Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

6

Static

static

3

Funshion/@...��.exe

windows7-x64

3

Funshion/@...��.exe

windows10-2004-x64

3

$PLUGINSDI...nt.dll

windows7-x64

3

$PLUGINSDI...nt.dll

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...er.dll

windows7-x64

3

$PLUGINSDI...er.dll

windows10-2004-x64

3

Funshion/CoreAAC.dll

windows7-x64

1

Funshion/CoreAAC.dll

windows10-2004-x64

1

Funshion/C...rt.exe

windows7-x64

1

Funshion/C...rt.exe

windows10-2004-x64

1

Funshion/FAQ.url

windows7-x64

6

Funshion/FAQ.url

windows10-2004-x64

3

Funshion/Funshion.exe

windows7-x64

4

Funshion/Funshion.exe

windows10-2004-x64

5

Funshion/G...ss.dll

windows7-x64

3

Funshion/G...ss.dll

windows10-2004-x64

3

Funshion/L...an.dll

windows7-x64

1

Funshion/L...an.dll

windows10-2004-x64

1

Funshion/R...ng.dll

windows7-x64

3

Funshion/R...ng.dll

windows10-2004-x64

3

Funshion/S...me.url

windows7-x64

6

Funshion/S...me.url

windows10-2004-x64

3

Funshion/S...wn.url

windows7-x64

6

Funshion/S...wn.url

windows10-2004-x64

3

Funshion/U...ry.url

windows7-x64

6

Funshion/U...ry.url

windows10-2004-x64

3

Analysis

  • max time kernel
    144s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/01/2024, 17:11 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    $PLUGINSDIR/InstallOptions.dll

  • Size

    14KB

  • MD5

    107737e3282fefd85684f2fa3df6d1c3

  • SHA1

    3befbcae116a644ae28cebdc1d7dfe6be5c8ca5f

  • SHA256

    21042be362d4073053bffcc90511b3ecf77902243525b56bb159581b5ece43a0

  • SHA512

    439ac2f3066902e08d63dc3061f55063089857e765feb29fe47ba5819a9bebdff3fe2fe55fc8bfcfddb729d340f006ee95b5aa4422d712f9dcc07cc02ec410b4

  • SSDEEP

    192:FTmFxiXTQdQbg9FkGuz9lBDpO5DwbgUojcA96lK72dwF7dBG0N1:FTmriEdYQFkGUlI6vojj6l+BGE

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4764
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
      2⤵
        PID:3200
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3200 -s 636
          3⤵
          • Program crash
          PID:2252
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 3200 -ip 3200
      1⤵
        PID:4960

      Network

      • flag-us
        DNS
        149.220.183.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        149.220.183.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        177.178.17.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        177.178.17.96.in-addr.arpa
        IN PTR
        Response
        177.178.17.96.in-addr.arpa
        IN PTR
        a96-17-178-177deploystaticakamaitechnologiescom
      • flag-us
        DNS
        95.221.229.192.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        95.221.229.192.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        149.177.190.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        149.177.190.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        26.165.165.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        26.165.165.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        198.187.3.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        198.187.3.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        217.135.221.88.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        217.135.221.88.in-addr.arpa
        IN PTR
        Response
        217.135.221.88.in-addr.arpa
        IN PTR
        a88-221-135-217deploystaticakamaitechnologiescom
      • flag-us
        DNS
        202.178.17.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        202.178.17.96.in-addr.arpa
        IN PTR
        Response
        202.178.17.96.in-addr.arpa
        IN PTR
        a96-17-178-202deploystaticakamaitechnologiescom
      • flag-us
        DNS
        43.229.111.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        43.229.111.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        194.178.17.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        194.178.17.96.in-addr.arpa
        IN PTR
        Response
        194.178.17.96.in-addr.arpa
        IN PTR
        a96-17-178-194deploystaticakamaitechnologiescom
      • flag-us
        DNS
        131.72.42.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        131.72.42.20.in-addr.arpa
        IN PTR
        Response
      • 138.91.171.81:80
        52 B
         1
      • 8.8.8.8:53
        149.220.183.52.in-addr.arpa
        dns
        73 B
         147 B
         1
        1

        DNS Request

        149.220.183.52.in-addr.arpa

      • 8.8.8.8:53
        177.178.17.96.in-addr.arpa
        dns
        72 B
         137 B
         1
        1

        DNS Request

        177.178.17.96.in-addr.arpa

      • 8.8.8.8:53
        95.221.229.192.in-addr.arpa
        dns
        73 B
         144 B
         1
        1

        DNS Request

        95.221.229.192.in-addr.arpa

      • 8.8.8.8:53
        149.177.190.20.in-addr.arpa
        dns
        73 B
         159 B
         1
        1

        DNS Request

        149.177.190.20.in-addr.arpa

      • 8.8.8.8:53
        26.165.165.52.in-addr.arpa
        dns
        72 B
         146 B
         1
        1

        DNS Request

        26.165.165.52.in-addr.arpa

      • 8.8.8.8:53
        198.187.3.20.in-addr.arpa
        dns
        71 B
         157 B
         1
        1

        DNS Request

        198.187.3.20.in-addr.arpa

      • 8.8.8.8:53
        217.135.221.88.in-addr.arpa
        dns
        73 B
         139 B
         1
        1

        DNS Request

        217.135.221.88.in-addr.arpa

      • 8.8.8.8:53
        202.178.17.96.in-addr.arpa
        dns
        72 B
         137 B
         1
        1

        DNS Request

        202.178.17.96.in-addr.arpa

      • 8.8.8.8:53
        43.229.111.52.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        43.229.111.52.in-addr.arpa

      • 8.8.8.8:53
        194.178.17.96.in-addr.arpa
        dns
        72 B
         137 B
         1
        1

        DNS Request

        194.178.17.96.in-addr.arpa

      • 8.8.8.8:53
        131.72.42.20.in-addr.arpa
        dns
        71 B
         157 B
         1
        1

        DNS Request

        131.72.42.20.in-addr.arpa

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.