Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3a31944ff5c...a1.exe
windows7-x64
7a31944ff5c...a1.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$TEMPLATES...at.exe
windows7-x64
1$TEMPLATES...at.exe
windows10-2004-x64
1$TEMPLATES...cs.dll
windows7-x64
1$TEMPLATES...cs.dll
windows10-2004-x64
1KKJDock.exe
windows7-x64
3KKJDock.exe
windows10-2004-x64
3uninst.exe
windows7-x64
7uninst.exe
windows10-2004-x64
7Analysis
-
max time kernel
92s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
25/02/2024, 06:23
Static task
static1
Behavioral task
behavioral1
Sample
a31944ff5c7531ecddbf45ac0d864ea1.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a31944ff5c7531ecddbf45ac0d864ea1.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral7
Sample
$TEMPLATES/installstat.exe
Resource
win7-20240220-en
Behavioral task
behavioral8
Sample
$TEMPLATES/installstat.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral9
Sample
$TEMPLATES/statistics.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
$TEMPLATES/statistics.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral11
Sample
KKJDock.exe
Resource
win7-20240215-en
Behavioral task
behavioral12
Sample
KKJDock.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral13
Sample
uninst.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
uninst.exe
Resource
win10v2004-20240221-en
General
-
Target
KKJDock.exe
-
Size
430KB
-
MD5
6791021b5dd067d129d042d782d68cc3
-
SHA1
f2a3fe15b3f6a422623ffda6ba93bd6025e33657
-
SHA256
78bfbda674558acf28a13f3332f723ca0e80b1941a0a7fcf84a2f75f9e1fc4e3
-
SHA512
d01a75a782350299429d02c0c3eb89c39ad9cce39d28e24cf9fdac663e409c3d77cd8a3be78f00e2bd0698956d904c2b99df19e602529d725eef12668930a587
-
SSDEEP
12288:6kYiPkjvazPGlHZnh6nCWZ3teMT6+DzgN:VYvaa5q3EiG
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 4456 KKJDock.exe Token: SeIncBasePriorityPrivilege 4456 KKJDock.exe -
Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 4456 KKJDock.exe 4456 KKJDock.exe 4456 KKJDock.exe 4456 KKJDock.exe 4456 KKJDock.exe 4456 KKJDock.exe 4456 KKJDock.exe 4456 KKJDock.exe -
Suspicious use of SendNotifyMessage 6 IoCs
pid Process 4456 KKJDock.exe 4456 KKJDock.exe 4456 KKJDock.exe 4456 KKJDock.exe 4456 KKJDock.exe 4456 KKJDock.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4456 KKJDock.exe