Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
6Static
static
3(4K) v1.1_...ed.exe
windows7-x64
3(4K) v1.1_...ed.exe
windows10-2004-x64
6(4K) v1.1_...od.exe
windows7-x64
1(4K) v1.1_...od.exe
windows10-2004-x64
1(4K) v1.1_...d9.dll
windows7-x64
1(4K) v1.1_...d9.dll
windows10-2004-x64
1(4K) v1.1_...ap.dll
windows7-x64
1(4K) v1.1_...ap.dll
windows10-2004-x64
1(4K) v1.1_...t8.dll
windows7-x64
1(4K) v1.1_...t8.dll
windows10-2004-x64
3(4K) v1.1_...ts.dll
windows7-x64
1(4K) v1.1_...ts.dll
windows10-2004-x64
3(4K) v1.1_...ns.dll
windows7-x64
1(4K) v1.1_...ns.dll
windows10-2004-x64
1(4K) v1.1_...ix.dll
windows7-x64
1(4K) v1.1_...ix.dll
windows10-2004-x64
1Analysis
-
max time kernel
55s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
23/08/2023, 15:39
Static task
static1
Behavioral task
behavioral1
Sample
(4K) v1.1_Underground_-_Definitive_Edition/Underground - Definitive Edition Mod/Speed.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
(4K) v1.1_Underground_-_Definitive_Edition/Underground - Definitive Edition Mod/Speed.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral3
Sample
(4K) v1.1_Underground_-_Definitive_Edition/Underground - Definitive Edition Mod/Texmod.exe
Resource
win7-20230712-en
Behavioral task
behavioral4
Sample
(4K) v1.1_Underground_-_Definitive_Edition/Underground - Definitive Edition Mod/Texmod.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral5
Sample
(4K) v1.1_Underground_-_Definitive_Edition/Underground - Definitive Edition Mod/d3d9.dll
Resource
win7-20230712-en
Behavioral task
behavioral6
Sample
(4K) v1.1_Underground_-_Definitive_Edition/Underground - Definitive Edition Mod/d3d9.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral7
Sample
(4K) v1.1_Underground_-_Definitive_Edition/Underground - Definitive Edition Mod/dimap.dll
Resource
win7-20230712-en
Behavioral task
behavioral8
Sample
(4K) v1.1_Underground_-_Definitive_Edition/Underground - Definitive Edition Mod/dimap.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral9
Sample
(4K) v1.1_Underground_-_Definitive_Edition/Underground - Definitive Edition Mod/dinput8.dll
Resource
win7-20230712-en
Behavioral task
behavioral10
Sample
(4K) v1.1_Underground_-_Definitive_Edition/Underground - Definitive Edition Mod/dinput8.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral11
Sample
(4K) v1.1_Underground_-_Definitive_Edition/Underground - Definitive Edition Mod/scripts/DebugOpts.dll
Resource
win7-20230712-en
Behavioral task
behavioral12
Sample
(4K) v1.1_Underground_-_Definitive_Edition/Underground - Definitive Edition Mod/scripts/DebugOpts.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral13
Sample
(4K) v1.1_Underground_-_Definitive_Edition/Underground - Definitive Edition Mod/scripts/NFSUHDReflections.dll
Resource
win7-20230712-en
Behavioral task
behavioral14
Sample
(4K) v1.1_Underground_-_Definitive_Edition/Underground - Definitive Edition Mod/scripts/NFSUHDReflections.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral15
Sample
(4K) v1.1_Underground_-_Definitive_Edition/Underground - Definitive Edition Mod/scripts/NFSUnderground.WidescreenFix.dll
Resource
win7-20230712-en
Behavioral task
behavioral16
Sample
(4K) v1.1_Underground_-_Definitive_Edition/Underground - Definitive Edition Mod/scripts/NFSUnderground.WidescreenFix.dll
Resource
win10v2004-20230703-en
General
-
Target
(4K) v1.1_Underground_-_Definitive_Edition/Underground - Definitive Edition Mod/Speed.exe
-
Size
3.0MB
-
MD5
22c731fe0c0c41fe14ce80b728b6cbe0
-
SHA1
0fe57c4f9ecf53fe60cad8a5ce21c6f218bd925d
-
SHA256
35654f401383be9af0dbff0d11a92220a17579a01030005de6943e63e03f460f
-
SHA512
23895d66ecec480095a7f1be53147ed3f5100e09b7fcb4135476d42c2db7313c1149f49a3b725a126895271e9d378fc16dac8d7ec4097516adc1ed593c7d0c0b
-
SSDEEP
49152:UL5aHsJ+Ad6UQYJ4AbWaSzyN2Cjmi4H7CoCbmK1ixBuKcTqiXaPCFCrgdi/U1ZLW:3Ngd5a/UHmmJ1CK35QjN3
Malware Config
Signatures
-
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Videos\Captures\desktop.ini svchost.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4176 3076 WerFault.exe 85 -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4176143399-3250363947-192774652-1000\{5B00EA97-9BD4-45CD-8979-2CF752CC6AAF} svchost.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 3076 Speed.exe 3076 Speed.exe 3076 Speed.exe 3076 Speed.exe 3076 Speed.exe 3076 Speed.exe 3076 Speed.exe 3076 Speed.exe 3076 Speed.exe 3076 Speed.exe 3076 Speed.exe 3076 Speed.exe 3076 Speed.exe 3076 Speed.exe 3076 Speed.exe 3076 Speed.exe 3076 Speed.exe 3076 Speed.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3076 Speed.exe 3076 Speed.exe 2112 OpenWith.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\(4K) v1.1_Underground_-_Definitive_Edition\Underground - Definitive Edition Mod\Speed.exe"C:\Users\Admin\AppData\Local\Temp\(4K) v1.1_Underground_-_Definitive_Edition\Underground - Definitive Edition Mod\Speed.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3076 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3076 -s 23202⤵
- Program crash
PID:4176
-
-
C:\Windows\System32\GameBarPresenceWriter.exe"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer1⤵PID:2004
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:2112
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Drops desktop.ini file(s)
- Modifies registry class
PID:1852
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3076 -ip 30761⤵PID:4512
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
190B
MD5b0d27eaec71f1cd73b015f5ceeb15f9d
SHA162264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA25686d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
SHA5127b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c