Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

656f95e6e6...4b.exe

windows7-x64

3

656f95e6e6...4b.exe

windows10-2004-x64

3

$SYSDIR/50...er.scr

windows7-x64

3

$SYSDIR/50...er.scr

windows10-2004-x64

3

$TEMP/dospop.exe

windows7-x64

7

$TEMP/dospop.exe

windows10-2004-x64

7

/tbu03...in.dll

windows7-x64

/tbu03...in.dll

windows10-2004-x64

/tbu03...t.html

windows7-x64

/tbu03...t.html

windows10-2004-x64

/tbu03...op.dll

windows7-x64

/tbu03...op.dll

windows10-2004-x64

/tbu03...e.html

windows7-x64

/tbu03...e.html

windows10-2004-x64

/tbu03...s.html

windows7-x64

/tbu03...s.html

windows10-2004-x64

/tbu03...g.html

windows7-x64

/tbu03...g.html

windows10-2004-x64

/tbu03...b.html

windows7-x64

/tbu03...b.html

windows10-2004-x64

/tbu03...er.dll

windows7-x64

/tbu03...er.dll

windows10-2004-x64

Uninstall.exe

windows7-x64

7

Uninstall.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    656f95e6e6813ee88d54842ac9609e4b

  • Size

    4.1MB

  • Sample

    240118-qas1dscadr

  • MD5

    656f95e6e6813ee88d54842ac9609e4b

  • SHA1

    0295695057075c29180e356e091401f001584e4e

  • SHA256

    f32ade747efbed7486284adb1b8ec38b4d593330369b6b52f4b3479f8b0688e3

  • SHA512

    6f08451a4a0bed9e81aea89847f06396959f961f9c2571f5cdb35358b7b88da9365fa329612ae70403c26ddd24ce4eb5d02b65bbfae76e67f2ece99433547026

  • SSDEEP

    98304:OslteTMw6fev+qOgroN/wweXtoeWoAW1FoQTvQfgL5NyI921pLYlQCqV:V8ww6fMtJ0NutrWi1OAvSgLebvF

Score
7/10
adwarestealer

Malware Config

Targets

    • Target

      656f95e6e6813ee88d54842ac9609e4b

    • Size

      4.1MB

    • MD5

      656f95e6e6813ee88d54842ac9609e4b

    • SHA1

      0295695057075c29180e356e091401f001584e4e

    • SHA256

      f32ade747efbed7486284adb1b8ec38b4d593330369b6b52f4b3479f8b0688e3

    • SHA512

      6f08451a4a0bed9e81aea89847f06396959f961f9c2571f5cdb35358b7b88da9365fa329612ae70403c26ddd24ce4eb5d02b65bbfae76e67f2ece99433547026

    • SSDEEP

      98304:OslteTMw6fev+qOgroN/wweXtoeWoAW1FoQTvQfgL5NyI921pLYlQCqV:V8ww6fMtJ0NutrWi1OAvSgLebvF

    Score
    3/10
    behavioral1behavioral2

    • Target

      $SYSDIR/50_Cent_Screensaver.scr

    • Size

      4.1MB

    • MD5

      dc1845f8395fab8ec586a58a60561567

    • SHA1

      c2d06972be8964a4ea48e04c37a09053fea5b612

    • SHA256

      fcef462ab79f13692334dd433e99b8bfd05cd3b2ff16856eb8756b358c5965e4

    • SHA512

      1ee82491243d2a16d9fea7d0dac7600fffb7ecae3d0652eb62c5337cb60df24780fdc985b4253e352d06a5eacb6492a3d179e18e4e7b48f7296e16184b643d44

