Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

7

The-Timebu...g_.exe

windows7-x64

7

The-Timebu...g_.exe

windows10-2004-x64

7

$PLUGINSDI...el.dll

windows7-x64

7

$PLUGINSDI...el.dll

windows10-2004-x64

7

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows7-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$TEMP/SDM1...er.dll

windows7-x64

7

$TEMP/SDM1...er.dll

windows10-2004-x64

7

$TEMP/SDM1...es.exe

windows7-x64

7

$TEMP/SDM1...es.exe

windows10-2004-x64

7

$TEMP/SDM1...er.dll

windows7-x64

1

$TEMP/SDM1...er.dll

windows10-2004-x64

3

$TEMP/SDM1...er.exe

windows7-x64

1

$TEMP/SDM1...er.exe

windows10-2004-x64

1

$TEMP/SDM1...ll.dll

windows7-x64

7

$TEMP/SDM1...ll.dll

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    The-Timebuilders--Pyramid-Rising_.exe

  • Size

    1.2MB

  • Sample

    240319-rg619sef21

  • MD5

    7f0ae43d94dce6056dada702de0865c3

  • SHA1

    1ed023af8f2d9721a957a16d731b3cf5293190fd

  • SHA256

    a5f658d37346324438f0c2f479074669d22a11fa8e13a14f5f83d57c7ce2ab03

  • SHA512

    1a139c75a3594578dbe8b848d7e1cc079f5533ec8b9fd4eb4e5f917556a2b7d4d3d8abf296883b0a830b5bbae5209a78a257a32a79c929b4ad40a1389566e90a

  • SSDEEP

    24576:8KX2vzpbZGaKBVlEn+f3VgikCFkJ9k4i/izgNwMqfQN+QfsqF:HGvz7GfY+f3VOCiJS46iwwMqqB0qF

Score
7/10
bootkitdiscoverypersistencespywarestealerupx

Malware Config

Targets

    • Target

      The-Timebuilders--Pyramid-Rising_.exe

    • Size

      1.2MB

    • MD5

      7f0ae43d94dce6056dada702de0865c3

    • SHA1

      1ed023af8f2d9721a957a16d731b3cf5293190fd

    • SHA256

      a5f658d37346324438f0c2f479074669d22a11fa8e13a14f5f83d57c7ce2ab03

    • SHA512

      1a139c75a3594578dbe8b848d7e1cc079f5533ec8b9fd4eb4e5f917556a2b7d4d3d8abf296883b0a830b5bbae5209a78a257a32a79c929b4ad40a1389566e90a

    • SSDEEP

      24576:8KX2vzpbZGaKBVlEn+f3VgikCFkJ9k4i/izgNwMqfQN+QfsqF:HGvz7GfY+f3VOCiJS46iwwMqqB0qF

    Score
    7/10
    bootkitdiscoverypersistencespywarestealerupx

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Downloads MZ/PE file

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Deletes itself

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/SelfDel.dll

    • Size

      5KB

    • MD5

      e5786e8703d651bc8bd4bfecf46d3844

    • SHA1

      fee5aa4b325deecbf69ccb6eadd89bd5ae59723f

    • SHA256

      d115bce0a787b4f895e700efe943695c8f1087782807d91d831f6015b0f98774

    • SHA512

      d14ad43a01db19428cd8ccd2fe101750860933409b5be2eb85a3e400efcd37b1b6425ce84e87a7fe46ecabc7b91c4b450259e624c178b86e194ba7da97957ba3

    • SSDEEP

      96:NdekHUj5z13cPopei+Ml9PNDFbS7xg+TScrQ5:NdeuU9xcPopr+M9FbSS+TSE

    Score
    7/10
    upx

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      a436db0c473a087eb61ff5c53c34ba27

    • SHA1

      65ea67e424e75f5065132b539c8b2eda88aa0506

    • SHA256

      75ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49

    • SHA512

      908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d

    • SSDEEP

      192:aVL7iZJX76BisO7+UZEw+Rl59pV8ghsVJ39dx8T:d7NsOpZsfLMJ39e

    Score
    3/10
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/nsExec.dll

    • Size

      6KB

    • MD5

      14f5984b926208de2aafb55dd9971d4a

    • SHA1

      e5afe0b80568135d3e259c73f93947d758a7b980

    • SHA256

      030bcfa82e3bb424835a5fa53a3ff17ab08557d3bbeea4815313036fc4bdafe1

    • SHA512

      e9ec97dd57ead871789d49ed38d9fde5f31d3cb2547810cae49a736e06b9f9b28cf8efea825eb83c3e07d880ee798abfb9069c6957416d5973c83e4531814e27

