Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3Launcher S....0.exe
windows7-x64
7Launcher S....0.exe
windows10-2004-x64
7$PLUGINSDIR/app-64.7z
windows7-x64
3$PLUGINSDIR/app-64.7z
windows10-2004-x64
7Launcher.exe
windows7-x64
7Launcher.exe
windows10-2004-x64
7$R0/Uninst...er.exe
windows7-x64
7$R0/Uninst...er.exe
windows10-2004-x64
7Analysis
-
max time kernel
148s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
17/02/2024, 20:20
Static task
static1
Behavioral task
behavioral1
Sample
Launcher Setup 9.4.0.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Launcher Setup 9.4.0.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/app-64.7z
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/app-64.7z
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
Launcher.exe
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
Launcher.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral7
Sample
$R0/Uninstall Launcher.exe
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
$R0/Uninstall Launcher.exe
Resource
win10v2004-20231215-en
General
-
Target
$PLUGINSDIR/app-64.7z
-
Size
80.0MB
-
MD5
3ee37c0a040d01b12c017d5910d9d2a0
-
SHA1
4722278c4de0742dcbaf92bbc73a1b0ecb44ab4a
-
SHA256
0b749b5d1a9c699ddb5fec5ffd600ba7ca15f410e54bc6bc5f2f834f69a46cb4
-
SHA512
6ad9ce42b0f0f0d2740b7899aaf776214f0ead4f649957e457150db38442f9a03d44ad74d7e60c59c4d38de57442cde360d3ce15bb05fee5d9fad87ab59f4ab5
-
SSDEEP
1572864:ab+n6npC5ZhWkKV0mxFee1STuEWSzPGZq5xGGmG6qcK2V78QrOptItrjYpT:aSn6npCokE0O1STuEWSCZqfGGdTtQrOR
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2284 7zFM.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 2284 7zFM.exe Token: 35 2284 7zFM.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2284 7zFM.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 840 wrote to memory of 2284 840 cmd.exe 29 PID 840 wrote to memory of 2284 840 cmd.exe 29 PID 840 wrote to memory of 2284 840 cmd.exe 29
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app-64.7z1⤵
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app-64.7z"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2284
-