Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3ADR_Instal...18.exe
windows7-x64
7ADR_Instal...18.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3ADR.exe
windows7-x64
6ADR.exe
windows10-2004-x64
1ADR_Servic...er.exe
windows7-x64
1ADR_Servic...er.exe
windows10-2004-x64
1Help/ADRHelp.dll
windows7-x64
1Help/ADRHelp.dll
windows10-2004-x64
1Homepage_R.url
windows7-x64
6Homepage_R.url
windows10-2004-x64
3homepage.url
windows7-x64
6homepage.url
windows10-2004-x64
3Homepage_R.url
windows7-x64
6Homepage_R.url
windows10-2004-x64
3homepage.url
windows7-x64
6homepage.url
windows10-2004-x64
3新云软件.url
windows7-x64
1新云软件.url
windows10-2004-x64
1Analysis
-
max time kernel
120s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15/03/2024, 13:55
Static task
static1
Behavioral task
behavioral1
Sample
ADR_Install_2.26 Build 118.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
ADR_Install_2.26 Build 118.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
ADR.exe
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
ADR.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
ADR_ServiceManager.exe
Resource
win7-20240215-en
Behavioral task
behavioral10
Sample
ADR_ServiceManager.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
Help/ADRHelp.dll
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
Help/ADRHelp.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
Homepage_R.url
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
Homepage_R.url
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
homepage.url
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
homepage.url
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
Homepage_R.url
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
Homepage_R.url
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
homepage.url
Resource
win7-20240215-en
Behavioral task
behavioral20
Sample
homepage.url
Resource
win10v2004-20231215-en
Behavioral task
behavioral21
Sample
新云软件.url
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
新云软件.url
Resource
win10v2004-20240226-en
General
-
Target
$PLUGINSDIR/LangDLL.dll
-
Size
5KB
-
MD5
c9ac0758ce8c10793d39655064c653cb
-
SHA1
8ba1f9dfcc671b5102f5940da67570c28252bc71
-
SHA256
161d69c50e5c50d853fda129b6f6f6bc241214b87d13a33bf93543e7e6886119
-
SHA512
54a8c2ded9a42de867c8a89a11701bcdb5d51aea168c4f3ffe8991859cf26f15d478b6111c85732c1059edbfd9408e42ca830706347a8ac87c5064e47d823349
-
SSDEEP
48:SnKQ/z+vUML8eYXICmlmGYKHz0JSpXSxwo6mpwzcR3RqG8aEJpABofgMGKO:Qz+MM4eqmvz0JScx56mpwzAhWjGV
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2312 2200 WerFault.exe 28 -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2292 wrote to memory of 2200 2292 rundll32.exe 28 PID 2292 wrote to memory of 2200 2292 rundll32.exe 28 PID 2292 wrote to memory of 2200 2292 rundll32.exe 28 PID 2292 wrote to memory of 2200 2292 rundll32.exe 28 PID 2292 wrote to memory of 2200 2292 rundll32.exe 28 PID 2292 wrote to memory of 2200 2292 rundll32.exe 28 PID 2292 wrote to memory of 2200 2292 rundll32.exe 28 PID 2200 wrote to memory of 2312 2200 rundll32.exe 29 PID 2200 wrote to memory of 2312 2200 rundll32.exe 29 PID 2200 wrote to memory of 2312 2200 rundll32.exe 29 PID 2200 wrote to memory of 2312 2200 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 2283⤵
- Program crash
PID:2312
-
-