    • SSDEEP

      96:k7GUaYNwCLuGFctpiKFlYJ8hH4RVHpwdEeY3kRlDr6dMqqyVgNJ38:Wygp3FcHi0xhYMR8dMqJVgN

    Score
    3/10
    behavioral7behavioral8

    • Target

      $TEMP/SDM143/ExentCtlInstaller.dll

    • Size

      100KB

    • MD5

      6b2c9276b76ff82abc5b12626a6b3201

    • SHA1

      ff1c09a79230e66eb6df7f6d7848710f1acfffa1

    • SHA256

      76814c96196776c5ed4d65b9144d66423c78fda2faa61daf87cf4c742c07551b

    • SHA512

      20bc0e0f236bf7f4cb91dfa205b41175abe2a830d4adb9f210d2da2291ddc444c8484485c5c97a0141cfb3763b1e46542f5b211057966d85dc4d4c764e8eefe0

    • SSDEEP

      1536:GyrB9NViYoJ3w1NjSzF5yfBsiZpsVI2TFQblrjgZYBmmlNL9bnouy8/Dvs3h5h:19eS3sF5EsuyQgp2out/DvSh

    Score
    7/10
    upx

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral10behavioral9

    • Target

      $TEMP/SDM143/Free Ride Games.exe

    • Size

      519KB

    • MD5

      2db35d715864b8846f21dc95756171e0

    • SHA1

      ed9030449256bd21e4f041961fb27bbbeddd7fff

    • SHA256

      854bb62475a4b700a7ec49651610d050f1651491d0148c4bd4928b18bdc0436b

    • SHA512

      65b62a0450a60f736af6ac42d6bec252160feac0681cc6319cbd32e76d631a4ea6d206dd62cee5cc00dd22e3de8dbf042024caa22d4288f8b932276f7b93898f

    • SSDEEP

      12288:7i5lxmt3u9QBxVlyR+f3BeqibabMrh9ec9crnk9fVfb1YoSoJ:7QGeKfVlyR+f3BesMSRk99b1j

    Score
    7/10
    upx

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral11behavioral12

    • Target

      $TEMP/SDM143/Splasher.dll

    • Size

      475KB

    • MD5

      41d94c8eb8cb17e04f8ec6e14132f9ca

    • SHA1

      add92b031eb36b26335763780df88bca58636ed7

    • SHA256

      2e522a4da2c291ebcde484b4a04a6ef0691a732b9db454f12399d3e577327c96

    • SHA512

      0561594d671cc64717463d59e2f076453614584ccdd47b4a39cd347e9999ba63463233c75dd9972102a2634b1abfe6c97fa8f682d944bc5cf129724b7595faa7

    • SSDEEP

      12288:2I2EL1NaycNyL+kNmQLnmQtMleiQ8Zceqw1:tTayPLDltMUiQ8Zceqw1

    Score
    3/10
    behavioral13behavioral14

    • Target

      $TEMP/SDM143/cmhelper.exe

    • Size

      234KB

    • MD5

      51d301714c7361192d6305f6c46d90d1

    • SHA1

      f546aac6dfab1187228df393e0db2c21e4fee1d0

    • SHA256

      c9245047b86f8359a7f313434b85af481008e8cdf9579fd55aff8b8fbfb5ebcb

    • SHA512

      9b6149c9c099f9cea3d574723d9ff6678d4f91ae7408349738a999d4986ce3cb7b4886f2972f6f1d3b27f7f7453a764f05c50d383f7054234b4ae55437d369b6

    • SSDEEP

      6144:LOEHuJxrvi0rxKdCOBogi3y0E3x+YHKeNIT0SCa8yAyDFOztzi1iHv1:LOEHuHNrxKd3BoTMxtOBOpP1

    Score
    1/10
    behavioral15behavioral16

    • Target

      $TEMP/SDM143/resourceDll.dll

    • Size

      171KB

    • MD5

      5cf0fba9e8775382233c8e63e52c838a

    • SHA1

      b2a092f71eff0f6916652d7f3bfde9204eda5636

    • SHA256

      7d940af8950b106227539cd4bdfb62f2d37a4abeaf568ebe2275fd31058c2ca5

    • SHA512

      73489e3638b98ffd7bd516bfed519cfd48758aaaedc11cb202d11822cad609caf9af95e9e864bd8a992be826945e6d018ce081f3970511fd49d7757ca6affd25

    • SSDEEP

      3072:+ZY/h+iA4GaJfGZK2MiMq5dpNQA2Wj5vg/ySQGdXMd86a30GCooutkzjO:YWwqGaJfGZ1Mq5BRj2/yR8XMZ0CooSkz

    Score
    7/10
    upx

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral17behavioral18

MITRE ATT&CK Enterprise v15

Tasks