Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

VirusShare...9c.exe

windows7-x64

7

VirusShare...9c.exe

windows10-2004-x64

7

$PLUGINSDI...is.dll

windows7-x64

3

$PLUGINSDI...is.dll

windows10-2004-x64

3

ffRichMedi...ion.js

windows7-x64

1

ffRichMedi...ion.js

windows10-2004-x64

1

ff/chrome/...e93.js

windows7-x64

1

ff/chrome/...e93.js

windows10-2004-x64

1

ff/chrome/...ion.js

windows7-x64

1

ff/chrome/...ion.js

windows10-2004-x64

1

ie/RichMed...93.dll

windows7-x64

6

ie/RichMed...93.dll

windows10-2004-x64

6

uninstall.exe

windows7-x64

7

uninstall.exe

windows10-2004-x64

7

$PLUGINSDI...is.dll

windows7-x64

3

$PLUGINSDI...is.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    VirusShare_35ce2d24d96aa1a1e460e19cb2f9f69c

  • Size

    657KB

  • Sample

    240204-zma5sacdgq

  • MD5

    35ce2d24d96aa1a1e460e19cb2f9f69c

  • SHA1

    6eaef78c270a4eb722aedb7dcc8f24d219bedf28

  • SHA256

    ba181e920e9f89d1c9f5718007d6f981ff1572c49b51fb48420a7b8ac848060d

  • SHA512

    70f923b90e734e016e1549524738c314fa01bda527e5ba23b24e2a08432d7e77d05563032b18e63e20d46040e4a85fdc847a7eadd62295da4a4b51c2d981d383

  • SSDEEP

    12288:WqoKCxmG4GQTq4OaQQTYJ8eP4/L5uO7D3f5Bsq48a/QTKJ8eP9/75uO7eU266Bk:WqoAG4GQm4OaHYJ8eP4D5uOHBBB48aeO

Score
7/10
adwarediscoveryspywarestealer

Malware Config

Targets

    • Target

      VirusShare_35ce2d24d96aa1a1e460e19cb2f9f69c

    • Size

      657KB

    • MD5

      35ce2d24d96aa1a1e460e19cb2f9f69c

    • SHA1

      6eaef78c270a4eb722aedb7dcc8f24d219bedf28

    • SHA256

      ba181e920e9f89d1c9f5718007d6f981ff1572c49b51fb48420a7b8ac848060d

    • SHA512

      70f923b90e734e016e1549524738c314fa01bda527e5ba23b24e2a08432d7e77d05563032b18e63e20d46040e4a85fdc847a7eadd62295da4a4b51c2d981d383

    • SSDEEP

      12288:WqoKCxmG4GQTq4OaQQTYJ8eP4/L5uO7D3f5Bsq48a/QTKJ8eP9/75uO7eU266Bk:WqoAG4GQm4OaHYJ8eP4D5uOHBBB48aeO

    Score
    7/10
    adwarediscoveryspywarestealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Drops file in System32 directory

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/aminsis.dll

    • Size

      567KB

    • MD5

      450753ad96785a240a39deccab3af0d0

    • SHA1

      21c544064d2ffa6444508268ce258a330d459fc5

    • SHA256

      1c371dcc6c3428ea98fb0d2dcb612b4ebc731f3ed72e683c8e33058cd2a952d3

    • SHA512

      c41b834f4228b7668316095569c836b4e0d55c5fbf310c65b0e0453ef0e74a3ce8f9357cea90b80f6590f85dd7708eeb4eec27518811ea4aab20c0e7f5643dab

    • SSDEEP

      12288:i/x6GnSkidh7NfMc4G1ppgH81vrKiuu+PUHOGcl5Sbl9B9GUdL:9GnSkWh4G1ppgH81vrBu3MHOGUKfGU

    Score
    3/10
    behavioral3behavioral4

    • Target

      ffRichMediaViewV1release93chaction.js

    • Size

      854B

    • MD5

      c99b88763f7de8f5e8e0a321c37fe5a4

    • SHA1

      248a554fc82c64bff49b39aec23d315f31a7e99f

    • SHA256

      13bb2f581c9ea66a71511f5b41b086c9e7234c2a52e879984075c346c969a71d

    • SHA512

      e19ac462ae793e303eaabca3674697990c2dfa337a9c7ab3c5f123b8b99e816806a1c728581f85e7a1836cfb89f1cb5011c25083fe531e46734ed9ceb527507d

