Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

54992b2e59...b0.exe

windows7-x64

7

54992b2e59...b0.exe

windows10-2004-x64

7

$PLUGINSDI...RL.dll

windows7-x64

3

$PLUGINSDI...RL.dll

windows10-2004-x64

3

$PLUGINSDI...se.dll

windows7-x64

3

$PLUGINSDI...se.dll

windows10-2004-x64

3

$PLUGINSDI...se.rtf

windows7-x64

4

$PLUGINSDI...se.rtf

windows10-2004-x64

1

$PLUGINSDI...ub.exe

windows7-x64

7

$PLUGINSDI...ub.exe

windows10-2004-x64

7

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...on.dll

windows7-x64

3

$PLUGINSDI...on.dll

windows10-2004-x64

3

$PLUGINSDIR/Math.dll

windows7-x64

3

$PLUGINSDIR/Math.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...fo.dll

windows7-x64

3

$PLUGINSDI...fo.dll

windows10-2004-x64

3

$PLUGINSDI...se.rtf

windows7-x64

4

$PLUGINSDI...se.rtf

windows10-2004-x64

1

$PLUGINSDI...se.rtf

windows7-x64

4

$PLUGINSDI...se.rtf

windows10-2004-x64

6

$PLUGINSDI...ib.dll

windows7-x64

3

$PLUGINSDI...ib.dll

windows10-2004-x64

3

$PLUGINSDI...se.rtf

windows7-x64

4

$PLUGINSDI...se.rtf

windows10-2004-x64

1

$PLUGINSDI...vo.rtf

windows7-x64

4

$PLUGINSDI...vo.rtf

windows10-2004-x64

1

$PLUGINSDI...de.rtf

windows7-x64

4

$PLUGINSDI...de.rtf

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    54992b2e59d01aba400012d8169764b0

  • Size

    441KB

  • Sample

    240111-z4kqjsheg4

  • MD5

    54992b2e59d01aba400012d8169764b0

  • SHA1

    7548b66850441c4a6b6fc05c6d0ee00f21fb8fc0

  • SHA256

    f8f069a41e4d653622bc3b8554bfd82d68a9d52c54510f574a669db91ab1c6ba

  • SHA512

    9798babcfcb78f27df4a30048bd75e9cb0196bf9e27cf0cd72f03d961dcf89cae63f22e3165ed525e8ea6c61c2ac1731dfe7be7b5273cecb2616eacdbbdb982a

  • SSDEEP

    12288:tI2HuFybubDbQpJDGQUN1g38rNrmZH2JsRgFKHyp:XSn+DOjiN9Hyp

Score
7/10
discoveryspywarestealer

Malware Config

Targets

    • Target

      54992b2e59d01aba400012d8169764b0

    • Size

      441KB

    • MD5

      54992b2e59d01aba400012d8169764b0

    • SHA1

      7548b66850441c4a6b6fc05c6d0ee00f21fb8fc0

    • SHA256

      f8f069a41e4d653622bc3b8554bfd82d68a9d52c54510f574a669db91ab1c6ba

    • SHA512

      9798babcfcb78f27df4a30048bd75e9cb0196bf9e27cf0cd72f03d961dcf89cae63f22e3165ed525e8ea6c61c2ac1731dfe7be7b5273cecb2616eacdbbdb982a

    • SSDEEP

      12288:tI2HuFybubDbQpJDGQUN1g38rNrmZH2JsRgFKHyp:XSn+DOjiN9Hyp

    Score
    7/10
    discoveryspywarestealer

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks for any installed AV software in registry

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

    • Target

      $PLUGINSDIR/BrandingURL.dll

    • Size

      4KB

    • MD5

      71c46b663baa92ad941388d082af97e7

    • SHA1

      5a9fcce065366a526d75cc5ded9aade7cadd6421

    • SHA256

      bb2b9c272b8b66bc1b414675c2acba7afad03fff66a63babee3ee57ed163d19e

    • SHA512

      5965bd3f5369b9a1ed641c479f7b8a14af27700d0c27d482aa8eb62acc42f7b702b5947d82f9791b29bcba4d46e1409244f0a8ddce4ec75022b5e27f6d671bce

