Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
3Back Alley...er.dll
windows7-x64
1Back Alley...er.dll
windows10-2004-x64
1Back Alley...ji.exe
windows7-x64
1Back Alley...ji.exe
windows10-2004-x64
1Back Alley...rp.dll
windows7-x64
1Back Alley...rp.dll
windows10-2004-x64
1Back Alley...ty.dll
windows7-x64
1Back Alley...ty.dll
windows10-2004-x64
1Back Alley...re.dll
windows7-x64
1Back Alley...re.dll
windows10-2004-x64
1Back Alley...ml.dll
windows7-x64
1Back Alley...ml.dll
windows10-2004-x64
1Back Alley...em.dll
windows7-x64
1Back Alley...em.dll
windows10-2004-x64
1Back Alley...le.dll
windows7-x64
1Back Alley...le.dll
windows10-2004-x64
1Back Alley...le.dll
windows7-x64
1Back Alley...le.dll
windows10-2004-x64
1Back Alley...le.dll
windows7-x64
1Back Alley...le.dll
windows10-2004-x64
1Back Alley...le.dll
windows7-x64
1Back Alley...le.dll
windows10-2004-x64
1Back Alley...le.dll
windows7-x64
1Back Alley...le.dll
windows10-2004-x64
1Back Alley...le.dll
windows7-x64
1Back Alley...le.dll
windows10-2004-x64
1Back Alley...le.dll
windows7-x64
1Back Alley...le.dll
windows10-2004-x64
1Back Alley...le.dll
windows7-x64
1Back Alley...le.dll
windows10-2004-x64
1Back Alley...ng.dll
windows7-x64
1Back Alley...ng.dll
windows10-2004-x64
1Analysis
-
max time kernel
147s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
28/01/2024, 00:30
Static task
static1
Behavioral task
behavioral1
Sample
Back Alley Tales v1.1.3 Windows/PC/UnityPlayer.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Back Alley Tales v1.1.3 Windows/PC/UnityPlayer.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
Back Alley Tales v1.1.3 Windows/PC/Uraroji.exe
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
Back Alley Tales v1.1.3 Windows/PC/Uraroji.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral5
Sample
Back Alley Tales v1.1.3 Windows/PC/Uraroji_Data/Managed/Assembly-CSharp.dll
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
Back Alley Tales v1.1.3 Windows/PC/Uraroji_Data/Managed/Assembly-CSharp.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
Back Alley Tales v1.1.3 Windows/PC/Uraroji_Data/Managed/Mono.Security.dll
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
Back Alley Tales v1.1.3 Windows/PC/Uraroji_Data/Managed/Mono.Security.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral9
Sample
Back Alley Tales v1.1.3 Windows/PC/Uraroji_Data/Managed/System.Core.dll
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
Back Alley Tales v1.1.3 Windows/PC/Uraroji_Data/Managed/System.Core.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
Back Alley Tales v1.1.3 Windows/PC/Uraroji_Data/Managed/System.Xml.dll
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
Back Alley Tales v1.1.3 Windows/PC/Uraroji_Data/Managed/System.Xml.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
Back Alley Tales v1.1.3 Windows/PC/Uraroji_Data/Managed/System.dll
Resource
win7-20231129-en
Behavioral task
behavioral14
Sample
Back Alley Tales v1.1.3 Windows/PC/Uraroji_Data/Managed/System.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
Back Alley Tales v1.1.3 Windows/PC/Uraroji_Data/Managed/UnityEngine.AIModule.dll
Resource
win7-20231215-en
Behavioral task
behavioral16
Sample
Back Alley Tales v1.1.3 Windows/PC/Uraroji_Data/Managed/UnityEngine.AIModule.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral17
Sample
Back Alley Tales v1.1.3 Windows/PC/Uraroji_Data/Managed/UnityEngine.ARModule.dll
Resource
win7-20231129-en
Behavioral task
behavioral18
Sample
