Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
12/01/2024, 05:35
240112-gactqsgcf6 712/01/2024, 05:30
240112-f7lx8sfdbm 712/01/2024, 05:25
240112-f4aqssfcej 7Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20231215-en -
resource tags
arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system -
submitted
12/01/2024, 05:35
Behavioral task
behavioral1
Sample
adb/AdbWinApi.dll
Resource
win11-20231215-en
Behavioral task
behavioral2
Sample
adb/AdbWinUsbApi.dll
Resource
win11-20231215-en
Behavioral task
behavioral3
Sample
adb/adb.exe
Resource
win11-20231215-en
Behavioral task
behavioral4
Sample
com.anagan.qgp.apk
Resource
win11-20231215-en
Behavioral task
behavioral5
Sample
huiziyuan.net.url
Resource
win11-20231215-en
Behavioral task
behavioral6
Sample
全自动安装.exe
Resource
win11-20231215-en
General
-
Target
adb/AdbWinUsbApi.dll
-
Size
61KB
-
MD5
0e24119daf1909e398fa1850b6112077
-
SHA1
293eedadb3172e756a421790d551e407457e0a8c
-
SHA256
25207c506d29c4e8dceb61b4bd50e8669ba26012988a43fbf26a890b1e60fc97
-
SHA512
9cbb26e555ab40b019a446337db58770b9a0c9c08316ff1e1909c4b6d99c00bd33522d05890870a91b4b581e20c7dce87488ab0d22fc3c4bbdd7e9b38f164b43
-
SSDEEP
1536:l72doFmOiHizFbPlspcsbj5ZsP+YeTs1p:lSSfN9+YeTs1p
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4508 1460 WerFault.exe 74 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 768 wrote to memory of 1460 768 rundll32.exe 74 PID 768 wrote to memory of 1460 768 rundll32.exe 74 PID 768 wrote to memory of 1460 768 rundll32.exe 74
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\adb\AdbWinUsbApi.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\adb\AdbWinUsbApi.dll,#12⤵PID:1460
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1460 -s 4963⤵
- Program crash
PID:4508
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 352 -p 1460 -ip 14601⤵PID:3872