Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
37780f8eb62...0a.exe
windows7-x64
77780f8eb62...0a.exe
windows10-2004-x64
7$0/basicscan.dll
windows7-x64
1$0/basicscan.dll
windows10-2004-x64
1$0/basicscan.exe
windows7-x64
1$0/basicscan.exe
windows10-2004-x64
1$0/uninstall.exe
windows7-x64
7$0/uninstall.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3Analysis
-
max time kernel
136s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26/01/2024, 13:36
Static task
static1
Behavioral task
behavioral1
Sample
7780f8eb628d8b09292d1e2a74a06f0a.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7780f8eb628d8b09292d1e2a74a06f0a.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
$0/basicscan.dll
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
$0/basicscan.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
$0/basicscan.exe
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
$0/basicscan.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral7
Sample
$0/uninstall.exe
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
$0/uninstall.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20231129-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231215-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20231215-en
General
-
Target
$0/uninstall.exe
-
Size
78KB
-
MD5
a2a6e2fe649d7df57bc7c53c43b70d8d
-
SHA1
8909dccd63e93d13be0d7d2d13fc18213cd2fce0
-
SHA256
a64aa3eeeb7916ad2bcaa43b58394636ca74f29403fd667a2d370d2710858fe2
-
SHA512
afa67804416104160c3c5f9ebe45d4adbf25f6cb85a65ac20c08918e6e67939105173a25a83f7191c4dcfc7a9d26db1edc6cacd42e1c6c70ec1a35b62e07ba69
-
SSDEEP
1536:PEkjY1zy214Qay0DGkJ7qAELVigJLcpub3RsagxxZ/RL32/DB:8kjAJ4dDGkJ+AI0F8hsagjZ/RLm/1
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1428 Au_.exe -
Loads dropped DLL 2 IoCs
pid Process 1428 Au_.exe 1428 Au_.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 1 IoCs
resource yara_rule behavioral8/files/0x000a000000023020-3.dat nsis_installer_1 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5116 wrote to memory of 1428 5116 uninstall.exe 88 PID 5116 wrote to memory of 1428 5116 uninstall.exe 88 PID 5116 wrote to memory of 1428 5116 uninstall.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\$0\uninstall.exe"C:\Users\Admin\AppData\Local\Temp\$0\uninstall.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\$0\2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1428
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13KB
MD5d765c492c21689e3d9d61634371fd861
SHA1ac200933671ae52c9d5544d0e2e8e9144d286c83
SHA256551e6042dd494ea01549555ffc194ab9729da09058ec714eb368dd06642c9bbc
SHA5129919a9e848c8f1e26c75d0d29207571e4b86a4140bd554743d2c1f8bd7f386fe4919345b163d89a5d907fb165e435ba0ac5f6b1101713636141f156a420e2e0f
-
Filesize
10KB
MD5fe24766ba314f620d57d0cf7339103c0
SHA18641545f03f03ff07485d6ec4d7b41cbb898c269
SHA256802ef71440f662f456bed6283a5ff78066af016897fe6bfd29cac6edc2967bbd
SHA51260d36959895cebf29c4e7713e6d414980139c7aa4ed1c8c96fefb672c1263af0ce909fb409534355895649c0e8056635112efb0da2ba05694446aec2ca77e2e3
-
Filesize
610B
MD598f29b9efd00295b9fa65a3a1f8ac9e6
SHA1da29b498694115ea9e9e5cd93054c724afa23f8e
SHA25679c75f4fea73440ee56f78e5772571745ad383ff4fe5e97d4664024d67d95325
SHA512e2e8c037b5aa434300c417111bb9e2ae003a28d32cc38c2ce7b3f6755bf6a0734b63f1156daa43b15051121b819b37746ce54f23ef65f2de4222b4c2a78d9e34
-
Filesize
78KB
MD5a2a6e2fe649d7df57bc7c53c43b70d8d
SHA18909dccd63e93d13be0d7d2d13fc18213cd2fce0
SHA256a64aa3eeeb7916ad2bcaa43b58394636ca74f29403fd667a2d370d2710858fe2
SHA512afa67804416104160c3c5f9ebe45d4adbf25f6cb85a65ac20c08918e6e67939105173a25a83f7191c4dcfc7a9d26db1edc6cacd42e1c6c70ec1a35b62e07ba69