    Score
    3/10
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/CustomLicense.dll

    • Size

      4KB

    • MD5

      ca37f2747e04ae09ae9f14852574abef

    • SHA1

      e40bf34907337340520f368575c848ddb62f98c5

    • SHA256

      bbcab5c7e9f4b3f63184b23995e5b335a1c6ca5108aaa1be0eaf3fbf78afc1c4

    • SHA512

      ea781e646313bc458fba0ce66e357818725f385cb6c3383bb9c41dbb5221a6f43e3d8296aa3cbd5e8759d95d87a8eefa5f87665912fbc65c8eb4efcacabfdb60

    Score
    3/10
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/DefaultTab_license.rtf

    • Size

      14KB

    • MD5

      b97839b3cfe1f7e62ef09d5a2815ed81

    • SHA1

      e569ba28d4a88a6e23551b96b3cec0e710b99487

    • SHA256

      f2c89065a00e08202756cb383d3092b685dcec2075314f494df71bf8ec01fd11

    • SHA512

      227a2a1b5322dd183ca7463aec8613447b8670e97011e26286d2718571ca76a6206493aee2bb3c747bdd28892ee9820e3da58e3e69e0d42051e26b112aabc221

    • SSDEEP

      384:ZrPL4Pgxpgc7u2ucXCN6CCnNA9NDrclFyLkH4A2:9Og3gwu2u3N6CCnNAfAjHS

    Score
    4/10
    behavioral7behavioral8

    • Target

      $PLUGINSDIR/DualStub.exe

    • Size

      56KB

    • MD5

      9b6c7fbe8b0396a655047e47961d7c19

    • SHA1

      4133bef2abaa4a6547d0e5ffb7015484a27d2774

    • SHA256

      4a3513307d3c0f3a6c7c5481999e5baa93cd9bad475a45d358f8f67763bf4a38

    • SHA512

      49b7ef18eaee509d399f1b84e0283908af4543e606d0b802b5fb3ef1ce9505e9f7d515aa54eb8e38ce1656f16148ef1b86dd293bbfd30e916c95b009be99e2a2

    • SSDEEP

      1536:GpgpHzb9dZVX9fHMvG0D3XJyl6DS9rjd1V/DOSUvKIS:sgXdZt9P6D3XJyl2SNhDmvK/

    Score
    7/10

    • Loads dropped DLL

    behavioral10behavioral9

    • Target

      $PLUGINSDIR/FindProcDLL.dll

    • Size

      3KB

    • MD5

      8614c450637267afacad1645e23ba24a

    • SHA1

      e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2

    • SHA256

      0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758

    • SHA512

      af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b

    Score
    3/10
    behavioral11behavioral12

    • Target

      $PLUGINSDIR/GetVersion.dll

    • Size

      6KB

    • MD5

      5264f7d6d89d1dc04955cfb391798446

    • SHA1

      211d8d3e7c2b2f57f54a11cb8bc4fa536df08acc

    • SHA256

      7d76c7dd8f7cd5a87e0118dacb434db3971a049501e22a5f4b947154621ab3d4

    • SHA512

      80d27ee2f87e2822bd5c8c55cc3d1e49beebb86d8557c92b52b7cbea9f27882d80e59eefa25e414eecee268a9a6193b6b50b748de33c778b007cde24ef8bcfb7

    • SSDEEP

      96:E12Z84uiwpGTVTDSpaHYfniz0R3GhCvXY6Ix5vdR7pBi46AQ5Vu4:2STVTGwYhR3GhCvy5vH7pBi46AQ5Vu