Back Alley Tales v1.1.3 Windows/PC/Uraroji_Data/Managed/UnityEngine.ARModule.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral19
Sample
Back Alley Tales v1.1.3 Windows/PC/Uraroji_Data/Managed/UnityEngine.AccessibilityModule.dll
Resource
win7-20231215-en
Behavioral task
behavioral20
Sample
Back Alley Tales v1.1.3 Windows/PC/Uraroji_Data/Managed/UnityEngine.AccessibilityModule.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral21
Sample
Back Alley Tales v1.1.3 Windows/PC/Uraroji_Data/Managed/UnityEngine.AnimationModule.dll
Resource
win7-20231129-en
Behavioral task
behavioral22
Sample
Back Alley Tales v1.1.3 Windows/PC/Uraroji_Data/Managed/UnityEngine.AnimationModule.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral23
Sample
Back Alley Tales v1.1.3 Windows/PC/Uraroji_Data/Managed/UnityEngine.AssetBundleModule.dll
Resource
win7-20231215-en
Behavioral task
behavioral24
Sample
Back Alley Tales v1.1.3 Windows/PC/Uraroji_Data/Managed/UnityEngine.AssetBundleModule.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral25
Sample
Back Alley Tales v1.1.3 Windows/PC/Uraroji_Data/Managed/UnityEngine.AudioModule.dll
Resource
win7-20231215-en
Behavioral task
behavioral26
Sample
Back Alley Tales v1.1.3 Windows/PC/Uraroji_Data/Managed/UnityEngine.AudioModule.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral27
Sample
Back Alley Tales v1.1.3 Windows/PC/Uraroji_Data/Managed/UnityEngine.ClothModule.dll
Resource
win7-20231215-en
Behavioral task
behavioral28
Sample
Back Alley Tales v1.1.3 Windows/PC/Uraroji_Data/Managed/UnityEngine.ClothModule.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral29
Sample
Back Alley Tales v1.1.3 Windows/PC/Uraroji_Data/Managed/UnityEngine.ClusterInputModule.dll
Resource
win7-20231215-en
Behavioral task
behavioral30
Sample
Back Alley Tales v1.1.3 Windows/PC/Uraroji_Data/Managed/UnityEngine.ClusterInputModule.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral31
Sample
Back Alley Tales v1.1.3 Windows/PC/Uraroji_Data/Managed/UnityEngine.Networking.dll
Resource
win7-20231215-en
Behavioral task
behavioral32
Sample
Back Alley Tales v1.1.3 Windows/PC/Uraroji_Data/Managed/UnityEngine.Networking.dll
Resource
win10v2004-20231215-en
General
-
Target
Back Alley Tales v1.1.3 Windows/PC/Uraroji.exe
-
Size
624KB
-
MD5
4e80744bf91f8361f0e72475afc8e359
-
SHA1
b61f9365d2e7b54f7edf97b1851aa99b7c93c1fb
-
SHA256
6c2cd57eeca22661804f4ff91463ca74dac93932bb4b4f1899d5330a7ea37265
-
SHA512
44a2ef01ba6b2c7bba58f1f7162d92f928403fcdaf73b5eb9de2f32fc78260e91ad2ba7b865d8c675c4d82411160eadeabff4f1dcb77c8504108375cd51e1dab
-
SSDEEP
6144:sjY/Uma5lhYWZf9nXF/IsWudOnAroO9IFE/sqS5Q2+U+1cAXQrzxfa78U76hDqRm:t/UkWZB3OAry5Q3cAXQrliF5RYgQR
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Uraroji.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Uraroji.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Uraroji.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Uraroji.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4452 Uraroji.exe 4452 Uraroji.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 2432 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2432 AUDIODG.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4452 Uraroji.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Back Alley Tales v1.1.3 Windows\PC\Uraroji.exe"C:\Users\Admin\AppData\Local\Temp\Back Alley Tales v1.1.3 Windows\PC\Uraroji.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4452
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x50c 0x3001⤵
- Suspicious use of AdjustPrivilegeToken
PID:2432