Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
6Static
static
3Bolt AIO C...G].exe
windows7-x64
6Bolt AIO C...G].exe
windows10-2004-x64
6Bolt AIO C...52.dll
windows7-x64
1Bolt AIO C...52.dll
windows10-2004-x64
1Bolt AIO C...ds.dll
windows7-x64
1Bolt AIO C...ds.dll
windows10-2004-x64
1Bolt AIO C...re.dll
windows7-x64
1Bolt AIO C...re.dll
windows10-2004-x64
1Bolt AIO C...st.dll
windows7-x64
1Bolt AIO C...st.dll
windows10-2004-x64
1Bolt AIO C...et.dll
windows7-x64
1Bolt AIO C...et.dll
windows10-2004-x64
1Bolt AIO C...ok.dll
windows7-x64
1Bolt AIO C...ok.dll
windows10-2004-x64
1Bolt AIO C...PC.dll
windows7-x64
1Bolt AIO C...PC.dll
windows10-2004-x64
1Bolt AIO C...PC.dll
windows7-x64
1Bolt AIO C...PC.dll
windows10-2004-x64
1Bolt AIO C...UI.dll
windows7-x64
1Bolt AIO C...UI.dll
windows10-2004-x64
1Bolt AIO C...UI.dll
windows7-x64
1Bolt AIO C...UI.dll
windows10-2004-x64
1Bolt AIO C...et.dll
windows7-x64
1Bolt AIO C...et.dll
windows10-2004-x64
1Bolt AIO C...es.dll
windows7-x64
1Bolt AIO C...es.dll
windows10-2004-x64
1Bolt AIO C...on.dll
windows7-x64
1Bolt AIO C...on.dll
windows10-2004-x64
1Bolt AIO C...UI.dll
windows7-x64
1Bolt AIO C...UI.dll
windows10-2004-x64
1Bolt AIO C...ne.dll
windows7-x64
1Bolt AIO C...ne.dll
windows10-2004-x64
1Analysis
-
max time kernel
139s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23/02/2024, 10:31
Static task
static1
Behavioral task
behavioral1
Sample
Bolt AIO CRACKED BY [TZCRACKING]/Bolt AIO CRACKED BY [TZCRACKING].exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Bolt AIO CRACKED BY [TZCRACKING]/Bolt AIO CRACKED BY [TZCRACKING].exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral3
Sample
Bolt AIO CRACKED BY [TZCRACKING]/Bunifu_UI_v1.52.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Bolt AIO CRACKED BY [TZCRACKING]/Bunifu_UI_v1.52.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral5
Sample
Bolt AIO CRACKED BY [TZCRACKING]/Discord.Net.Commands.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
Bolt AIO CRACKED BY [TZCRACKING]/Discord.Net.Commands.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral7
Sample
Bolt AIO CRACKED BY [TZCRACKING]/Discord.Net.Core.dll
Resource
win7-20240220-en
Behavioral task
behavioral8
Sample
Bolt AIO CRACKED BY [TZCRACKING]/Discord.Net.Core.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral9
Sample
Bolt AIO CRACKED BY [TZCRACKING]/Discord.Net.Rest.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
Bolt AIO CRACKED BY [TZCRACKING]/Discord.Net.Rest.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral11
Sample
Bolt AIO CRACKED BY [TZCRACKING]/Discord.Net.WebSocket.dll
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
Bolt AIO CRACKED BY [TZCRACKING]/Discord.Net.WebSocket.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral13
Sample
Bolt AIO CRACKED BY [TZCRACKING]/Discord.Net.Webhook.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
Bolt AIO CRACKED BY [TZCRACKING]/Discord.Net.Webhook.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral15
Sample
Bolt AIO CRACKED BY [TZCRACKING]/DiscordRPC.dll
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
Bolt AIO CRACKED BY [TZCRACKING]/DiscordRPC.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral17
Sample
Bolt AIO CRACKED BY [TZCRACKING]/DiscordWebRPC.dll
Resource
win7-20240215-en
Behavioral task
behavioral18
Sample
Bolt AIO CRACKED BY [TZCRACKING]/DiscordWebRPC.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral19
Sample
Bolt AIO CRACKED BY [TZCRACKING]/FlatUI.dll
Resource
win7-20240220-en
Behavioral task
behavioral20
Sample
Bolt AIO CRACKED BY [TZCRACKING]/FlatUI.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral21
Sample
Bolt AIO CRACKED BY [TZCRACKING]/Guna.UI.dll
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
Bolt AIO CRACKED BY [TZCRACKING]/Guna.UI.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral23
Sample
Bolt AIO CRACKED BY [TZCRACKING]/Leaf.xNet.dll
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
Bolt AIO CRACKED BY [TZCRACKING]/Leaf.xNet.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral25
Sample
Bolt AIO CRACKED BY [TZCRACKING]/Microsoft.Bcl.AsyncInterfaces.dll
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
Bolt AIO CRACKED BY [TZCRACKING]/Microsoft.Bcl.AsyncInterfaces.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral27
Sample
Bolt AIO CRACKED BY [TZCRACKING]/Newtonsoft.Json.dll
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
Bolt AIO CRACKED BY [TZCRACKING]/Newtonsoft.Json.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral29
Sample
Bolt AIO CRACKED BY [TZCRACKING]/Siticone.UI.dll
Resource
win7-20240215-en
Behavioral task
behavioral30
Sample
Bolt AIO CRACKED BY [TZCRACKING]/Siticone.UI.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral31
Sample
Bolt AIO CRACKED BY [TZCRACKING]/SuperSocket.ClientEngine.dll
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
Bolt AIO CRACKED BY [TZCRACKING]/SuperSocket.ClientEngine.dll
Resource
win10v2004-20240221-en
General
-
Target
Bolt AIO CRACKED BY [TZCRACKING]/Bolt AIO CRACKED BY [TZCRACKING].exe
-
Size
922KB
-
MD5
727188832e9d77e87ebd1aaa12105638
-
SHA1
