Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

3

QDeskSetup1.1.1.6.exe

windows7-x64

7

QDeskSetup1.1.1.6.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows7-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

D3DCompiler_43.dll

windows7-x64

1

D3DCompiler_43.dll

windows10-2004-x64

1

D3DX9_43.dll

windows7-x64

1

D3DX9_43.dll

windows10-2004-x64

1

VMProtectSDK64.dll

windows7-x64

1

VMProtectSDK64.dll

windows10-2004-x64

1

avcodec-58.dll

windows7-x64

1

avcodec-58.dll

windows10-2004-x64

1

avdevice-58.dll

windows7-x64

1

avdevice-58.dll

windows10-2004-x64

1

avfilter-7.dll

windows7-x64

1

avfilter-7.dll

windows10-2004-x64

1

avformat-58.dll

windows7-x64

1

avformat-58.dll

windows10-2004-x64

1

avutil-56.dll

windows7-x64

1

avutil-56.dll

windows10-2004-x64

1

breakpad.dll

windows7-x64

1

breakpad.dll

windows10-2004-x64

1

d3dx11_43.dll

windows7-x64

1

d3dx11_43.dll

windows10-2004-x64

1

driver/devcon.exe

windows10-2004-x64

1

driver/idd...dd.dll

windows10-2004-x64

1

driver/install.bat

windows7-x64

1

driver/install.bat

windows10-2004-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/03/2024, 11:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    driver/install.bat

  • Size

    913B

  • MD5

    e304283c4c158fed4e877bcf1c21df7d

  • SHA1

    2991be31c6a1070acd7f2eea883c3ea2e91d1748

  • SHA256

    931170d763dbbf046aac972d548a182c473957714db63d99133ae65240459916

  • SHA512

    085a96602d5b055dcec3e57799ff89a8f1e3da89434be36e03592ca015ede060bdd4c05201da2126e4c60509f5508a49efe83ec2825a77dd496c6ec3e64be099