    • SSDEEP

      98304:HsVVhyXINiBncoKqis0MYD2UICrAC99k+Gx:RYNgLiqYfIolgHx

    Score
    3/10
    behavioral3behavioral4

    • Target

      $TEMP/dospop.exe

    • Size

      437KB

    • MD5

      b2347a5c2350b6342cdabda956618759

    • SHA1

      f6a779efafcf4bd6a9e1f8bf2c66af33f140622e

    • SHA256

      9240b45f226db49da56c7b12b7a347eaee578cfc0e4603019091a1fd81bfcafb

    • SHA512

      76468bda8a4e0df0bf49efdf6cf96d3f45a85db73540e066cc156ca0481d676606d46f3b98774395914c4f357d752c9bbae6e41f9277bc362dd712bd430eda04

    • SSDEEP

      12288:WGeC/oEjVcYKKrh/RfKum6YGBzz9QJWCqoRFf:8CNjVcNKrnVm6vBzBCqoH

    Score
    7/10
    adwarestealer

    • Loads dropped DLL

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware
    behavioral5behavioral6

    • Target

      /tbu03344/RSSReader_plugin.dll

    • Size

      260KB

    • MD5

      131fa8aaa9f5e717477d6e16c6f8fb70

    • SHA1

      17e50467e224d7461c46a456442f10a0da3cc7ec

    • SHA256

      efb9b1707ca2447c63036b1074c402f8ff6a5f30441c03ea372d1f0ec8423bc5

    • SHA512

      d87a6789aec7574c4888e4a6da3c7776e937b62ab481e2aa874752d71854b32a9ad2814321cb24da1f1b134e3b443be4474fbfb09335e06349862151beccd32e

    • SSDEEP

      3072:OoqSEB35vhDI5+crn7CAjtjJ0voNZmDlny+sSy2EjJqP8InGnhIkIoRQc5ciab/W:dEB3QrCgOvSmD1TBEleGOkPWe

    Score
    1/10
    behavioral7behavioral8

    • Target

      /tbu03344/content.tmpl

    • Size

      304B

    • MD5

      80ba40bb56e55f81154073497011785e

    • SHA1

      b3c465dd09afed93e7a7ef6473a329f4c0ca2ccf

    • SHA256

      d069903c72eb22e8b2a3b581e579796df3750e902d2428ed4cb39882891a0d1a

    • SHA512

      f6fbc20ce71a66837b4aa33e5c7af0ade8229290efcb3a2d4e8fd3680de7a3ee33312baffda9de62906f40bce6386c7e148ec0e572fcf5f1a8489b0ebb31b6c5

    Score
    1/10
    behavioral10behavioral9

    • Target

      /tbu03344/dospop.dll

    • Size

      872KB

    • MD5

      c97179ba4ed0491d227335ffebdc856a

    • SHA1

      6de5da7bf23ec5e519a9068817cd26890c1a8930

    • SHA256

      7e333107d1b5d943b9ad2a52625b02d28d79be60734e2d77a8ed2c7335214632

    • SHA512

      bc2eb7c9c939907e7390530722b722aefc7e59a06d59187d9cbb9b9678d2209f484d53b0e3c22337026c4ae6b8c619a53ccd0505612f5ab6b456ec204a4b2265

    • SSDEEP

      12288:JbJRJfYLE7U0n/y2xVlZcuKFAejQD48mCJon71dEMcSbLn3BghuL2OT31YzsPzXh:JVRJfCEw0nq2xVtKFApY5v3+19e

    Score
    1/10
    behavioral11behavioral12

    • Target

      /tbu03344/marquee.tmpl

    • Size

      1KB

    • MD5

      1cb103dabfc25402a01957b9eb04f948

    • SHA1

      da250b475bfb386b1741805bda18fbe6e1ae9282

    • SHA256

      5dd15a2ba1b7b646b1ca35e13ea9ae6c5f3fd5ccfa0480c0070a9b9bf59d477a

    • SHA512

      66441e7796cb87eba88aa2b9493f8dea5371dbe045a5f4bfd45a4d9922fab9e0f5277819c0d11d7d561389c75edb1f9b9002439829a13406b92f46fbfd85d2f7