    Score
    3/10
    behavioral13behavioral14

    • Target

      $PLUGINSDIR/Math.dll

    • Size

      66KB

    • MD5

      b140459077c7c39be4bef249c2f84535

    • SHA1

      c56498241c2ddafb01961596da16d08d1b11cd35

    • SHA256

      0598f7d83db44929b7170c1285457b52b4281185f63ced102e709bf065f10d67

    • SHA512

      fbcb19a951d96a216d73b6b3e005338bbb6e11332c6cc8c3f179ccd420b4db0e5682dc4245bd120dcb67bc70960eab368e74c68c7c165a485a12a7d0d8a00328

    • SSDEEP

      1536:0P43WZ4Ql60gam+2MwRmPeqFVHbQH0ZZ1Iet:0wU609VMH0T/t

    Score
    3/10
    behavioral15behavioral16

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      c17103ae9072a06da581dec998343fc1

    • SHA1

      b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

    • SHA256

      dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

    • SHA512

      d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

    • SSDEEP

      192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw

    Score
    3/10
    behavioral17behavioral18

    • Target

      $PLUGINSDIR/UserInfo.dll

    • Size

      4KB

    • MD5

      7579ade7ae1747a31960a228ce02e666

    • SHA1

      8ec8571a296737e819dcf86353a43fcf8ec63351

    • SHA256

      564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5

    • SHA512

      a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b

    Score
    3/10
    behavioral19behavioral20

    • Target

      $PLUGINSDIR/frg_license.rtf

    • Size

      57KB

    • MD5

      7be0f88cc380caaf3efc805e14eb3c9b

    • SHA1

      28cfb260e938a81bd4eada0099e397ec83f2e619

    • SHA256

      5101a990a7d78e415958a8e803fae4b4a1de3601d9fb37dbb55f85e0644a85a3

    • SHA512

      a307c461dbb171f88972e2220a07f307a1f006f00a0369a935fb33c9af4d4cef62cc2e05ec9a9d84376778556ed201d10884319fbf9b35581bce71cbbf771c4c

    • SSDEEP

      768:GH6OyQAoYRJQQA5Vq7MYQQA5VqKMPQQA5Vq7MPQQA5VqUMPQQA5VqT81O3idRfOE:SpsxIUhd

    Score
    4/10
    behavioral21behavioral22

    • Target

      $PLUGINSDIR/gc_license.rtf

    • Size

      14KB

    • MD5

      5190bd8d892384b72d0a7f5eb4364eb0

    • SHA1

      4960e2af31f9dc90f6c8f864b8fb865150e76e97

    • SHA256

      cd47392546a0b63061e33a431debd341f21755d794b59d14b6272ae895725db3

    • SHA512

      718bd94078f78f074d6dee299aadd12041e1b7cee9a51aa8ce320477845d627259da76239ac1f10a87dd90135c1a9c83f65ddd6dc1eac4d18ef210a3cd2b6295

    • SSDEEP

      384:PMxEXYxvXulMRXk///JGGl/q7yJQCTLDJTLSjYC12xx:VXYx2lW0/3JGGl/q76QCTPJTWYC12xx

    Score
    6/10

    • Process spawned suspicious child process

      This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

    behavioral23behavioral24

    • Target

      $PLUGINSDIR/intlib.dll

    • Size

      24KB

    • MD5

      1efbbf5a54eb145a1a422046fd8dfb2c

    • SHA1

      ec4efd0a95bb72fd4cf47423647e33e5a3fddf26

    • SHA256

      983859570099b941c19d5eb9755eda19dd21f63e8ccad70f6e93f055c329d341

    • SHA512

      7fdeba8c961f3507162eb59fb8b9b934812d449cc85c924f61722a099618d771fed91cfb3944e10479280b73648a9a5cbb23482d7b7f8bfb130f23e8fd6c15fb

    • SSDEEP

      384:XErRo4TdlKCdUk6qz46qu2vPqUcnlSHmkuPJOiya4fF0Ac9khYLMkIX0+GvBgK3M:XiRoW7Kc5bBq1qNlSHmkuPJOJa4f4CD

