Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
3Yagami 1.0...re.dll
windows7-x64
3Yagami 1.0...re.dll
windows10-2004-x64
3Yagami 1.0/Qt5Gui.dll
windows7-x64
3Yagami 1.0/Qt5Gui.dll
windows10-2004-x64
3Yagami 1.0...ia.dll
windows7-x64
3Yagami 1.0...ia.dll
windows10-2004-x64
3Yagami 1.0...rk.dll
windows7-x64
3Yagami 1.0...rk.dll
windows10-2004-x64
3Yagami 1.0...ts.dll
windows7-x64
1Yagami 1.0...ts.dll
windows10-2004-x64
3Yagami 1.0/Yagami.exe
windows7-x64
1Yagami 1.0/Yagami.exe
windows10-2004-x64
3Yagami 1.0...-1.dll
windows7-x64
3Yagami 1.0...-1.dll
windows10-2004-x64
3Yagami 1.0...-6.dll
windows7-x64
3Yagami 1.0...-6.dll
windows10-2004-x64
3Yagami 1.0...-1.dll
windows7-x64
1Yagami 1.0...-1.dll
windows10-2004-x64
1Yagami 1.0...if.dll
windows7-x64
1Yagami 1.0...if.dll
windows10-2004-x64
1Yagami 1.0...fd.dll
windows7-x64
1Yagami 1.0...fd.dll
windows10-2004-x64
1Yagami 1.0...ns.dll
windows7-x64
1Yagami 1.0...ns.dll
windows10-2004-x64
1Yagami 1.0...sd.dll
windows7-x64
1Yagami 1.0...sd.dll
windows10-2004-x64
1Yagami 1.0...co.dll
windows7-x64
1Yagami 1.0...co.dll
windows10-2004-x64
1Yagami 1.0...od.dll
windows7-x64
1Yagami 1.0...od.dll
windows10-2004-x64
1Yagami 1.0...eg.dll
windows7-x64
1Yagami 1.0...eg.dll
windows10-2004-x64
1Analysis
-
max time kernel
165s -
max time network
182s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-es -
resource tags
arch:x64arch:x86image:win10v2004-20240226-eslocale:es-esos:windows10-2004-x64systemwindows -
submitted
28/03/2024, 22:46
Static task
static1
Behavioral task
behavioral1
Sample
Yagami 1.0/Qt5Core.dll
Resource
win7-20240221-es
Behavioral task
behavioral2
Sample
Yagami 1.0/Qt5Core.dll
Resource
win10v2004-20240226-es
Behavioral task
behavioral3
Sample
Yagami 1.0/Qt5Gui.dll
Resource
win7-20240221-es
Behavioral task
behavioral4
Sample
Yagami 1.0/Qt5Gui.dll
Resource
win10v2004-20240226-es
Behavioral task
behavioral5
Sample
Yagami 1.0/Qt5Multimedia.dll
Resource
win7-20240220-es
Behavioral task
behavioral6
Sample
Yagami 1.0/Qt5Multimedia.dll
Resource
win10v2004-20240226-es
Behavioral task
behavioral7
Sample
Yagami 1.0/Qt5Network.dll
Resource
win7-20240319-es
Behavioral task
behavioral8
Sample
Yagami 1.0/Qt5Network.dll
Resource
win10v2004-20240226-es
Behavioral task
behavioral9
Sample
Yagami 1.0/Qt5Widgets.dll
Resource
win7-20240221-es
Behavioral task
behavioral10
Sample
Yagami 1.0/Qt5Widgets.dll
Resource
win10v2004-20240226-es
Behavioral task
behavioral11
Sample
Yagami 1.0/Yagami.exe
Resource
win7-20240221-es
Behavioral task
behavioral12
Sample
Yagami 1.0/Yagami.exe
Resource
win10v2004-20240226-es
Behavioral task
behavioral13
Sample
Yagami 1.0/libgcc_s_dw2-1.dll
Resource
win7-20240221-es
Behavioral task
behavioral14
Sample
Yagami 1.0/libgcc_s_dw2-1.dll
Resource
win10v2004-20240226-es
Behavioral task
behavioral15
Sample
