Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3a31156b8d8...eb.exe
windows7-x64
7a31156b8d8...eb.exe
windows10-2004-x64
7$PLUGINSDI...ol.dll
windows7-x64
3$PLUGINSDI...ol.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3LinkCreator.exe
windows7-x64
1LinkCreator.exe
windows10-2004-x64
1Uninstall.exe
windows7-x64
7Uninstall.exe
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3eMule Light.js
windows7-x64
1eMule Light.js
windows10-2004-x64
1eMule.js
windows7-x64
1eMule.js
windows10-2004-x64
1emule.exe
windows7-x64
1emule.exe
windows10-2004-x64
1lang/ar_AE.dll
windows7-x64
1lang/ar_AE.dll
windows10-2004-x64
1lang/ba_BA.dll
windows7-x64
1lang/ba_BA.dll
windows10-2004-x64
1lang/bg_BG.dll
windows7-x64
1lang/bg_BG.dll
windows10-2004-x64
1lang/ca_ES.dll
windows7-x64
1lang/ca_ES.dll
windows10-2004-x64
1lang/cz_CZ.dll
windows7-x64
1lang/cz_CZ.dll
windows10-2004-x64
1Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
25/02/2024, 06:05
Static task
static1
Behavioral task
behavioral1
Sample
a31156b8d80a68e8f4354c63e0747beb.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a31156b8d80a68e8f4354c63e0747beb.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/AccessControl.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/AccessControl.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral11
Sample
LinkCreator.exe
Resource
win7-20240220-en
Behavioral task
behavioral12
Sample
LinkCreator.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral13
Sample
Uninstall.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
Uninstall.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral17
Sample
eMule Light.js
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
eMule Light.js
Resource
win10v2004-20240221-en
Behavioral task
behavioral19
Sample
eMule.js
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
eMule.js
Resource
win10v2004-20240221-en
Behavioral task
behavioral21
Sample
emule.exe
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
emule.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral23
Sample
lang/ar_AE.dll
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
lang/ar_AE.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral25
Sample
lang/ba_BA.dll
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
lang/ba_BA.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral27
Sample
lang/bg_BG.dll
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
lang/bg_BG.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral29
Sample
lang/ca_ES.dll
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
lang/ca_ES.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral31
Sample
lang/cz_CZ.dll
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
lang/cz_CZ.dll
Resource
win10v2004-20240221-en
General
-
Target
emule.exe
-
Size
5.5MB
-
MD5
f3f709c2d49dd6636f4ede5c2cae5448
-
SHA1
8e0ea03e4c38199e10a2bc12db8b2df70484111d
-
SHA256
06cdf814387f627a4bd05a0c68211f715bfa952423e8e8a462e1f47c11a4d20e
-
SHA512
7a0df912b5ddc149d770260a2e1a3f55e58ac2e9ef02883e8baa08e79261075b82955bc8e57641bb2c16983abcada2581850fafc11b92a133605127bda80513e
-
SSDEEP
49152:/BGoXbyOj8LePLHcPPLRCAnyOTxP9DzE4GEATLHYiipKXePi9Wxmw7b4ZC1VTWS3:rEWLHcPFCv745ATLHY1kO6g0w7b0XiG
Malware Config
Signatures
-
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\ed2k\shell emule.exe Set value (str) \REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\ed2k\ = "URL: ed2k Protocol" emule.exe Set value (str) \REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\ed2k\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\emule.exe" emule.exe Set value (str) \REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\ed2k\URL Protocol emule.exe Key created \REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\ed2k\shell\open\command emule.exe Key created \REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\ed2k emule.exe Key created \REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\ed2k\shell\open emule.exe Key created \REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\ed2k\DefaultIcon emule.exe Set value (str) \REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\ed2k\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\emule.exe\" \"%1\"" emule.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 3972 emule.exe 3972 emule.exe 3972 emule.exe 3972 emule.exe 3972 emule.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 3972 emule.exe 3972 emule.exe 3972 emule.exe 3972 emule.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3972 emule.exe 3972 emule.exe 3972 emule.exe 3972 emule.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
26B
MD5ec0280f3f439c6febb6b49883c5c100e
SHA1642fe5a3945184440c48368e92c0d6be4c195326
SHA256f124bff0c7833f05418d9980d994152346329d8ca56d080840859aca3a78f151
SHA512cb5e24ed70c9228eeb0028be1ed1cd69c1bc7961f203290a6fa9b0f55780167ca4d989ce09a2f654504da5bcc9e4ce79ea4f5121680a62fb65bcf929f109f5fc
-
Filesize
812B
MD5e09f889d1ba807bdf6dc1cb7457b44d9
SHA1194fe3662357ff0f8e165de882791a2a1af5d76c
SHA2567272a491d35d0d6973436aa108de6861a7abdc3d3c6b535fffcaf9a37a8c5603
SHA512f3fdb561b1a32af48b1d6ba43aaec56a8e0db8034700a26f083b8fae1db64be2412952d9c160ef8fcece48665f1359ab6489338a12de3c48f921c7b60f828edc
-
Filesize
1KB
MD5dca5ea21fc626a457c23bdcfae5ece8f
SHA178bf040981d68f48ffad7e1f8112e9a66d6bead6
SHA256051bb5dad4823ca23cb7233c97ca894971886c6913e9fcb3a7f163f218cfd44b
SHA512820f0e0d187c4eefe8c652089688187699ce2eeaa7c22deccc5bfff1d20937208aaa253223ecc45053f29f814650d795cd09a41a258520fa4984e198cde4063d
-
Filesize
1KB
MD543f30c0ee815f1bc41a9588a79643dc1
SHA17a4d344353d7204d96eea0d02c7da123a6ac45dd
SHA2567f93e610eec9d6ecb1723aa3ab4fbb46bdc2598d8f0a40c649238b58f0785f31
SHA512593547c05747593bf6eeeb5eb45ad02ea5849e4482e2f807175a72c851a303802e4fcd213e06c54d41edbb6693ef86815af0c46506785f78f5d86e6b96df59f5