Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3dog.exe
windows10-2004-x64
7$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3LICENSES.c...m.html
windows10-2004-x64
1d3dcompiler_47.dll
windows10-2004-x64
1dog.exe
windows10-2004-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows10-2004-x64
1resources/elevate.exe
windows10-2004-x64
1swiftshade...GL.dll
windows10-2004-x64
1swiftshade...v2.dll
windows10-2004-x64
1vk_swiftshader.dll
windows10-2004-x64
1vulkan-1.dll
windows10-2004-x64
1$PLUGINSDI...7z.dll
windows10-2004-x64
3Analysis
-
max time kernel
159s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
11/02/2024, 19:53
Static task
static1
Behavioral task
behavioral1
Sample
dog.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
LICENSES.chromium.html
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
d3dcompiler_47.dll
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
dog.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
ffmpeg.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
libEGL.dll
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
libGLESv2.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
resources/elevate.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
swiftshader/libEGL.dll
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
swiftshader/libGLESv2.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
vk_swiftshader.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
vulkan-1.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
General
-
Target
dog.exe
-
Size
139.5MB
-
MD5
f71c554354bf1d6b5bb0f6b1e4adf4af
-
SHA1
7647253311c00309f9cda21b097fdaa1c8c1cc25
-
SHA256
40bd7d0c1ba5c44a0b9405c43119f9e41c8754d2635f66cf6b3cbbf544ec8230
-
SHA512
1b802572b0cb7856fefbd0e2e469d8961b24a0fce03f98120d33876380cf7acf48d5370c8cfa5a2c326ca04d4915133a63810cdca38b3b8f4d9550b6e7f9327f
-
SSDEEP
786432:X14w5ThzHwQBgmoLWv+K18nCzKdo5DTdvfMQr6SSmPuvh8tSIW68:X14kpHwQjCWv+K18CedmVvEQEpcJW
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3388 dog.exe 3388 dog.exe 5040 dog.exe 5040 dog.exe 5040 dog.exe 5040 dog.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1100 dog.exe Token: SeCreatePagefilePrivilege 1100 dog.exe Token: SeShutdownPrivilege 1100 dog.exe Token: SeCreatePagefilePrivilege 1100 dog.exe Token: SeShutdownPrivilege 1100 dog.exe Token: SeCreatePagefilePrivilege 1100 dog.exe Token: SeShutdownPrivilege 1100 dog.exe Token: SeCreatePagefilePrivilege 1100 dog.exe Token: SeShutdownPrivilege 1100 dog.exe Token: SeCreatePagefilePrivilege 1100 dog.exe Token: SeShutdownPrivilege 1100 dog.exe Token: SeCreatePagefilePrivilege 1100 dog.exe Token: SeShutdownPrivilege 1100 dog.exe Token: SeCreatePagefilePrivilege 1100 dog.exe Token: SeShutdownPrivilege 1100 dog.exe Token: SeCreatePagefilePrivilege 1100 dog.exe Token: SeShutdownPrivilege 1100 dog.exe Token: SeCreatePagefilePrivilege 1100 dog.exe Token: SeShutdownPrivilege 1100 dog.exe Token: SeCreatePagefilePrivilege 1100 dog.exe Token: SeShutdownPrivilege 1100 dog.exe Token: SeCreatePagefilePrivilege 1100 dog.exe Token: SeShutdownPrivilege 1100 dog.exe Token: SeCreatePagefilePrivilege 1100 dog.exe Token: SeShutdownPrivilege 1100 dog.exe Token: SeCreatePagefilePrivilege 1100 dog.exe Token: SeShutdownPrivilege 1100 dog.exe Token: SeCreatePagefilePrivilege 1100 dog.exe Token: SeShutdownPrivilege 1100 dog.exe Token: SeCreatePagefilePrivilege 1100 dog.exe Token: SeShutdownPrivilege 1100 dog.exe Token: SeCreatePagefilePrivilege 1100 dog.exe Token: SeShutdownPrivilege 1100 dog.exe Token: SeCreatePagefilePrivilege 1100 dog.exe Token: SeShutdownPrivilege 1100 dog.exe Token: SeCreatePagefilePrivilege 1100 dog.exe Token: SeShutdownPrivilege 1100 dog.exe Token: SeCreatePagefilePrivilege 1100 dog.exe Token: SeShutdownPrivilege 1100 dog.exe Token: SeCreatePagefilePrivilege 1100 dog.exe Token: SeShutdownPrivilege 1100 dog.exe Token: SeCreatePagefilePrivilege 1100 dog.exe Token: SeShutdownPrivilege 1100 dog.exe Token: SeCreatePagefilePrivilege 1100 dog.exe Token: SeShutdownPrivilege 1100 dog.exe Token: SeCreatePagefilePrivilege 1100 dog.exe Token: SeShutdownPrivilege 1100 dog.exe