    Score
    3/10
    behavioral25behavioral26

    • Target

      $PLUGINSDIR/jp_license.rtf

    • Size

      47KB

    • MD5

      2295052cf62645dba3faf2eda7615284

    • SHA1

      35a12753dab4c8c038112264b392e3568bebf2b9

    • SHA256

      f35bd0bb83bd565b5830df90a0280726746c523ac00c34f7a8211d92ed371de9

    • SHA512

      fe71413c234354551fd350921c42edc3dd042f3ef7272189b3d8195dcf605420fa6734e315f194c26bcf9b4327ae7c0f7475c1b573656e69d26348924707227d

    • SSDEEP

      768:gEz9fy2DcPMRC90OtKWcURiuowatg14J4bR0+2he7tsGUY60V+Sd6GvzWG6idwxa:By7yGCGJ9mm

    Score
    4/10
    behavioral27behavioral28

    • Target

      $PLUGINSDIR/license_Ciuvo.rtf

    • Size

      36KB

    • MD5

      ba4c90081e04285a65dc539bb7ecc1b5

    • SHA1

      858a3c8f576a5369ca6c1c19288c7601224454bb

    • SHA256

      36438f8057a12df36d93c249b90cff0df7d50b70aa4ee9053bf5902e6f5e8340

    • SHA512

      17d01f17643cc978aa855916ccb2fea15c7b8742f91d5c6b42b64062fb6aa8b826ed2c769ea35a4308ef6746a67df1c20c81cc63e5ec45e8caafff10eb9baa07

    • SSDEEP

      192:Oe66QzSvmgoUpYzKCXHjJnaKFQusE+VjcQh+gg+KpehSJSy3zS2GRerpadVB5NAx:u6wStoUpYSKcYAWJjMdT5ivZfF

    Score
    4/10
    behavioral29behavioral30

    • Target

      $PLUGINSDIR/license_Ciuvo_de.rtf

    • Size

      31KB

    • MD5

      c17d94791d08bc745dfb92155cb214fe

    • SHA1

      5fdb5c87f120baea6d77db3c7a1d8150c2fe96e5

    • SHA256

      dc3838a77f2869905c5117814f1eb4edf8c980994f4fb5c728518e9ea0835442

    • SHA512

      035c133c8e547d36eae7246e69d0ef57a447a9a3a7b5dfe48c465c5357d7abedfbdef74717ebef76a9f5e8f05766f6223a64cbd22e60640b5661d09f5c67bb94

    • SSDEEP

      768:fmDxjufnFvTCPe+V9EOReOb1vPwgyr+dX/VHDfAhWba5TzAVqnD69n:4vPDhddfMWP

    Score
    4/10
    behavioral31behavioral32

MITRE ATT&CK Enterprise v15

Tasks

static1

Score
3/10

behavioral1

discoveryspywarestealer
Score
7/10

behavioral2

discoveryspywarestealer
Score
7/10

behavioral3

Score
3/10

behavioral4

Score
3/10

behavioral5

Score
3/10

behavioral6

Score
3/10

behavioral7

Score
4/10

behavioral8

Score
1/10

behavioral9

Score
7/10

behavioral10

Score
7/10

behavioral11

Score
3/10

behavioral12

Score
3/10

behavioral13

Score
3/10

behavioral14

Score
3/10

behavioral15

Score
3/10

behavioral16

Score
3/10

behavioral17

Score
3/10

behavioral18

Score
3/10

behavioral19

Score
3/10

behavioral20

Score
3/10

behavioral21

Score
4/10

behavioral22

Score
1/10

behavioral23

Score
4/10

behavioral24

Score
6/10

behavioral25

Score
3/10

behavioral26

Score
3/10

behavioral27

Score
4/10

behavioral28

Score
1/10

behavioral29

Score
4/10

behavioral30

Score
1/10

behavioral31

Score
4/10

behavioral32

Score
1/10