Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3ADR_Instal...18.exe
windows7-x64
7ADR_Instal...18.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3ADR.exe
windows7-x64
6ADR.exe
windows10-2004-x64
1ADR_Servic...er.exe
windows7-x64
1ADR_Servic...er.exe
windows10-2004-x64
1Help/ADRHelp.dll
windows7-x64
1Help/ADRHelp.dll
windows10-2004-x64
1Homepage_R.url
windows7-x64
6Homepage_R.url
windows10-2004-x64
3homepage.url
windows7-x64
6homepage.url
windows10-2004-x64
3Homepage_R.url
windows7-x64
6Homepage_R.url
windows10-2004-x64
3homepage.url
windows7-x64
6homepage.url
windows10-2004-x64
3新云软件.url
windows7-x64
1新云软件.url
windows10-2004-x64
1Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
15/03/2024, 13:55
Static task
static1
Behavioral task
behavioral1
Sample
ADR_Install_2.26 Build 118.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
ADR_Install_2.26 Build 118.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
ADR.exe
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
ADR.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
ADR_ServiceManager.exe
Resource
win7-20240215-en
Behavioral task
behavioral10
Sample
ADR_ServiceManager.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
Help/ADRHelp.dll
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
Help/ADRHelp.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
Homepage_R.url
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
Homepage_R.url
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
homepage.url
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
homepage.url
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
Homepage_R.url
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
Homepage_R.url
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
homepage.url
Resource
win7-20240215-en
Behavioral task
behavioral20
Sample
homepage.url
Resource
win10v2004-20231215-en
Behavioral task
behavioral21
Sample
新云软件.url
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
新云软件.url
Resource
win10v2004-20240226-en
General
-
Target
ADR.exe
-
Size
793KB
-
MD5
22d15da443d9ce05bd4db542c671bdc2
-
SHA1
31e2ee1c02b7aa2af5b17301bb5c8a4c80bf4291
-
SHA256
c409ed66a84e3a1cc0754dd156676a0e4152c343b288f2bb01d49f8987c4418f
-
SHA512
bac757ef777be13f6d4d15d90c3c824d6299c1773550be0c73c07f39eb7bf3207649f906bffa74c723172e9010774a2cb32d14486896a310f4a1781cc18866a9
-
SSDEEP
24576:JDFELvaut+qaRb9xxR3UROireiB67MP+h2X6C:hK+BleTyiBth6C
Malware Config
Signatures
-
Modifies registry class 13 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0B00D35E-CBC6-F31E-340C-7C3A9980E496}\InProcServer32\ulqsrgfhjcyyheeddatrfkmpagb = c1b217190a ADR.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0B00D35E-CBC6-F31E-340C-7C3A9980E496}\InProcServer32\xqwunelgdmchfxpdushpdkpwhqkpv = c1b218130f ADR.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0B00D35E-CBC6-F31E-340C-7C3A9980E496}\InProcServer32\uohokwpxdhourwkqgpdpudl = c1b217190a ADR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key ADR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0B00D35E-CBC6-F31E-340C-7C3A9980E496} ADR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID ADR.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0B00D35E-CBC6-F31E-340C-7C3A9980E496}\InProcServer32\hfawoulvukggvstavxkeslhtyiafcecaktwgevhcth = c1b218120a ADR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0B00D35E-CBC6-F31E-340C-7C3A9980E496}\InProcServer32 ADR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node ADR.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0B00D35E-CBC6-F31E-340C-7C3A9980E496}\InProcServer32\hqawoulvukggvstavxkeslhtyiafcecaktwgevhcth = c1b217190a ADR.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0B00D35E-CBC6-F31E-340C-7C3A9980E496}\InProcServer32\haawoulvukggvstavxkeslhtyiafcecaktwgevhcth = c1b217190a ADR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ ADR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" ADR.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2972 ADR.exe 2972 ADR.exe 2972 ADR.exe 2972 ADR.exe 2972 ADR.exe 2972 ADR.exe 2972 ADR.exe 2972 ADR.exe 2972 ADR.exe 2972 ADR.exe 2972 ADR.exe 2972 ADR.exe 2972 ADR.exe 2972 ADR.exe 2972 ADR.exe 2972 ADR.exe 2972 ADR.exe 2972 ADR.exe 2972 ADR.exe 2972 ADR.exe 2972 ADR.exe 2972 ADR.exe 2972 ADR.exe 2972 ADR.exe 2972 ADR.exe 2972 ADR.exe 2972 ADR.exe 2972 ADR.exe 2972 ADR.exe 2972 ADR.exe 2972 ADR.exe 2972 ADR.exe 2972 ADR.exe 2972 ADR.exe 2972 ADR.exe 2972 ADR.exe 2972 ADR.exe 2972 ADR.exe 2972 ADR.exe 2972 ADR.exe 2972 ADR.exe 2972 ADR.exe 2972 ADR.exe 2972 ADR.exe 2972 ADR.exe 2972 ADR.exe 2972 ADR.exe 2972 ADR.exe 2972 ADR.exe 2972 ADR.exe 2972 ADR.exe 2972 ADR.exe 2972 ADR.exe 2972 ADR.exe 2972 ADR.exe 2972 ADR.exe 2972 ADR.exe 2972 ADR.exe 2972 ADR.exe 2972 ADR.exe 2972 ADR.exe 2972 ADR.exe 2972 ADR.exe 2972 ADR.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2972 ADR.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
349B
MD50805c0111fd87d6f2ec0c1a8c610f716
SHA11ea42d2f7197d5d47777ef7bd1d100182a6a06e9
SHA256fd9fa2cfb7a9398507d7626a4485f21545e882e19b9abf5e64a252e85530333c
SHA51249600616de184c84b93d15b600f0c124c9b94672dc9248176c5b683ef5881b4eda48c66ae285d9e8e4d7767cf55b0ef69f7976a90dbd072cdea09c9ece991b1b