Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

upgrade.exe

windows7-x64

7

upgrade.exe

windows10-2004-x64

7

$0/uninstall.exe

windows7-x64

7

$0/uninstall.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$0/wyeke.dll

windows7-x64

1

$0/wyeke.dll

windows10-2004-x64

3

$0/wyeke.exe

windows7-x64

1

$0/wyeke.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8b7c456cd1b3d2c0a2ccab57f07be88e

  • Size

    646KB

  • Sample

    240203-fwgt5shhd4

  • MD5

    8b7c456cd1b3d2c0a2ccab57f07be88e

  • SHA1

    5601db1cde87a734f1335d83f5dd6f1583ce234d

  • SHA256

    478e5a10a2d3f41fd903448dd9d06c7d901a53933cfa7d90f10d905d01c8fb49

  • SHA512

    cda7a266f85988e951c193164b761976695fa2ad8a4d634d7368a57f13464c7ec5911c8a96a089eb16e22d4957becc6a7df42412d9cc60da8cda294a6f5ee6f8

  • SSDEEP

    12288:g2mhYGgGg+NQdFGzWUoBFJPtxpnNibhqMdy8pxxKtj5SHiJ1n3JY3A:DtGFGdwz2L3nNibh7y8pxxyj5t1ZD

Score
7/10
discovery

Malware Config

Targets

    • Target

      upgrade.exe

    • Size

      655KB

    • MD5

      6200fd0bf01918f26533c82758163b5a

    • SHA1

      6b7397caf49036062dc8b7210c27e5a3e3fc36fc

    • SHA256

      66f26009c24d3b893aed432ad50b80427869b78f17e1a1bb34cfcb0c5c9ee43d

    • SHA512

      76be6261325f3e39edf07984179911ec3a86d24bea4db10e67dc8a49fb07d8db9044d9d725bbb81a0290fe865e71615cc662cebd985e6397d684f8cae8bd81e5

    • SSDEEP

      12288:22mfYcDGg+uQdFGzJUoBIJPtx2nNtJhqmFi8plxgtj5SSiJtL3JL0T:ZiGFTdozH2AnNtJhXi8plx4j5itVoT

    Score
    7/10
    discovery

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

    • Target

      $0/uninstall.exe

    • Size

      87KB

    • MD5

      ff795d8c92ba9e210087811450f07b86

    • SHA1

      6c2959c83a4c460b77a285473cb02de79d01d1b0

    • SHA256

      7911cc2005f04f64f514f0aedaf9bde9aec48e51ecb9e0b21981e39a3885cd68

    • SHA512

      951620bede769f77b40f1d315841604212632a2f5095df5cf9134811f43328e95f4c36962fecc2fdc7639ed1570238a9578c6cc1d2e7b17b820ba3c7909cf401

    • SSDEEP

      1536:HEkjY1zy214Qay0DGkJbvPJDtimfOx+cp17GP/W8eptep2/D90w:kkjAJ4dDGkJzniUkOPebp0o/Z

    Score
    7/10

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral3behavioral4

    • Target

      $PLUGINSDIR/InstallOptions.dll

    • Size

      13KB

    • MD5

      d765c492c21689e3d9d61634371fd861

    • SHA1

      ac200933671ae52c9d5544d0e2e8e9144d286c83

    • SHA256

      551e6042dd494ea01549555ffc194ab9729da09058ec714eb368dd06642c9bbc

    • SHA512

      9919a9e848c8f1e26c75d0d29207571e4b86a4140bd554743d2c1f8bd7f386fe4919345b163d89a5d907fb165e435ba0ac5f6b1101713636141f156a420e2e0f

    • SSDEEP

      192:9B6RvrfvOuJQDghBy/X7QKq3TLGciZJf0EzWzMnz6WoF1dBs:v6RrviWaX7eiZJ7nz6bB

    Score
    3/10
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/System.dll

    • Size

      10KB

    • MD5

      fe24766ba314f620d57d0cf7339103c0

    • SHA1

      8641545f03f03ff07485d6ec4d7b41cbb898c269

    • SHA256

      802ef71440f662f456bed6283a5ff78066af016897fe6bfd29cac6edc2967bbd

    • SHA512

      60d36959895cebf29c4e7713e6d414980139c7aa4ed1c8c96fefb672c1263af0ce909fb409534355895649c0e8056635112efb0da2ba05694446aec2ca77e2e3

    • SSDEEP

      192:rO6dJA/ruAFEiUdWWE6hE5RYUdJfbub1aMBgMO:yKAFERdlxhGRYUzqZaMB

    Score
    3/10
    behavioral7behavioral8

    • Target

      $0/wyeke.dll

    • Size

      584KB

    • MD5

      8d72049838c972e95f059074964caef3

    • SHA1

      d3c6fe1e7fde339e20fad30dd442381355d9c864

    • SHA256

      8cccccba3915668213fd73ec202a291ad8eb9920e7bc01e876ec7584e6302f8b

    • SHA512

      a2213bb7e0c1f7aa3bf901b191b2408019d6a43213438b159c7548562d160358a12f7c218054fb441a61f01c60e657165702ab0245b741965949e272a558ed82

    • SSDEEP

      12288:nEG5JNaYqvQ96roOMcIga0TqOV4FIV5EJa0ZyowlE5ZsarNp:n7I3vpMoa0Tq10Ds1r1N

    Score
    3/10
    behavioral10behavioral9

    • Target

      $0/wyeke.exe

    • Size

      57KB

    • MD5

      1a6a68ce5fbe650abca2450c245aca9e

    • SHA1

      f1d3aa00d1f60a0fc9e40e1da18a7ee5851bf493

    • SHA256

      bb957c094016983a5c41dd684a22b834024219e99bed8531f245d8753703b1e2

    • SHA512

      8763e3fab06a52c080243ea4b9ca8e0befc83c0f0afb5881d213c54ff1db5de3f3d3a529ed72c7e2da49eb696b28741f0abf9d367da5b346c7dc9368a22f98d6

    • SSDEEP

      768:CaZaPYd34SJGaCOch83abYWlcuizv6uBjD06t+ZpzuwSSmlOD2SLfTM:9sPYrJGd8tWlcvzDjD0G6pzufuD2SXM

    Score
    1/10
    behavioral11behavioral12

MITRE ATT&CK Enterprise v15

Tasks