Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3ADR_Instal...18.exe
windows7-x64
7ADR_Instal...18.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3ADR.exe
windows7-x64
6ADR.exe
windows10-2004-x64
1ADR_Servic...er.exe
windows7-x64
1ADR_Servic...er.exe
windows10-2004-x64
1Help/ADRHelp.dll
windows7-x64
1Help/ADRHelp.dll
windows10-2004-x64
1Homepage_R.url
windows7-x64
6Homepage_R.url
windows10-2004-x64
3homepage.url
windows7-x64
6homepage.url
windows10-2004-x64
3Homepage_R.url
windows7-x64
6Homepage_R.url
windows10-2004-x64
3homepage.url
windows7-x64
6homepage.url
windows10-2004-x64
3新云软件.url
windows7-x64
1新云软件.url
windows10-2004-x64
1Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
15/03/2024, 13:55
Static task
static1
Behavioral task
behavioral1
Sample
ADR_Install_2.26 Build 118.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
ADR_Install_2.26 Build 118.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
ADR.exe
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
ADR.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
ADR_ServiceManager.exe
Resource
win7-20240215-en
Behavioral task
behavioral10
Sample
ADR_ServiceManager.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
Help/ADRHelp.dll
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
Help/ADRHelp.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
Homepage_R.url
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
Homepage_R.url
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
homepage.url
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
homepage.url
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
Homepage_R.url
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
Homepage_R.url
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
homepage.url
Resource
win7-20240215-en
Behavioral task
behavioral20
Sample
homepage.url
Resource
win10v2004-20231215-en
Behavioral task
behavioral21
Sample
新云软件.url
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
新云软件.url
Resource
win10v2004-20240226-en
General
-
Target
ADR.exe
-
Size
793KB
-
MD5
22d15da443d9ce05bd4db542c671bdc2
-
SHA1
31e2ee1c02b7aa2af5b17301bb5c8a4c80bf4291
-
SHA256
c409ed66a84e3a1cc0754dd156676a0e4152c343b288f2bb01d49f8987c4418f
-
SHA512
bac757ef777be13f6d4d15d90c3c824d6299c1773550be0c73c07f39eb7bf3207649f906bffa74c723172e9010774a2cb32d14486896a310f4a1781cc18866a9
-
SSDEEP
24576:JDFELvaut+qaRb9xxR3UROireiB67MP+h2X6C:hK+BleTyiBth6C
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 ADR.exe -
Modifies registry class 13 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ ADR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node ADR.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5E59AD89-BFA8-9C39-B6F3-B50BDE2749F0}\InProcServer32\uwwawmtpeyfpsvgdgrjyywqhykavgbloqjeswcwgry = b437ddbb8d ADR.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5E59AD89-BFA8-9C39-B6F3-B50BDE2749F0}\InProcServer32\hnnmttlbyqxahdnajqdwmxtciqy = b437d2b08d ADR.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5E59AD89-BFA8-9C39-B6F3-B50BDE2749F0}\InProcServer32\eilondtvvbsyqqdarfmrmfymhyrlm = b437ddba88 ADR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID ADR.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5E59AD89-BFA8-9C39-B6F3-B50BDE2749F0}\InProcServer32\uswawmtpeyfpsvgdgrjyywqhykavgbloqjeswcwgry = b437d2b08d ADR.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5E59AD89-BFA8-9C39-B6F3-B50BDE2749F0}\InProcServer32\ucwawmtpeyfpsvgdgrjyywqhykavgbloqjeswcwgry = b437d2b08d ADR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" ADR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5E59AD89-BFA8-9C39-B6F3-B50BDE2749F0}\InProcServer32 ADR.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5E59AD89-BFA8-9C39-B6F3-B50BDE2749F0}\InProcServer32\dgbrkkpnsejiwrwmajtraus = b437d2b08d ADR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key ADR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5E59AD89-BFA8-9C39-B6F3-B50BDE2749F0} ADR.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2344 ADR.exe 2344 ADR.exe 2344 ADR.exe 2344 ADR.exe 2344 ADR.exe 2344 ADR.exe 2344 ADR.exe 2344 ADR.exe 2344 ADR.exe 2344 ADR.exe 2344 ADR.exe 2344 ADR.exe 2344 ADR.exe 2344 ADR.exe 2344 ADR.exe 2344 ADR.exe 2344 ADR.exe 2344 ADR.exe 2344 ADR.exe 2344 ADR.exe 2344 ADR.exe 2344 ADR.exe 2344 ADR.exe 2344 ADR.exe 2344 ADR.exe 2344 ADR.exe 2344 ADR.exe 2344 ADR.exe 2344 ADR.exe 2344 ADR.exe 2344 ADR.exe 2344 ADR.exe 2344 ADR.exe 2344 ADR.exe 2344 ADR.exe 2344 ADR.exe 2344 ADR.exe 2344 ADR.exe 2344 ADR.exe 2344 ADR.exe 2344 ADR.exe 2344 ADR.exe 2344 ADR.exe 2344 ADR.exe 2344 ADR.exe 2344 ADR.exe 2344 ADR.exe 2344 ADR.exe 2344 ADR.exe 2344 ADR.exe 2344 ADR.exe 2344 ADR.exe 2344 ADR.exe 2344 ADR.exe 2344 ADR.exe 2344 ADR.exe 2344 ADR.exe 2344 ADR.exe 2344 ADR.exe 2344 ADR.exe 2344 ADR.exe 2344 ADR.exe 2344 ADR.exe 2344 ADR.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2344 ADR.exe