Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3d56af58923...04.exe
windows7-x64
7d56af58923...04.exe
windows10-2004-x64
7$0/basicscan.dll
windows7-x64
1$0/basicscan.dll
windows10-2004-x64
1$0/basicscan.exe
windows7-x64
1$0/basicscan.exe
windows10-2004-x64
1$0/uninstall.exe
windows7-x64
7$0/uninstall.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
19/03/2024, 06:23
Static task
static1
Behavioral task
behavioral1
Sample
d56af5892316ea8d3d1a2317546d8504.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
d56af5892316ea8d3d1a2317546d8504.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$0/basicscan.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$0/basicscan.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
$0/basicscan.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$0/basicscan.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
$0/uninstall.exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$0/uninstall.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240220-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20231215-en
General
-
Target
$0/uninstall.exe
-
Size
78KB
-
MD5
15c684cbe9b6a3d4b075b555dda6c3a5
-
SHA1
9df0ff2343eb9d1e0e855a527ea2f47b9b69123f
-
SHA256
ede89fd80817313dfe13954bd3d9d9231253dace78ed8d6d0f273d2230f0467f
-
SHA512
e870477a2deb5834236b30a6a11600380886d5c4414260717c5b5c0989e41c40f259b6658f1e15f93f42a54889aa192b85cec09e6053eb05c5869496d3383d8c
-
SSDEEP
1536:PEkjY1zy214Qay0DGkJ7qAELVigJSxhcpub3RsagxxZ/RL32/DH:8kjAJ4dDGkJ+AI0x+8hsagjZ/RLm/T
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3312 Au_.exe -
Loads dropped DLL 2 IoCs
pid Process 3312 Au_.exe 3312 Au_.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 1 IoCs
resource yara_rule behavioral8/files/0x0008000000023211-3.dat nsis_installer_1 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 460 wrote to memory of 3312 460 uninstall.exe 89 PID 460 wrote to memory of 3312 460 uninstall.exe 89 PID 460 wrote to memory of 3312 460 uninstall.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\$0\uninstall.exe"C:\Users\Admin\AppData\Local\Temp\$0\uninstall.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:460 -
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\$0\2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3312
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13KB
MD5d765c492c21689e3d9d61634371fd861
SHA1ac200933671ae52c9d5544d0e2e8e9144d286c83
SHA256551e6042dd494ea01549555ffc194ab9729da09058ec714eb368dd06642c9bbc
SHA5129919a9e848c8f1e26c75d0d29207571e4b86a4140bd554743d2c1f8bd7f386fe4919345b163d89a5d907fb165e435ba0ac5f6b1101713636141f156a420e2e0f
-
Filesize
10KB
MD5fe24766ba314f620d57d0cf7339103c0
SHA18641545f03f03ff07485d6ec4d7b41cbb898c269
SHA256802ef71440f662f456bed6283a5ff78066af016897fe6bfd29cac6edc2967bbd
SHA51260d36959895cebf29c4e7713e6d414980139c7aa4ed1c8c96fefb672c1263af0ce909fb409534355895649c0e8056635112efb0da2ba05694446aec2ca77e2e3
-
Filesize
650B
MD50e9ebf409db459aaa4ada3deaf05e777
SHA1cf173727b4ae746ec595f4ee7ece174e42a4206a
SHA25662e07237b2ad4b17eb5ffe450480a3598beebc5be585d2e2cf4d3492ea861202
SHA51206892299c7b83d46f85c8fca07bef958d1bda38c9b09da4480e534b4312f8317c37b0f47d5d53ea2c364e2b5e727dfd9ad2b9aaa1fbf9323dd52299979d341ac
-
Filesize
78KB
MD515c684cbe9b6a3d4b075b555dda6c3a5
SHA19df0ff2343eb9d1e0e855a527ea2f47b9b69123f
SHA256ede89fd80817313dfe13954bd3d9d9231253dace78ed8d6d0f273d2230f0467f
SHA512e870477a2deb5834236b30a6a11600380886d5c4414260717c5b5c0989e41c40f259b6658f1e15f93f42a54889aa192b85cec09e6053eb05c5869496d3383d8c