Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10TotalAV_Setup.exe
windows11-21h2-x64
8$APPDATA/T...te.exe
windows11-21h2-x64
1$APPDATA/T...io.dll
windows11-21h2-x64
3$APPDATA/T...lt.sys
windows11-21h2-x64
1$APPDATA/T...bb.sys
windows11-21h2-x64
1$APPDATA/T...gr.sys
windows11-21h2-x64
1$APPDATA/T...io.dll
windows11-21h2-x64
3$APPDATA/T...lt.sys
windows11-21h2-x64
1$APPDATA/T...bb.sys
windows11-21h2-x64
1$APPDATA/T...gr.sys
windows11-21h2-x64
1$APPDATA/T...io.dll
windows11-21h2-x64
3$APPDATA/T...lt.sys
windows11-21h2-x64
1$APPDATA/T...bb.sys
windows11-21h2-x64
1$APPDATA/T...gr.sys
windows11-21h2-x64
1$APPDATA/T...io.dll
windows11-21h2-x64
3$APPDATA/T...lt.sys
windows11-21h2-x64
1Microsoft....cs.dll
windows11-21h2-x64
1Microsoft....es.dll
windows11-21h2-x64
1Microsoft.CSharp.dll
windows11-21h2-x64
1Microsoft....ns.dll
windows11-21h2-x64
1Microsoft....on.dll
windows11-21h2-x64
1Microsoft....on.dll
windows11-21h2-x64
Microsoft....ng.dll
windows11-21h2-x64
1Microsoft....es.dll
windows11-21h2-x64
1Microsoft....re.dll
windows11-21h2-x64
1Microsoft....es.dll
windows11-21h2-x64
1Microsoft....ry.dll
windows11-21h2-x64
1Mindscape....on.dll
windows11-21h2-x64
1NamedPipeS...on.dll
windows11-21h2-x64
1Newtonsoft.Json.dll
windows11-21h2-x64
1Nito.Async...on.dll
windows11-21h2-x64
1Nito.AsyncEx.Oop.dll
windows11-21h2-x64
1Analysis
-
max time kernel
78s -
max time network
99s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
20/03/2024, 23:27
Behavioral task
behavioral1
Sample
TotalAV_Setup.exe
Resource
win11-20240214-en
Behavioral task
behavioral2
Sample
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/avupdate.exe
Resource
win11-20240221-en
Behavioral task
behavioral3
Sample
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win32/win7/avgio.dll
Resource
win11-20240221-en
Behavioral task
behavioral4
Sample
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win32/win7/avgntflt.sys
Resource
win11-20240221-en
Behavioral task
behavioral5
Sample
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win32/win7/avipbb.sys
Resource
win11-20240221-en
Behavioral task
behavioral6
Sample
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win32/win7/avkmgr.sys
Resource
win11-20240221-en
Behavioral task
behavioral7
Sample
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win32/win8/avgio.dll
Resource
win11-20240221-en
Behavioral task
behavioral8
Sample
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win32/win8/avgntflt.sys
Resource
win11-20240221-en
Behavioral task
behavioral9
Sample
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win32/win8/avipbb.sys
Resource
win11-20240221-en
Behavioral task
behavioral10
Sample
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win32/win8/avkmgr.sys
Resource
win11-20240221-en
Behavioral task
behavioral11
Sample
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win64/win7/avgio.dll
Resource
win11-20240214-en
Behavioral task
behavioral12
Sample
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win64/win7/avgntflt.sys
Resource
win11-20240221-en
Behavioral task
behavioral13
Sample
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win64/win7/avipbb.sys
Resource
win11-20240221-en
Behavioral task
behavioral14
Sample
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win64/win7/avkmgr.sys
Resource
win11-20240319-en
Behavioral task
behavioral15
Sample
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win64/win8/avgio.dll
Resource
win11-20240221-en
Behavioral task
behavioral16
Sample
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win64/win8/avgntflt.sys
Resource
win11-20240221-en
Behavioral task
behavioral17
Sample
Microsoft.AppCenter.Analytics.dll
Resource
win11-20240221-en
Behavioral task
behavioral18
Sample
Microsoft.AppCenter.Crashes.dll
Resource
win11-20240214-en
Behavioral task
behavioral19
Sample
Microsoft.CSharp.dll
Resource
win11-20240221-en
Behavioral task
behavioral20
Sample
Microsoft.Extensions.Configuration.Abstractions.dll
Resource
win11-20240221-en
Behavioral task
behavioral21
Sample
Microsoft.Extensions.Configuration.dll
Resource
win11-20240221-en
Behavioral task
behavioral22
Sample
Microsoft.Extensions.DependencyInjection.dll
Resource
win11-20240221-en
Behavioral task
behavioral23
Sample
Microsoft.Extensions.Logging.dll
Resource
win11-20240221-en
Behavioral task
behavioral24
Sample
Microsoft.Extensions.Primitives.dll
Resource
win11-20240221-en
Behavioral task
behavioral25
Sample
Microsoft.VisualBasic.Core.dll
Resource
win11-20240221-en
Behavioral task
behavioral26
Sample
Microsoft.Win32.Primitives.dll
Resource
win11-20240221-en
Behavioral task
behavioral27
Sample
Microsoft.Win32.Registry.dll
Resource
win11-20240221-en
Behavioral task
behavioral28
Sample
Mindscape.Raygun4Net.NetCore.Common.dll
Resource
win11-20240221-en
Behavioral task
behavioral29
Sample
NamedPipeServerStream.NetFrameworkVersion.dll
Resource
win11-20240319-en
Behavioral task
behavioral30
Sample
Newtonsoft.Json.dll
Resource
win11-20240221-en
Behavioral task
behavioral31
Sample
Nito.AsyncEx.Coordination.dll
Resource
win11-20240221-en
Behavioral task
behavioral32
Sample
Nito.AsyncEx.Oop.dll
Resource
win11-20240214-en
General
-
Target
Microsoft.Win32.Primitives.dll
-
Size
7KB
-
MD5
8607bdfc638e4fa1d8e716486a9c6475
-
SHA1
9e246a9f462097de2b3b2472950eb6273e874efc
-
SHA256
85c9a4fac07761d259bd91c669e4e1c10cf79d0939e64ee96e32abdcce51c86c
-
SHA512
91314554e0937194f74c802c695090582e9a6b857da72026ccf5432f5ad960547b4f4e2235f0a56108a63cbb40d60fb7d7bbb30b39f1851606a09bcf34371c5a
-
SSDEEP
96:/0TYpaXzERVpxxeDZeoIqA4NVPiDKWUOLfW+qxv87xbO+XDS8PODxVWhPIeWE:8spQgrpnkeQwRUOKlxEdr50WhPIeW
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4728 wrote to memory of 2080 4728 rundll32.exe 78 PID 4728 wrote to memory of 2080 4728 rundll32.exe 78 PID 4728 wrote to memory of 2080 4728 rundll32.exe 78
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Microsoft.Win32.Primitives.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Microsoft.Win32.Primitives.dll,#12⤵PID:2080
-