Score
8/10

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Drops file in System32 directory 51 IoCs
  • Drops file in Windows directory 17 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 20 IoCs
  • Suspicious use of WriteProcessMemory 46 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\driver\install.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1808
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" ver "
      2⤵
        PID:4532
      • C:\Windows\system32\find.exe
        find "10.0"
        2⤵
          PID:4312
        • C:\Users\Admin\AppData\Local\Temp\driver\devcon.exe
          devcon status Nefarius\ViGEmBus\Gen1
          2⤵
          • Checks SCSI registry key(s)
          PID:4180
        • C:\Windows\system32\findstr.exe
          findstr "Driver is running"
          2⤵
            PID:2768
          • C:\Users\Admin\AppData\Local\Temp\driver\devcon.exe
            devcon remove Nefarius\ViGEmBus\Gen1
            2⤵
            • Checks SCSI registry key(s)
            PID:4520
          • C:\Users\Admin\AppData\Local\Temp\driver\devcon.exe
            devcon install vigem\ViGEmBus.inf Nefarius\ViGEmBus\Gen1
            2⤵
            • Drops file in System32 directory
            • Drops file in Windows directory
            • Checks SCSI registry key(s)
            • Suspicious use of AdjustPrivilegeToken
            PID:5044
          • C:\Users\Admin\AppData\Local\Temp\driver\devcon.exe
            devcon status djpnewton\vmulti
            2⤵
            • Checks SCSI registry key(s)
            PID:4712
          • C:\Windows\system32\findstr.exe
            findstr "Driver is running"
            2⤵
              PID:3424
            • C:\Users\Admin\AppData\Local\Temp\driver\devcon.exe
              devcon status Root\qdeskvhid
              2⤵
              • Checks SCSI registry key(s)
              PID:3360
            • C:\Windows\system32\findstr.exe
              findstr "Driver is running"
              2⤵
                PID:4884
              • C:\Users\Admin\AppData\Local\Temp\driver\devcon.exe
                devcon remove *qdeskvhid*
                2⤵
                • Checks SCSI registry key(s)
                PID:3352
              • C:\Users\Admin\AppData\Local\Temp\driver\devcon.exe
                devcon.exe install qdeskhid\qdeskhid.inf root\qdeskvhid
                2⤵
                • Drops file in System32 directory
                • Drops file in Windows directory
                • Checks SCSI registry key(s)
                • Suspicious use of AdjustPrivilegeToken
                PID:2996
              • C:\Users\Admin\AppData\Local\Temp\driver\devcon.exe
                devcon remove Root\Qdesk\IDD
                2⤵
                • Checks SCSI registry key(s)
                PID:232
              • C:\Users\Admin\AppData\Local\Temp\driver\devcon.exe
                devcon status Root\Qdesk\IDD
                2⤵
                • Checks SCSI registry key(s)
                PID:3124
              • C:\Windows\system32\findstr.exe
                findstr "Driver is running"
                2⤵
                  PID:784
                • C:\Users\Admin\AppData\Local\Temp\driver\devcon.exe
                  devcon remove Root\Qdesk\IDD
                  2⤵
                  • Checks SCSI registry key(s)
                  PID:2100
                • C:\Users\Admin\AppData\Local\Temp\driver\devcon.exe
                  devcon install idd\qdeskidd.inf Root\Qdesk\IDD
                  2⤵
                  • Drops file in System32 directory
                  • Drops file in Windows directory
                  • Checks SCSI registry key(s)
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2832
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
                1⤵
                • Drops file in Windows directory
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:1128
                • C:\Windows\system32\DrvInst.exe
                  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{3850783a-65a7-1f49-820d-a269cbc3d4b0}\vigembus.inf" "9" "429a86e87" "000000000000014C" "WinSta0\Default" "0000000000000158" "208" "c:\users\admin\appdata\local\temp\driver\vigem"
                  2⤵
                  • Drops file in System32 directory
                  • Drops file in Windows directory
                  • Checks SCSI registry key(s)
                  • Modifies data under HKEY_USERS
                  PID:4664
                • C:\Windows\system32\DrvInst.exe
                  DrvInst.exe "2" "211" "ROOT\SYSTEM\0001" "C:\Windows\INF\oem3.inf" "oem3.inf:c14ce88408607219:ViGEmBus_Device:1.17.333.0:nefarius\vigembus\gen1," "429a86e87" "000000000000014C"
                  2⤵
                  • Drops file in Drivers directory
                  • Drops file in System32 directory
                  • Drops file in Windows directory
                  • Checks SCSI registry key(s)
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2672
                • C:\Windows\system32\DrvInst.exe
                  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{d439740c-eeaa-3644-8caf-751a62952425}\qdeskhid.inf" "9" "47099baef" "0000000000000160" "WinSta0\Default" "0000000000000170" "208" "c:\users\admin\appdata\local\temp\driver\qdeskhid"
                  2⤵
                  • Drops file in System32 directory
                  • Drops file in Windows directory
                  • Checks SCSI registry key(s)
                  • Modifies data under HKEY_USERS
                  PID:1712
                • C:\Windows\system32\DrvInst.exe
                  DrvInst.exe "2" "211" "ROOT\USB\0000" "C:\Windows\INF\oem4.inf" "oem4.inf:c14ce884788e99ee:qdeskhid_Device:14.16.37.368:root\qdeskvhid," "47099baef" "0000000000000160"
                  2⤵
                  • Drops file in Drivers directory
                  • Drops file in System32 directory
                  • Drops file in Windows directory
                  • Checks SCSI registry key(s)
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1140
                • C:\Windows\system32\DrvInst.exe
                  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{d06b75cc-d1af-8240-b678-50530b88de90}\qdeskidd.inf" "9" "4f369b2e7" "000000000000014C" "WinSta0\Default" "0000000000000184" "208" "c:\users\admin\appdata\local\temp\driver\idd"
                  2⤵
                  • Drops file in System32 directory
                  • Drops file in Windows directory
                  • Checks SCSI registry key(s)
                  • Modifies data under HKEY_USERS
                  PID:3604
                • C:\Windows\system32\DrvInst.exe
                  DrvInst.exe "2" "211" "ROOT\DISPLAY\0000" "C:\Windows\INF\oem5.inf" "oem5.inf:c14ce8840c48fa1f:Qdeskidd_Install:14.7.32.627:root\qdesk\idd," "4f369b2e7" "000000000000014C"
                  2⤵
                  • Drops file in Drivers directory
                  • Drops file in System32 directory
                  • Drops file in Windows directory
                  • Checks SCSI registry key(s)
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5056

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\{3850783a-65a7-1f49-820d-a269cbc3d4b0}\vigembus.inf
                Filesize

                3KB

                MD5

                cd0027aa0f5a8a47a6596d880f06964b

                SHA1

                167b62bfd7471179cf68cb5b2f83c8365edf4875

                SHA256

                634b032a33cecbf2e43c46c5896a3c359cdda452c632da6396452419ffa301d6

                SHA512

                19563a3fc7d985ee48a158f6f051e5b8ba200a092b2f1e902024aa9c6a8d6f5a6f04b80c8ea0587bd23802dcfd7775a7a625164387ae61ded5124ccea61b8ef9

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\{38507~1\ViGEmBus.cat
                Filesize

                10KB

                MD5

                5312064607460baaa4562aabc42b8922

                SHA1

                c8a0758e5ae7158acb0f6f111ad298fbc0b1a2ae

                SHA256

                58b8a1bf9160fd4310a183b3431580eda2bc0a5ecaac2e0fbd6399184ff02404

                SHA512

                dcfc68f09d339695aa3b8eea02a7adafc21473d259df9d6dd7cbb7d29fb8f3ff9b3184f8921d9f829c665b1447ebec7ce97729914fb7367bf6e07d9fd02d2aba

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\{D06B7~1\qdeskidd.cat
                Filesize

                11KB

                MD5

                0b4ca2c96d0ffcf537cae26f01f3549f

                SHA1

                5321003f5d5d78a69718cc8acfb934f8421353af

                SHA256

                0e2c1794746f2eabc4c92234257eea2a78a77e721285496e73293fe7398e7576

                SHA512

                390c4faec6d28e59f1b8a41f25f662b52b6b2af5d81652fbe3c210762f1e09f4df9b5be064859d9ca73d1d5fbbbccfb311d67b68d6405d96fe21a1c8333474e1