Token: SeCreatePagefilePrivilege 1100 dog.exe Token: SeShutdownPrivilege 1100 dog.exe Token: SeCreatePagefilePrivilege 1100 dog.exe Token: SeShutdownPrivilege 1100 dog.exe Token: SeCreatePagefilePrivilege 1100 dog.exe Token: SeShutdownPrivilege 1100 dog.exe Token: SeCreatePagefilePrivilege 1100 dog.exe Token: SeShutdownPrivilege 1100 dog.exe Token: SeCreatePagefilePrivilege 1100 dog.exe Token: SeShutdownPrivilege 1100 dog.exe Token: SeCreatePagefilePrivilege 1100 dog.exe Token: SeShutdownPrivilege 1100 dog.exe Token: SeCreatePagefilePrivilege 1100 dog.exe Token: SeShutdownPrivilege 1100 dog.exe Token: SeCreatePagefilePrivilege 1100 dog.exe Token: SeShutdownPrivilege 1100 dog.exe Token: SeCreatePagefilePrivilege 1100 dog.exe -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 1100 wrote to memory of 3168 1100 dog.exe 82 PID 1100 wrote to memory of 3168 1100 dog.exe 82 PID 1100 wrote to memory of 3168 1100 dog.exe 82 PID 1100 wrote to memory of 3168 1100 dog.exe 82 PID 1100 wrote to memory of 3168 1100 dog.exe 82 PID 1100 wrote to memory of 3168 1100 dog.exe 82 PID 1100 wrote to memory of 3168 1100 dog.exe 82 PID 1100 wrote to memory of 3168 1100 dog.exe 82 PID 1100 wrote to memory of 3168 1100 dog.exe 82 PID 1100 wrote to memory of 3168 1100 dog.exe 82 PID 1100 wrote to memory of 3168 1100 dog.exe 82 PID 1100 wrote to memory of 3168 1100 dog.exe 82 PID 1100 wrote to memory of 3168 1100 dog.exe 82 PID 1100 wrote to memory of 3168 1100 dog.exe 82 PID 1100 wrote to memory of 3168 1100 dog.exe 82 PID 1100 wrote to memory of 3168 1100 dog.exe 82 PID 1100 wrote to memory of 3168 1100 dog.exe 82 PID 1100 wrote to memory of 3168 1100 dog.exe 82 PID 1100 wrote to memory of 3168 1100 dog.exe 82 PID 1100 wrote to memory of 3168 1100 dog.exe 82 PID 1100 wrote to memory of 3168 1100 dog.exe 82 PID 1100 wrote to memory of 3168 1100 dog.exe 82 PID 1100 wrote to memory of 3168 1100 dog.exe 82 PID 1100 wrote to memory of 3168 1100 dog.exe 82 PID 1100 wrote to memory of 3168 1100 dog.exe 82 PID 1100 wrote to memory of 3168 1100 dog.exe 82 PID 1100 wrote to memory of 3168 1100 dog.exe 82 PID 1100 wrote to memory of 3168 1100 dog.exe 82 PID 1100 wrote to memory of 3168 1100 dog.exe 82 PID 1100 wrote to memory of 3168 1100 dog.exe 82 PID 1100 wrote to memory of 3168 1100 dog.exe 82 PID 1100 wrote to memory of 3168 1100 dog.exe 82 PID 1100 wrote to memory of 3168 1100 dog.exe 82 PID 1100 wrote to memory of 3168 1100 dog.exe 82 PID 1100 wrote to memory of 3168 1100 dog.exe 82 PID 1100 wrote to memory of 3168 1100 dog.exe 82 PID 1100 wrote to memory of 3168 1100 dog.exe 82 PID 1100 wrote to memory of 3168 1100 dog.exe 82 PID 1100 wrote to memory of 3168 1100 dog.exe 82 PID 1100 wrote to memory of 3168 1100 dog.exe 82 PID 1100 wrote to memory of 3388 1100 dog.exe 83 PID 1100 wrote to memory of 3388 1100 dog.exe 83 PID 1100 wrote to memory of 5040 1100 dog.exe 93 PID 1100 wrote to memory of 5040 1100 dog.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\dog.exe"C:\Users\Admin\AppData\Local\Temp\dog.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\dog.exe"C:\Users\Admin\AppData\Local\Temp\dog.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\script" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 --field-trial-handle=1852,2959667035595671458,15558304523833333525,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵PID:3168
-
-
C:\Users\Admin\AppData\Local\Temp\dog.exe"C:\Users\Admin\AppData\Local\Temp\dog.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\script" --mojo-platform-channel-handle=2076 --field-trial-handle=1852,2959667035595671458,15558304523833333525,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3388
-
-
C:\Users\Admin\AppData\Local\Temp\dog.exe"C:\Users\Admin\AppData\Local\Temp\dog.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\script" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAIAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1344 --field-trial-handle=1852,2959667035595671458,15558304523833333525,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5040
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1748