0a547ad642b712ab92a189acc776d3758ba163bb
-
SHA256
567b8af881787af693a08f8c0849d104ea1427e65c5275e554346a40c44bb219
-
SHA512
5cf2ff673614718723f15d7201c6292fe8be0d24cdd9b2bd210c8155049b2e3045ae4e05be9f09deeafb04d3d4e690696750413576cd675a33d2a85484d36dd8
-
SSDEEP
24576:GF4fE2pLTyWeFtPtFt6WxWFTxkt6WxWFTxZ:eYLT2rlrj
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 3 discord.com 2 discord.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 31 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff Bolt AIO CRACKED BY [TZCRACKING].exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Sort = 000000000000000000000000000000000200000030f125b7ef471a10a5f102608c9eebac0a0000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff Bolt AIO CRACKED BY [TZCRACKING].exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg Bolt AIO CRACKED BY [TZCRACKING].exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg Bolt AIO CRACKED BY [TZCRACKING].exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags Bolt AIO CRACKED BY [TZCRACKING].exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC} Bolt AIO CRACKED BY [TZCRACKING].exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1" Bolt AIO CRACKED BY [TZCRACKING].exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_Classes\Local Settings Bolt AIO CRACKED BY [TZCRACKING].exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots Bolt AIO CRACKED BY [TZCRACKING].exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff Bolt AIO CRACKED BY [TZCRACKING].exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f4225481e03947bc34db131e946b44c8dd50000 Bolt AIO CRACKED BY [TZCRACKING].exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 Bolt AIO CRACKED BY [TZCRACKING].exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\LogicalViewMode = "1" Bolt AIO CRACKED BY [TZCRACKING].exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1092616257" Bolt AIO CRACKED BY [TZCRACKING].exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell Bolt AIO CRACKED BY [TZCRACKING].exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_FolderType = "{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}" Bolt AIO CRACKED BY [TZCRACKING].exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewVersion = "0" Bolt AIO CRACKED BY [TZCRACKING].exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 Bolt AIO CRACKED BY [TZCRACKING].exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 9e0000001a00eebbfe23000010007db10d7bd29c934a973346cc89022e7c00002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020002a0000000000efbe7e47b3fbe4c93b4ba2bad3f5d3cd46f98207ba827a5b6945b5d7ec83085f08cc20002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020000000 Bolt AIO CRACKED BY [TZCRACKING].exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff Bolt AIO CRACKED BY [TZCRACKING].exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders Bolt AIO CRACKED BY [TZCRACKING].exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Mode = "4" Bolt AIO CRACKED BY [TZCRACKING].exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Bolt AIO CRACKED BY [TZCRACKING].exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9} Bolt AIO CRACKED BY [TZCRACKING].exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\IconSize = "16" Bolt AIO CRACKED BY [TZCRACKING].exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 Bolt AIO CRACKED BY [TZCRACKING].exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" Bolt AIO CRACKED BY [TZCRACKING].exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 Bolt AIO CRACKED BY [TZCRACKING].exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 Bolt AIO CRACKED BY [TZCRACKING].exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewID = "{82BA0782-5B7A-4569-B5D7-EC83085F08CC}" Bolt AIO CRACKED BY [TZCRACKING].exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff Bolt AIO CRACKED BY [TZCRACKING].exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2868 Bolt AIO CRACKED BY [TZCRACKING].exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2868 Bolt AIO CRACKED BY [TZCRACKING].exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 2868 Bolt AIO CRACKED BY [TZCRACKING].exe 2868 Bolt AIO CRACKED BY [TZCRACKING].exe 2868 Bolt AIO CRACKED BY [TZCRACKING].exe 2868 Bolt AIO CRACKED BY [TZCRACKING].exe 2868 Bolt AIO CRACKED BY [TZCRACKING].exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Bolt AIO CRACKED BY [TZCRACKING]\Bolt AIO CRACKED BY [TZCRACKING].exe"C:\Users\Admin\AppData\Local\Temp\Bolt AIO CRACKED BY [TZCRACKING]\Bolt AIO CRACKED BY [TZCRACKING].exe"1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2868
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2372
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Documents\New Text Document.txt1⤵PID:2784
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42B
MD5e8a5485e570ab67708edab32db23f8c2
SHA1fa8073114fbf53d7d92155334ea00af004a8f22f
SHA25661499beed72c4e9b94fdb9b8299b89f84043648718498601e30463c60d9bbedd
SHA5129ffb1a370edd7df3ea58ae6416b91df9d241e0091df228c5958d1b9114b2f7e81ebae58a7d39707ac736af225e683ce39dbb07b0e38f3e6f50ab387bb7d3ccc0