Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

afkconsoleclient.exe

windows7-x64

7

afkconsoleclient.exe

windows10-2004-x64

7

$PLUGINSDI...ls.dll

windows7-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDIR/UAC.dll

windows7-x64

3

$PLUGINSDIR/UAC.dll

windows10-2004-x64

3

$PLUGINSDI...ll.dll

windows7-x64

3

$PLUGINSDI...ll.dll

windows10-2004-x64

3

$PLUGINSDIR/app-64.7z

windows7-x64

3

$PLUGINSDIR/app-64.7z

windows10-2004-x64

7

LICENSE.electron.txt

windows7-x64

1

LICENSE.electron.txt

windows10-2004-x64

1

chrome_100...nt.pak

windows7-x64

3

chrome_100...nt.pak

windows10-2004-x64

3

chrome_200...nt.pak

windows7-x64

3

chrome_200...nt.pak

windows10-2004-x64

3

icudtl.dat

windows7-x64

3

icudtl.dat

windows10-2004-x64

3

locales/af.pak

windows7-x64

3

locales/af.pak

windows10-2004-x64

3

locales/am.pak

windows7-x64

3

locales/am.pak

windows10-2004-x64

3

locales/ar.pak

windows7-x64

3

locales/ar.pak

windows10-2004-x64

3

locales/bg.pak

windows7-x64

3

locales/bg.pak

windows10-2004-x64

3

locales/bn.pak

windows7-x64

3

locales/bn.pak

windows10-2004-x64

3

resources/elevate.exe

windows7-x64

1

resources/elevate.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    afkconsoleclient.exe

  • Size

    88.1MB

  • Sample

    240219-ythyjacg43

  • MD5

    2bd08d8d42f3c2789b91bc4b82d87ff9

  • SHA1

    6c49972d4e16aa7c663fda5b7750e5dfdc2ae977

  • SHA256

    80a2f9e557e81028d751037e5d27bb90cd7b822bc0e6a6e4201287074d8fec08

  • SHA512

    3666a81ca5a66e809d01d15a210585fdc18c73074faa8064d2ce677012f069bdc7d0335e7ae757c7a33c74b52f1597c42407f201173da03c594f697dfa2173f1

  • SSDEEP

    1572864:BUukF5V0Acb7RzHb9ppW1eo9qXT8GvwtGeTP34o41T8YmgFwU:Bw90AkBHRMB9qQGotNTPXi/F3

Score
7/10
discovery

Malware Config

Targets

    • Target

      afkconsoleclient.exe

    • Size

      88.1MB

    • MD5

      2bd08d8d42f3c2789b91bc4b82d87ff9

    • SHA1

      6c49972d4e16aa7c663fda5b7750e5dfdc2ae977

    • SHA256

      80a2f9e557e81028d751037e5d27bb90cd7b822bc0e6a6e4201287074d8fec08

    • SHA512

      3666a81ca5a66e809d01d15a210585fdc18c73074faa8064d2ce677012f069bdc7d0335e7ae757c7a33c74b52f1597c42407f201173da03c594f697dfa2173f1

    • SSDEEP

      1572864:BUukF5V0Acb7RzHb9ppW1eo9qXT8GvwtGeTP34o41T8YmgFwU:Bw90AkBHRMB9qQGotNTPXi/F3

    Score
    7/10
    discovery

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

    • Target

      $PLUGINSDIR/StdUtils.dll

    • Size

      100KB

    • MD5

      c6a6e03f77c313b267498515488c5740

    • SHA1

      3d49fc2784b9450962ed6b82b46e9c3c957d7c15

    • SHA256

      b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

    • SHA512

      9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

    • SSDEEP

      3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v

    Score
    3/10
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      0d7ad4f45dc6f5aa87f606d0331c6901