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\{D06B7~1\qdeskidd.dll
                Filesize

                84KB

                MD5

                2d19eb605ca6654666c45739bc467fa3

                SHA1

                ee9d9603d1182b0f41b8dd50c4b502b3d28bf634

                SHA256

                3dc27c2c533fc448bd7d7a3920d11fbe024f7d16464f1f4cd346796a5844b69f

                SHA512

                76b94449a2a13aaf6d27e31d3f415e0de4b96a19c174cb4f2fed1e85ed76f8b157fa5bb46cb26e8d86d9f68480eb26553dfe0a066b1a94944ebfa8c6fad0e20b

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\{D4397~1\qdeskhid.cat
                Filesize

                11KB

                MD5

                2edb6d7fffea227aa245d467ab67cd84

                SHA1

                9eabb481ffb0a69512cb83907eccb1efcf54c5c2

                SHA256

                3dc91a3305343ae255155f509e4f3f1459437e4ad23845e252a859ac960dbcaa

                SHA512

                cbba4116061657f43089adff9412733aa88d3c3bbce7102ffc1fc444adcb09d66bf9aee432a82f0f2004977a26a9e68360101afffcc72fc1ac352a0208174ffb

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\{D4397~1\qdeskhid.sys
                Filesize

                41KB

                MD5

                a01c1724eaf4354517f402cb547a11cc

                SHA1

                3e523541cfc40a127935b0f3dfbdfa2e47638ab0

                SHA256

                f9eb3f77e7a876dff81b9e7e524dff7b7de9c716999af506711d6b3008d1cdf6

                SHA512

                9cc9a46907630da21623866e1575aea7776ca1a954f2543fe250e42bd942ff59eeec1237aeddd9ae63beeace47609e54b94940b6c8969c8b17efc173ad0198bd

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\{d06b75cc-d1af-8240-b678-50530b88de90}\qdeskidd.inf
                Filesize

                3KB

                MD5

                32aeac7446d7f80b11b01fc7df1728e3

                SHA1

                7066aa82f02b4ed2509417903b24a5f837e73082

                SHA256

                bb3f1a3243059e8d9234b278e95003e7e0ac8979f4ba2a84fffc170224203f7a

                SHA512

                53a3445e43b686d51a6b60339ee0d2b4576fab3f13ef3da681a09c390f68e656e6a6262b0f21b6496e2c8652f5ac875f2ce9b76fbdd7b4c6fdeb99d209636444

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\{d439740c-eeaa-3644-8caf-751a62952425}\qdeskhid.inf
                Filesize

                2KB

                MD5

                093d3cf4ade07e5d08f1d04eaf9807b9

                SHA1

                3a7e261c61727281beb6efb583abb27b3b7d71a3

                SHA256

                71eef0e27bd7d25079353e889d62d4f096b4c51fa3ff6cffa9404c101aac7431

                SHA512

                9e5784bc4595352cbe68842fa840a4734fd04786a5dd5c81e50effe4d9f2fa2ca48e3ae0a348786a75d053b64cf506364223900619fb2c2ead737a8eefefa5ba

                Download Submit

              • C:\Windows\System32\CatRoot2\dberr.txt
                Filesize

                19KB

                MD5

                23279383157406c996419d943a14fdba

                SHA1

                f6c7da4b1162338fd603b4009147c4c4a22183cd

                SHA256

                e200329d0adb21e5a622329569e9895155275ee4cb0cfb1cf018623effc95493

                SHA512

                cc8ff162f774d75266dc0e649eb94760645027b97db87f56d0d0f5efa6a676cd7b689d0632c6e7b699c510d44f237340bdb23c9e64635efa5fdbb2ab9c023e12

                Download Submit

              • C:\Windows\System32\CatRoot2\dberr.txt
                Filesize

                19KB

                MD5

                161d2c67f89b106d07ab0ba89a462c43

                SHA1

                16a24e3acd2708a7698431cf9a7383e5e61fd3c3

                SHA256

                13325c1d5650d750ab008d635e9205a8b45d22c98cfc1ac260d0e21fdfa55124

                SHA512

                35676d5e0317ff44d6c43b96bb47bc721dd8274ad36e3cb2e7bc52675a2bdeb6345771d88c0d10ee80585493df9ee5b07fb7a8aff0160e4e97c482e771a6d572

                Download Submit

              • C:\Windows\System32\DriverStore\Temp\{77041586-67a4-804e-a683-aba8988d386f}\SET3961.tmp
                Filesize

                161KB

                MD5

                87fe350c6ffe8d60ce58dbc16a2d091e

                SHA1

                7e2727a31c54df2fe4fba73a6b0537afa5faf534

                SHA256

                8fb8402b7266fa9b9ea8841708317c8c25367b2947eeda9b6462c0e4801f05a4

                SHA512

                f892b87a8d45ddb14a99e736eff26f7257c492dade5754362acf4d2522927c337dd3d6ec4d47b0553681764e5cf15db61f8a96098889a7b5a56c052b53dced63

                Download Submit