Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
32854e234da...12.exe
windows7-x64
72854e234da...12.exe
windows10-2004-x64
7$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3LICENSES.c...m.html
windows7-x64
1LICENSES.c...m.html
windows10-2004-x64
1d3dcompiler_47.dll
windows7-x64
1d3dcompiler_47.dll
windows10-2004-x64
1ffmpeg.dll
windows7-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows7-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows7-x64
1libGLESv2.dll
windows10-2004-x64
1resources/elevate.exe
windows7-x64
1resources/elevate.exe
windows10-2004-x64
1swiftshade...GL.dll
windows7-x64
1swiftshade...GL.dll
windows10-2004-x64
1swiftshade...v2.dll
windows7-x64
1swiftshade...v2.dll
windows10-2004-x64
1updater.exe
windows7-x64
7updater.exe
windows10-2004-x64
7vk_swiftshader.dll
windows7-x64
1vk_swiftshader.dll
windows10-2004-x64
1vulkan-1.dll
windows7-x64
1vulkan-1.dll
windows10-2004-x64
1$PLUGINSDI...7z.dll
windows7-x64
3$PLUGINSDI...7z.dll
windows10-2004-x64
3Analysis
-
max time kernel
144s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
12/01/2024, 23:07
Static task
static1
Behavioral task
behavioral1
Sample
2854e234da3cf8855095e1b74f3bb61e5a39ebd534b531f46d875add3eb29312.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2854e234da3cf8855095e1b74f3bb61e5a39ebd534b531f46d875add3eb29312.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
LICENSES.chromium.html
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
LICENSES.chromium.html
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
d3dcompiler_47.dll
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
d3dcompiler_47.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
ffmpeg.dll
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
ffmpeg.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
libEGL.dll
Resource
win7-20231129-en
Behavioral task
behavioral14
Sample
libEGL.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral15
Sample
libGLESv2.dll
Resource
win7-20231215-en
Behavioral task
behavioral16
Sample
libGLESv2.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral17
Sample
resources/elevate.exe
Resource
win7-20231129-en
Behavioral task
behavioral18
Sample
resources/elevate.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral19
Sample
swiftshader/libEGL.dll
Resource
win7-20231129-en
Behavioral task
behavioral20
Sample
swiftshader/libEGL.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral21
Sample
swiftshader/libGLESv2.dll
Resource
win7-20231215-en
Behavioral task
behavioral22
Sample
swiftshader/libGLESv2.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral23
Sample
updater.exe
Resource
win7-20231215-en
Behavioral task
behavioral24
Sample
updater.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral25
Sample
vk_swiftshader.dll
Resource
win7-20231215-en
Behavioral task
behavioral26
Sample
vk_swiftshader.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral27
Sample
vulkan-1.dll
Resource
win7-20231215-en
Behavioral task
behavioral28
Sample
vulkan-1.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral29
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win7-20231215-en
Behavioral task
behavioral30
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win10v2004-20231215-en
General
-
Target
LICENSES.chromium.html
-
Size
5.3MB
-
MD5
dfa12f4edccb902d7d3b07fae219f176
-
SHA1
c2073440a5add265b4143de05e6864fed2c3b840
-
SHA256
501f0b7ebf0be7ed8702d317332a0f8820af837c0a2a1d7645ba04352270e2b8
-
SHA512
eee3a8e0eeae139ddd9369d0869c29c91007bf6c5b0d7982918d5a013214a9e80b9233e7c1ccb43124152f684f0b782831b0a6b3d126558261dd161230004e50
-
SSDEEP
12288:FetnJnVncnJnknE9RBvjYJEi400/Q599b769B9UOE6MwMGucMEbHDuX04nNWQFna:WbXZ5IoWSL9bcwVR8mf+/cHBBaRp1
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30284f11ad45da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000ba5bd91175a389352e8d5078b4540dee5e280a17ef940c9f5d8fded928fda9ce000000000e8000000002000020000000610fc1fd6cfd475c950ded72f08f274e9cc63b00eca8530cc5625f79793d3b3590000000d6d1fb4fef075ecdf8bfbd5b66a7d84910668e4eb05167ef94e224d799922338f396dfca8d990399626b3f100161ecbae9430fb20c708c35752894ba895420b87d3943f0e185c9b7128c31b8aefcbe22f0bb276f7b3ab2e3a243f87fee7131713a4c7a31301f03d98d37f7e0769bcae761632b8ba9ad9fdb15646eb4ddc17fb4f0ccb59adb5cb864dfb43aaaecf101b540000000ffd00737ba6f540db733d649435cc4094750bb0db49221a8f53568a758f19b39fafc1fe2847c87c5d5dfb0751a40233b63c4e848e6b45f648045bc726bfc84ce iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411263097" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000005235a67c183c4a9913eb5200572bf457fd40887972f39db92e50f6c9c102f21d000000000e8000000002000020000000300da135d0f16c431379cc1b6f9f4aef711dc166eb664477939667b8f988f0b420000000d39f4ed3f38fb0284b3a319f2cd6b5b6cc1112575d24272aa9c0b45de56bf44c40000000254ffab5f9abeafcefcd2c88dde0e33fd45a3d3bbfe18155c93be9dfe52a50de462709ef3ffe53a9a40dc4522271ff8e818e346b8a430f726f35c81db1d6aaca iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3AE4F801-B1A0-11EE-A2F4-C2500A176F17} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2136 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2136 iexplore.exe 2136 iexplore.exe 2392 IEXPLORE.EXE 2392 IEXPLORE.EXE 2392 IEXPLORE.EXE 2392 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2136 wrote to memory of 2392 2136 iexplore.exe 28 PID 2136 wrote to memory of 2392 2136 iexplore.exe 28 PID 2136 wrote to memory of 2392 2136 iexplore.exe 28 PID 2136 wrote to memory of 2392 2136 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2136 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2392
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52c0989997ad938e105295c051a023d7a
SHA12a50d154465ab26a245f3249d1ae050f5a975269
SHA256000cf9752ed262345c4d449365a72c5ec16b7cee9447b4f2bc408461ad0d86aa
SHA51242d9ed1aa4d340012e01a7e412d3919b79b3d037a31bc4f13a51125e79feeee0c2d118b93f58869516208711fbed7e348e070bfda6b5b153705ec09500823a23
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fc287f6d643f3cbc5959b902acebd34a
SHA1074bb24006636d7328df4aa488c018e955b75e87
SHA2562cd11ea1b316b35df0e7ba6fefa2befba36e51f2d13868753faf17088506b297
SHA5127290321a972346540828777ffb31a4bff271515583b3bec38a2300fa964aeec6c68d8fdce328603cb822ac6b6e32ecfee622426083703c242902429d0fcdf57d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD549741bf2228d7518f4512d4f67180cc9
SHA1e25da8e474ac6f9bcfdf6f9d65e0b30e7f3d5ec5
SHA256e49437b33d961e0a7ad6193467b41c2357a15bbe90385ac21aa13c688006dcc4
SHA512749f393cbf8cf61c430f111d82e269037c5b0f34cbbcb88906eb6e2f6cf045e045acc30ef658e9b10998649c94ff1866b179391825d445e1752bb0719bd47fc8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56f0566713529ff6a7c868341bac17983
SHA169870d1623ab4c4fa97ba09dbf908d9285d97351
SHA256a35090a4227f640587eef121f76062b45d75b2446c45be1cd3d2b81ac4a4e3c3
SHA512fec50994ba72c828af30232de7301906cc2f4bac8c90f5736277d604defe83cf0f9966e642a4926be38c8340468b5e2d1f1c59d28fececc01e6306efcfe6994d
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06