    • SHA1

      48df0911f0484cbe2a8cdd5362140b63c41ee457

    • SHA256

      3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

    • SHA512

      c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

    • SSDEEP

      192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6

    Score
    3/10
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/UAC.dll

    • Size

      14KB

    • MD5

      adb29e6b186daa765dc750128649b63d

    • SHA1

      160cbdc4cb0ac2c142d361df138c537aa7e708c9

    • SHA256

      2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

    • SHA512

      b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

    • SSDEEP

      192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs

    Score
    3/10
    behavioral7behavioral8

    • Target

      $PLUGINSDIR/WinShell.dll

    • Size

      3KB

    • MD5

      1cc7c37b7e0c8cd8bf04b6cc283e1e56

    • SHA1

      0b9519763be6625bd5abce175dcc59c96d100d4c

    • SHA256

      9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

    • SHA512

      7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

    Score
    3/10
    behavioral10behavioral9

    • Target

      $PLUGINSDIR/app-64.7z

    • Size

      87.2MB

    • MD5

      4a37499f673e65a1abf983f32538bf37

    • SHA1

      2aba5488d09519371fc2274b75071b1c05d05d07

    • SHA256

      26787d348a2a3d404de3a05b33831386e67324b8ffa1ba9a3024641621a37771

    • SHA512

      ac78894ad76b25d685dc2bef312f74c0e656eaec89f3019eede858722b6facbe555ad8a8b9a954671d8ccf9fb77e205f7bc52646fe9328c64f5092d0abfcf133

    • SSDEEP

      1572864:gukF5V0Acb7RzHb9ppW1eo9qXT8GvwtGeTP34o41T8YmgFwQ:U90AkBHRMB9qQGotNTPXi/F/

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral11behavioral12

    • Target

      LICENSE.electron.txt

    • Size

      1KB

    • MD5

      4d42118d35941e0f664dddbd83f633c5

    • SHA1

      2b21ec5f20fe961d15f2b58efb1368e66d202e5c

    • SHA256

      5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d

    • SHA512

      3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

    Score
    1/10
    behavioral13behavioral14

    • Target

      chrome_100_percent.pak

    • Size

      126KB

    • MD5

      8626e1d68e87f86c5b4dabdf66591913

    • SHA1

      4cd7b0ac0d3f72587708064a7b0a3beca3f7b81c

    • SHA256

      2caa1da9b6a6e87bdb673977fee5dd771591a1b6ed5d3c5f14b024130a5d1a59

    • SHA512

      03bcd8562482009060f249d6a0dd7382fc94d669a2094dec08e8d119be51bef2c3b7b484bb5b7f805ae98e372dab9383a2c11a63ab0f5644146556b1bb9a4c99

    • SSDEEP

      3072:AEKzwqCT4weSxQCS/qGTL2o418Gb0+VRLf0ld0GY3cQ39Vm2I:AEKzwt4hC4/rK18Gb0OV8ld0GecQ3f2

    Score
    3/10
    behavioral15behavioral16

    • Target

      chrome_200_percent.pak

    • Size

      175KB

    • MD5

      48515d600258d60019c6b9c6421f79f6

    • SHA1

      0ef0b44641d38327a360aa6954b3b6e5aab2af16

    • SHA256

      07bee34e189fe9a8789aed78ea59ad41414b6e611e7d74da62f8e6ca36af01ce

    • SHA512

      b7266bc8abc55bd389f594dac0c0641ecf07703f35d769b87e731b5fdf4353316d44f3782a4329b3f0e260dead6b114426ddb1b0fb8cd4a51e0b90635f1191d9

    • SSDEEP

      3072:rDQYaEQN6AJPrSxQCS/qGTafR54x5GMR+F44ffbdZnYw9p4AbIVGYoDd+HxNK/r4:rDQYaNN68rC4/Ygx5GMRejnbdZnVE6YR

    Score
    3/10
    behavioral17behavioral18

    • Target

      icudtl.dat

    • Size

      10.1MB

    • MD5

      2c367970ac87a9275eeec5629bb6fc3d

    • SHA1

      399324d1aeee5e74747a6873501a1ee5aac005ee

    • SHA256

      17d57b17d12dc5cfbf06413d68a06f45ccf245f4abdf5429f30256977c4ed6de

    • SHA512

      f788a0d35f9e4bebe641ee67fff14968b62891f52d05bf638cd2c845df87f2e107c42a32bbe62f389f05e5673fe55cbdb85258571e698325400705cd7b16db01

    • SSDEEP

      98304:TfPBQYOo+ddlymYf2LfPQCvliXUxiG9Ha93Whla6ZENSs285:TfPBhORjYAHliXUxiG9Ha93Whla6ZEV7

    Score
    3/10
    behavioral19behavioral20

    • Target

      locales/af.pak

    • Size

      353KB

    • MD5

      464e5eeaba5eff8bc93995ba2cb2d73f

    • SHA1

      3b216e0c5246c874ad0ad7d3e1636384dad2255d

    • SHA256

      0ad547bb1dc57907adeb02e1be3017cce78f6e60b8b39395fe0e8b62285797a1

    • SHA512

      726d6c41a9dbf1f5f2eff5b503ab68d879b088b801832c13fba7eb853302b16118cacda4748a4144af0f396074449245a42b2fe240429b1afcb7197fa0cb6d41

