Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

qbittorren...up.exe

windows7-x64

7

qbittorren...up.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    119s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    03/10/2023, 00:34

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    qbittorrent_4.5.5_x64_setup.exe

  • Size

    31.5MB

  • MD5

    a1e3d62bb16c2fef5fba7d2899796239

  • SHA1

    841c7c16a30ca3a2ec77148b2fcd250ce9335830

  • SHA256

    a95a39a8701661fcd9eec6dbf78f8099be1edfa145fb7d43a0105ec82f97df8f

  • SHA512

    121401f7df8f4cd01ecc5205510ad4d824ca7208ddb69bb9a5e4678359e82005d76b20467662878975a739f41236edc8581f61279bae278dbb5c7206058def59

  • SSDEEP

    786432:rDRS7fOdUC+EQNLErJ5L8xPEP9vnzfrnfHo9ft03Pvy96VgQCGq7NBwq:rp1+EQNLkJO2pnvnfIfq3P6YCn7H

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1288.0.698899168\545993885" -parentBuildID 20221007134813 -prefsHandle 1164 -prefMapHandle 1156 -prefsLen 20938 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2b114a6f-f05d-44fc-a62e-a5950998af9a} 1288 "\\.\pipe\gecko-crash-server-pipe.1288" 1228 11cf8558 gpu
    1⤵
      PID:2604
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1288.1.2065089182\49274068" -parentBuildID 20221007134813 -prefsHandle 1404 -prefMapHandle 1400 -prefsLen 21019 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {60ebf2a5-6e74-4675-91a6-93f2a1ef1fde} 1288 "\\.\pipe\gecko-crash-server-pipe.1288" 1432 d71358 socket
      1⤵
        PID:2748
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1288.2.512496184\312416413" -childID 1 -isForBrowser -prefsHandle 1908 -prefMapHandle 1796 -prefsLen 21122 -prefMapSize 232675 -jsInitHandle 896 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {48b2b870-49c8-4cb6-ab1f-21c985f50b72} 1288 "\\.\pipe\gecko-crash-server-pipe.1288" 1784 1880ae58 tab
        1⤵
          PID:2904
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1288.3.1049074852\590896552" -childID 2 -isForBrowser -prefsHandle 2236 -prefMapHandle 2332 -prefsLen 26482 -prefMapSize 232675 -jsInitHandle 896 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {96acefb8-b287-429e-92bc-68f4c60e2596} 1288 "\\.\pipe\gecko-crash-server-pipe.1288" 2360 d67858 tab
          1⤵
            PID:2424
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1288.4.469757190\505245479" -childID 3 -isForBrowser -prefsHandle 2620 -prefMapHandle 2616 -prefsLen 26482 -prefMapSize 232675 -jsInitHandle 896 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bf78a9cf-48c6-43bd-ad04-b9ddea65a1b2} 1288 "\\.\pipe\gecko-crash-server-pipe.1288" 2636 1a32a758 tab
            1⤵
              PID:1436
            • C:\Users\Admin\AppData\Local\Temp\qbittorrent_4.5.5_x64_setup.exe
              "C:\Users\Admin\AppData\Local\Temp\qbittorrent_4.5.5_x64_setup.exe"
              1⤵
              • Loads dropped DLL
              • Suspicious behavior: GetForegroundWindowSpam
              PID:2312
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1288.6.1420719439\286590866" -childID 5 -isForBrowser -prefsHandle 3764 -prefMapHandle 3768 -prefsLen 26541 -prefMapSize 232675 -jsInitHandle 896 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7df5e052-165b-4526-8e3b-0e521537c3c3} 1288 "\\.\pipe\gecko-crash-server-pipe.1288" 3752 1d22b958 tab
              1⤵
                PID:1572
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1288.7.55588463\1901186429" -childID 6 -isForBrowser -prefsHandle 3952 -prefMapHandle 3956 -prefsLen 26541 -prefMapSize 232675 -jsInitHandle 896 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fcaa2765-2b70-4851-8a40-63145b6aee15} 1288 "\\.\pipe\gecko-crash-server-pipe.1288" 3940 1d22bf58 tab
                1⤵
                  PID:440
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1288.5.646770131\1959941138" -childID 4 -isForBrowser -prefsHandle 3644 -prefMapHandle 3500 -prefsLen 26541 -prefMapSize 232675 -jsInitHandle 896 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c46a9087-45fc-49c4-9fbd-e613e929fe01} 1288 "\\.\pipe\gecko-crash-server-pipe.1288" 3656 1d22c858 tab
                  1⤵
                    PID:2004

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • \Users\Admin\AppData\Local\Temp\nst430B.tmp\LangDLL.dll
                    Filesize

                    5KB

                    MD5

                    68b287f4067ba013e34a1339afdb1ea8

                    SHA1

                    45ad585b3cc8e5a6af7b68f5d8269c97992130b3

                    SHA256

                    18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026

                    SHA512

                    06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\nst430B.tmp\System.dll
                    Filesize

                    12KB

                    MD5

                    cff85c549d536f651d4fb8387f1976f2

                    SHA1

                    d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

                    SHA256

                    8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

                    SHA512

                    531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\nst430B.tmp\UAC.dll
                    Filesize

                    14KB

                    MD5

                    adb29e6b186daa765dc750128649b63d

                    SHA1

                    160cbdc4cb0ac2c142d361df138c537aa7e708c9

                    SHA256

                    2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

                    SHA512

                    b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\nst430B.tmp\nsDialogs.dll
                    Filesize

                    9KB

                    MD5

                    6c3f8c94d0727894d706940a8a980543

                    SHA1

                    0d1bcad901be377f38d579aafc0c41c0ef8dcefd

                    SHA256

                    56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2

                    SHA512

                    2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355

                    Download Submit