBoard-英文\MINI KeyBoard.application"1⤵
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"2⤵PID:1856
-