Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
7ca2bea3722...72.exe
windows7-x64
7ca2bea3722...72.exe
windows10-2004-x64
7$PLUGINSDI...er.dll
windows7-x64
1$PLUGINSDI...er.dll
windows10-2004-x64
1$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...le.exe
windows7-x64
7$PLUGINSDI...le.exe
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3MainInstaller.exe
windows7-x64
7MainInstaller.exe
windows10-2004-x64
7PingMe.exe
windows7-x64
1PingMe.exe
windows10-2004-x64
1Setup.exe
windows7-x64
7Setup.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...oc.dll
windows7-x64
1$PLUGINSDI...oc.dll
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ss.dll
windows7-x64
3$PLUGINSDI...ss.dll
windows10-2004-x64
32YourFace_Util.dll
windows7-x64
32YourFace_Util.dll
windows10-2004-x64
3AddInstall.js
windows7-x64
1AddInstall.js
windows10-2004-x64
1background.html
windows7-x64
1background.html
windows10-2004-x64
1Analysis
-
max time kernel
144s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
15/03/2024, 01:49
Behavioral task
behavioral1
Sample
ca2bea37223005c7718fa6cd7c1d2372.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ca2bea37223005c7718fa6cd7c1d2372.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/Banner.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/Banner.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/bundle.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/bundle.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
MainInstaller.exe
Resource
win7-20240220-en
Behavioral task
behavioral14
Sample
MainInstaller.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
PingMe.exe
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
PingMe.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
Setup.exe
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
Setup.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
$PLUGINSDIR/KillProc.dll
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
$PLUGINSDIR/KillProc.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240215-en
Behavioral task
behavioral24
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
2YourFace_Util.dll
Resource
win7-20231129-en
Behavioral task
behavioral28
Sample
2YourFace_Util.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral29
Sample
AddInstall.js
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
AddInstall.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
background.html
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
background.html
Resource
win10v2004-20231215-en
General
-
Target
MainInstaller.exe
-
Size
531KB
-
MD5
9ce448dcd7cf13dd950725957361bdff
-
SHA1
5831ff31825ea82d90a2989e0fc0a33b859d5f97
-
SHA256
3dbc5aff076ef9c86a90ad30e963581f7cb22f8e212aa38db29d82cf45b73f80
-
SHA512
b4a175da3677cd3380cb3789f281f2afb10aa00dc9592217062d66eb9b5e73805886b692975d7244cdd439d8d5bcd0eb5810533284ba4b13ff02a20b792bf74f
-
SSDEEP
12288:z/8Ze69hm2S17Y/bv9VXXLVS+n28L6OdBCZrrf3xSEowuj6ZQM7gMWZQkN:zihc17YpVE+PGsB03xSEowuj6ZQM71WD
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2256 Setup.exe -
Loads dropped DLL 1 IoCs
pid Process 2256 Setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 2 IoCs
resource yara_rule behavioral14/files/0x000800000002324d-3.dat nsis_installer_1 behavioral14/files/0x000800000002324d-3.dat nsis_installer_2 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4604 wrote to memory of 2256 4604 MainInstaller.exe 98 PID 4604 wrote to memory of 2256 4604 MainInstaller.exe 98 PID 4604 wrote to memory of 2256 4604 MainInstaller.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\MainInstaller.exe"C:\Users\Admin\AppData\Local\Temp\MainInstaller.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\Setup.exeC:\Users\Admin\AppData\Local\Temp\Setup.exe /PID=0 /NOTIFY=0 /FFR=1 /FFP=12⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2256
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1352 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:81⤵PID:4344
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
505KB
MD55d8d0c08384ad73216d52a2eabc064f5
SHA10fa5c77fd6b6323b926c9648679e063d1bbc8bcc
SHA25630522715240f4a05859099ac370dfb516097ab257402981c6a9ad31951f36cce
SHA51242a3003019e39622082506c7ae50d8a27e2920fdfdf15eb9a8dbf7f1dbd49a02cd0390dabd74c136ed44e9d8ba270540ce9390f31aa84c2fc9fdfcc9e912dd57
-
Filesize
14KB
MD5325b008aec81e5aaa57096f05d4212b5
SHA127a2d89747a20305b6518438eff5b9f57f7df5c3
SHA256c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
SHA51218362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
-
Filesize
694B
MD5781d575d4fa228d8c7633617b186f8d3
SHA1cc0e03860342523d10ce788353b6f04894d4f3a4
SHA2565f20cd209d1e9ecd22d61f579b26edcf042cded27055f6f02c0ce2a4ba13ce18
SHA512cd2404782a15c6bbed9a6f464e1d6fed2c5cd771744d6801870c4a50f47e6be02891b300ca019df36774bdf8d8f43c3b0e6a7dd08bd8361403838e23730daa70