    • SSDEEP

      6144:j54QCpN9/WiHIR9a5D4+kQMGSB+jC6kAw1TUKKpg3b9xIsVxSt2y5qP3ux5tPwDV:F9CpN9OiHIRX+HMT+jC6kAw1TYpg3b9P

    Score
    3/10
    behavioral21behavioral22

    • Target

      locales/am.pak

    • Size

      569KB

    • MD5

      2c933f084d960f8094e24bee73fa826c

    • SHA1

      91dfddc2cff764275872149d454a8397a1a20ab1

    • SHA256

      fa1e44215bd5acc7342c431a3b1fddb6e8b6b02220b4599167f7d77a29f54450

    • SHA512

      3c9ecfb0407de2aa6585f4865ad54eeb2ec6519c9d346e2d33ed0e30be6cc3ebfed676a08637d42c2ca8fa6cfefb4091feb0c922ff71f09a2b89cdd488789774

    • SSDEEP

      12288:QqhqEuPxT8xZTtWosuF9Q5m9yAAVzfukCQox30jH8+I:Zh8T8xTWoZF9Q5m9yAAVzXCQ0

    Score
    3/10
    behavioral23behavioral24

    • Target

      locales/ar.pak

    • Size

      624KB

    • MD5

      6352905a290802a05dd3a64d22216f6e

    • SHA1

      11adb10f0678079c8f73779bb039e12329bcaac7

    • SHA256

      00861d9fa5763cc5c3152edb4a5c956c6bc4f56311ce2ed9e6b496181624ab5e

    • SHA512

      0b0dbad8201ebd1a7dc2cfb11325c509efbcced3ac3d337915cf2972defe2304ea9f8af91d9362cb51333459900a80b714e7302a6483ad58fd64404f8410b6ea

    • SSDEEP

      12288:Z/yZHOg8tqI45/XvYUtOkjbkqBJ51NbW+eTtvZEMgSENOM:4ZHOgUYRF75S+3

    Score
    3/10
    behavioral25behavioral26

    • Target

      locales/bg.pak

    • Size

      652KB

    • MD5

      38bcabb6a0072b3a5f8b86b693eb545d

    • SHA1

      d36c8549fe0f69d05ffdaffa427d3ddf68dd6d89

    • SHA256

      898621731ac3471a41f8b3a7bf52e7f776e8928652b37154bc7c1299f1fd92e1

    • SHA512

      002adbdc17b6013becc4909daf2febb74ce88733c78e968938b792a52c9c5a62834617f606e4cb3774ae2dad9758d2b8678d7764bb6dcfe468881f1107db13ef

    • SSDEEP

      12288:MMq8w2kMLlYrdAs1aQUx41aVVwslMLOmFOMw35uKN31tfbDMxbV2Jfu64Kjz5fS+:MMqckulYrdAs1aQUmBsmRw35uK7Jgxho

    Score
    3/10
    behavioral27behavioral28

    • Target

      locales/bn.pak

    • Size

      838KB

    • MD5

      9340520696e7cb3c2495a78893e50add

    • SHA1

      eed5aeef46131e4c70cd578177c527b656d08586

    • SHA256

      1ea245646a4b4386606f03c8a3916a3607e2adbbc88f000976be36db410a1e39

    • SHA512

      62507685d5542cfcd394080917b3a92ca197112feea9c2ddc1dfc77382a174c7ddf758d85af66cd322692215cb0402865b2a2b212694a36da6b592028caafcdf

    • SSDEEP

      3072:6gGTLRFbMdhBVHvr5eSnC6PRWhk7Bbd8+D95H0XluZ:YWBlvr5FCYRWuBbdB5wl2

    Score
    3/10
    behavioral29behavioral30

    • Target

      resources/elevate.exe

    • Size

      105KB

    • MD5

      792b92c8ad13c46f27c7ced0810694df

    • SHA1

      d8d449b92de20a57df722df46435ba4553ecc802

    • SHA256

      9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37

    • SHA512

      6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40

    • SSDEEP

      3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l

    Score
    1/10
    behavioral31behavioral32

MITRE ATT&CK Enterprise v15

Tasks