Yagami 1.0/libstdc++-6.dll
Resource
win7-20240221-es
Behavioral task
behavioral16
Sample
Yagami 1.0/libstdc++-6.dll
Resource
win10v2004-20240226-es
Behavioral task
behavioral17
Sample
Yagami 1.0/libwinpthread-1.dll
Resource
win7-20240215-es
Behavioral task
behavioral18
Sample
Yagami 1.0/libwinpthread-1.dll
Resource
win10v2004-20240226-es
Behavioral task
behavioral19
Sample
Yagami 1.0/plugins/imageformats/qgif.dll
Resource
win7-20231129-es
Behavioral task
behavioral20
Sample
Yagami 1.0/plugins/imageformats/qgif.dll
Resource
win10v2004-20240226-es
Behavioral task
behavioral21
Sample
Yagami 1.0/plugins/imageformats/qgifd.dll
Resource
win7-20240221-es
Behavioral task
behavioral22
Sample
Yagami 1.0/plugins/imageformats/qgifd.dll
Resource
win10v2004-20240226-es
Behavioral task
behavioral23
Sample
Yagami 1.0/plugins/imageformats/qicns.dll
Resource
win7-20240319-es
Behavioral task
behavioral24
Sample
Yagami 1.0/plugins/imageformats/qicns.dll
Resource
win10v2004-20240226-es
Behavioral task
behavioral25
Sample
Yagami 1.0/plugins/imageformats/qicnsd.dll
Resource
win7-20240221-es
Behavioral task
behavioral26
Sample
Yagami 1.0/plugins/imageformats/qicnsd.dll
Resource
win10v2004-20240226-es
Behavioral task
behavioral27
Sample
Yagami 1.0/plugins/imageformats/qico.dll
Resource
win7-20240221-es
Behavioral task
behavioral28
Sample
Yagami 1.0/plugins/imageformats/qico.dll
Resource
win10v2004-20240226-es
Behavioral task
behavioral29
Sample
Yagami 1.0/plugins/imageformats/qicod.dll
Resource
win7-20240221-es
Behavioral task
behavioral30
Sample
Yagami 1.0/plugins/imageformats/qicod.dll
Resource
win10v2004-20240226-es
Behavioral task
behavioral31
Sample
Yagami 1.0/plugins/imageformats/qjpeg.dll
Resource
win7-20231129-es
Behavioral task
behavioral32
Sample
Yagami 1.0/plugins/imageformats/qjpeg.dll
Resource
win10v2004-20240226-es
General
-
Target
Yagami 1.0/Yagami.exe
-
Size
2.4MB
-
MD5
952d820b9c648d4e7a70e4ae78701e4d
-
SHA1
743693a3e7a6faa524438ce4ecab4bb424e54dfc
-
SHA256
86314f1b1004e693ef2d1bbdb399fa9410f56d9daf68a77ae72d1b50f84a9f6c
-
SHA512
91f55efa7a4215a58f78265212365f551d5329bfcf095e3512dbf1aa08ae380f5f2ab4144c4d9c2a08905a7ca3e9ad563230f6c144d853cbaa7ea3ba1f8324fd
-
SSDEEP
49152:D89Sti9ZmME9zD0fx/ZZWGNh8bu3kR6Zj2G2mfFtjd4qwp14m8P4LHLKrCczISJ3:D8EME930fxRZWymbuURGz2mfFtjKqwpo
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2452 Yagami.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2452 Yagami.exe 2452 Yagami.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Yagami 1.0\Yagami.exe"C:\Users\Admin\AppData\Local\Temp\Yagami 1.0\Yagami.exe"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2452
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5232 --field-trial-handle=2000,i,11471789752336399729,10863385903208193579,262144 --variations-seed-version /prefetch:81⤵PID:2972