    Score
    1/10
    behavioral5behavioral6

    • Target

      ff/chrome/content/ffRichMediaViewV1release93.js

    • Size

      759B

    • MD5

      0be362b7734b3f5cafa10e52c21fb1cc

    • SHA1

      eb7d52a3c5851bd7d062d5651782ebb7513ef2da

    • SHA256

      12da3cfa698b4d36cc4de01cbc0049dbfd49b498f8d32630e2aebab2f8043c78

    • SHA512

      daf4a47670b4a16c275db4ba8522d65307f5ff489bc1507a7fe59eea51873223f7141fe3129f422db901d8df3bf2233da0d4d742d68b4c1677d33f8170529fb2

    Score
    1/10
    behavioral7behavioral8

    • Target

      ff/chrome/content/ffRichMediaViewV1release93ffaction.js

    • Size

      694B

    • MD5

      408fa294a5ec790c91af023827da7dcc

    • SHA1

      637e516677206c95a3784ca736ad05f08edd670b

    • SHA256

      d2108b05f361289f1622529733055dc5b2658400080f8e88fe80ff7b7c6ff1e2

    • SHA512

      c5a7bef1bb591900ab8973712b028b59e31cb2f165307f2496138e149a984d855d3def92caa74b3e055183b9f3e1f92320573a30b536da554844d1e2c0685530

    Score
    1/10
    behavioral10behavioral9

    • Target

      ie/RichMediaViewV1release93.dll

    • Size

      85KB

    • MD5

      dbf723dbfe76e71fa975e999b3f1bef9

    • SHA1

      be09bb595c52a2e1dc43583a72826a99c7e84684

    • SHA256

      9b83ab1f0841cfdb84981f0cb279acef984a877b8b1661129aac33abbe824901

    • SHA512

      d7b0cfd3cc2bc0d1827f5ec684bbddfde2f13e601cbedc8967b8a59062f1c6b7601bf4c422e7845a1f8f67b2e9cd5da828133c2ed9b7c55c851017a517a22ecf

    • SSDEEP

      1536:Nc/9Cs8ekkcEDtqJ6Zk8DkQpxnLlQLDwUpY:G9eekkcEJqJ6ZFpxLaLDwn

    Score
    6/10
    adwarestealer

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware
    behavioral11behavioral12

    • Target

      uninstall.exe

    • Size

      289KB

    • MD5

      abf980841453e2a16b66e6f965f92c7c

    • SHA1

      76407eee202f16e6d27b96756c38b6250ae06970

    • SHA256

      26909d4b6138f335bf3af0ca0d1bea51b42a4b2a167931325a3d34eb9091d4e8

    • SHA512

      ee432011ea12c19bc46091f75b51a32ce51edfaea9438d68638a097ad22e5dd7264144b82414712fb4a7416a8e07c97e599972ad7e154a4a311bf5a7d0ed460f

    • SSDEEP

      6144:Ue34lBI+Rg4l8ai5PQtTZ763J8eWW43YLYjn5uO7D32fuCa7Bmy:Ilq4OaQQTYJ8eP4/L5uO7D3f5Bn

    Score
    7/10
    spywarestealer

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral13behavioral14

    • Target

      $PLUGINSDIR/aminsis.dll

    • Size

      567KB

    • MD5

      450753ad96785a240a39deccab3af0d0

    • SHA1

      21c544064d2ffa6444508268ce258a330d459fc5

    • SHA256

      1c371dcc6c3428ea98fb0d2dcb612b4ebc731f3ed72e683c8e33058cd2a952d3

    • SHA512

      c41b834f4228b7668316095569c836b4e0d55c5fbf310c65b0e0453ef0e74a3ce8f9357cea90b80f6590f85dd7708eeb4eec27518811ea4aab20c0e7f5643dab

    • SSDEEP

      12288:i/x6GnSkidh7NfMc4G1ppgH81vrKiuu+PUHOGcl5Sbl9B9GUdL:9GnSkWh4G1ppgH81vrBu3MHOGUKfGU

    Score
    3/10
    behavioral15behavioral16

MITRE ATT&CK Enterprise v15

Tasks