    Score
    1/10
    behavioral13behavioral14

    • Target

      /tbu03344/options.html

    • Size

      6KB

    • MD5

      adc6e16ce6e97bd1eb19d3a8dad7274f

    • SHA1

      12b55eab3225b2250ba051803f7d791db59a46a1

    • SHA256

      29e525a91d8ac4ec6bb2fa299a404d9f151b45400c7cab09675a23469373435b

    • SHA512

      2c4bc233ae8741fe0a6995845aa88d707b347cfc78745fefac346ce27ddd5b799dd374bbba15516f6e61348f52720be3639cf0cd925a599250a9947a33ab7103

    • SSDEEP

      96:BKQ/O9mOdYCQiLFyzNYs90Yi67mX9gPui39bnLNza7/OBgx4wTn:BFj1cFUYJYnV6Bm8

    Score
    1/10
    behavioral15behavioral16

    • Target

      /tbu03344/static_img.html

    • Size

      503B

    • MD5

      2caff3519f5be538757c467d4fec4756

    • SHA1

      7e77344f049d9ee4d216b6f412c01ba28596773c

    • SHA256

      e94503ad0ea2a4f7002ba70f57e12da9daabb5037b6bedc7725d1fc43a487415

    • SHA512

      029814dd117053d03acc6c0cb1af2802256149c6a3588cd41334deeffad6095dc16386887e2053f288b13a5ebd3599cbf9c55c194fde81f3df77045d2609a467

    Score
    1/10
    behavioral17behavioral18

    • Target

      /tbu03344/static_pub.html

    • Size

      599B

    • MD5

      0bf3de7de6f6a9ece7674fb245c7e428

    • SHA1

      a71d601820676d5741734e825c7347d59570bc98

    • SHA256

      29101ddb9fc880b921c78a8aa0952310ccf0fe4eb03479425500fc2e779d4b2b

    • SHA512

      30dc0cf67d772a79dec244882f24c4a6ad71a3139b1b92d6e059f1e677ef138596e71c7bf12c2283b591ad64744b9abd15895fa29c4a600f64c784423bc270b2

    Score
    1/10
    behavioral19behavioral20

    • Target

      /tbu03344/tbhelper.dll

    • Size

      180KB

    • MD5

      bd60d9ff3cfc8ce202063f75eb817780

    • SHA1

      27f7e3d852ca84223f2a4b48a5a6f8fbca11dfbf

    • SHA256

      3f56aa185c36a69557a87633def1b291bc7e61064e4ee51483e7b6a2659bb51c

    • SHA512

      2946d94e697d02c6d25e9daa7b7f18430a6ba597f9f0ce082296b57e28821d2199aab92ed14c58a95a2fa80824c800ab968fc88797d0f0cf1839befb04518155

    • SSDEEP

      3072:063enkjfM0238ENyc0eePgN8MsSBTwMifOZUv+2jFoArAMsJg:0BiE02HePgCfswMiWZyl0Jg

    Score
    1/10
    behavioral21behavioral22

    • Target

      Uninstall.exe

    • Size

      49KB

    • MD5

      f55a5771c957531993dfb07f95c7a8b1

    • SHA1

      c7bc9fde42dc32660dcc4bf4242dd0c0782c70a3

    • SHA256

      673b8cbb826421c650c9c7e548292337ed4f70e6cb61918b2989478b0d02a511

    • SHA512

      71af1b805331c29ee66ca6c3f05f1e8b262d4d9972e4d150f142837bd006bb03e7ab4166bb39da5cafa095c70afd74b12634dbaa8169478140abacaee4aedb72

    • SSDEEP

      768:LbGBkj++ARXzxc2FdZ6IOw7UkfSy0D3DwdFkqsWkJd+eJRn5Am6kRRJ2iZ3igvPX:/EkjY1zy214Qay0DGkJYqAELVigvPX

    Score
    7/10

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral23behavioral24

MITRE ATT&CK Enterprise v15

Tasks