Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3X2 2021 20...al.zip
windows11-21h2-x64
1X2 2021 Of...Bin.db
windows11-21h2-x64
3X2 2021 Of...in.dll
windows11-21h2-x64
3X2 2021 Of...rm.dll
windows11-21h2-x64
3X2 2021 Of...21.exe
windows11-21h2-x64
1X2 2021 Of...23.exe
windows11-21h2-x64
10X2 2021 Of...2A.exp
windows11-21h2-x64
3X2 2021 Of...2A.lib
windows11-21h2-x64
3X2 2021 Of...2A.pdb
windows11-21h2-x64
3X2 2021 Of...ns.exe
windows11-21h2-x64
1X2 2021 Of...mp.dat
windows11-21h2-x64
3X2 2021 Of...ac.zip
windows11-21h2-x64
1src/MacGyv...et.cap
windows11-21h2-x64
3src/MacGyv...ss.cap
windows11-21h2-x64
3src/MacGyv...ol.cap
windows11-21h2-x64
3src/MacGyv...or.cap
windows11-21h2-x64
3src/MacGyv...ry.cap
windows11-21h2-x64
3src/MacGyv...er.cap
windows11-21h2-x64
3src/MacGyv...rt.cap
windows11-21h2-x64
3src/MacGyv...od.cap
windows11-21h2-x64
3src/MacGyv...on.cap
windows11-21h2-x64
3src/MacGyv...ld.cap
windows11-21h2-x64
3X2 2021 Of...c2.zip
windows11-21h2-x64
1main/javac...et.cap
windows11-21h2-x64
3main/javac...ss.cap
windows11-21h2-x64
3main/javac...ol.cap
windows11-21h2-x64
3main/javac...ug.cap
windows11-21h2-x64
3main/javac...or.cap
windows11-21h2-x64
3main/javac...ry.cap
windows11-21h2-x64
3main/javac...er.cap
windows11-21h2-x64
3X2 2021 Of...e3.dll
windows11-21h2-x64
3X2 2021 Of...b1.dll
windows11-21h2-x64
3Analysis
-
max time kernel
452s -
max time network
1179s -
platform
windows11-21h2_x64 -
resource
win11-20240214-en -
resource tags
arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system -
submitted
04/04/2024, 20:32
Static task
static1
Behavioral task
behavioral1
Sample
X2 2021 2023 Official.zip
Resource
win11-20240221-en
Behavioral task
behavioral2
Sample
X2 2021 Official/Bin.db
Resource
win11-20240221-en
Behavioral task
behavioral3
Sample
X2 2021 Official/GPPcScConnectionPlugin.dll
Resource
win11-20240214-en
Behavioral task
behavioral4
Sample
X2 2021 Official/GlobalPlatform.dll
Resource
win11-20240221-en
Behavioral task
behavioral5
Sample
X2 2021 Official/X2 2021.exe
Resource
win11-20240221-en
Behavioral task
behavioral6
Sample
X2 2021 Official/X2 2023.exe
Resource
win11-20240221-en
Behavioral task
behavioral7
Sample
X2 2021 Official/X2A.exp
Resource
win11-20240221-en
Behavioral task
behavioral8
Sample
X2 2021 Official/X2A.lib
Resource
win11-20240221-en
Behavioral task
behavioral9
Sample
X2 2021 Official/X2A.pdb
Resource
win11-20240221-en
Behavioral task
behavioral10
Sample
X2 2021 Official/bins.exe
Resource
win11-20240214-en
Behavioral task
behavioral11
Sample
X2 2021 Official/cardtemp.dat
Resource
win11-20240221-en
Behavioral task
behavioral12
Sample
X2 2021 Official/mac.zip
Resource
win11-20240221-en
Behavioral task
behavioral13
Sample
src/MacGyver/javacard/Applet.cap
Resource
win11-20240221-en
Behavioral task
behavioral14
Sample
src/MacGyver/javacard/Class.cap
Resource
win11-20240221-en
Behavioral task
behavioral15
Sample
src/MacGyver/javacard/ConstantPool.cap
Resource
win11-20240221-en
Behavioral task
behavioral16
Sample
src/MacGyver/javacard/Descriptor.cap
Resource
win11-20240221-en
Behavioral task
behavioral17
Sample
src/MacGyver/javacard/Directory.cap
Resource
win11-20240221-en
Behavioral task
behavioral18
Sample
src/MacGyver/javacard/Header.cap
Resource
win11-20240221-en
Behavioral task
behavioral19
Sample
src/MacGyver/javacard/Import.cap
Resource
win11-20240214-en
Behavioral task
behavioral20
Sample
src/MacGyver/javacard/Method.cap
Resource
win11-20240221-en
Behavioral task
behavioral21
Sample
src/MacGyver/javacard/RefLocation.cap
Resource
win11-20240221-en
Behavioral task
behavioral22
Sample
src/MacGyver/javacard/StaticField.cap
Resource
win11-20240319-en
Behavioral task
behavioral23
Sample
X2 2021 Official/mac2.zip
Resource
win11-20240221-en
Behavioral task
behavioral24
Sample
main/javacard/Applet.cap
Resource
win11-20240221-en
Behavioral task
behavioral25
Sample
main/javacard/Class.cap
Resource
win11-20240221-en
Behavioral task
behavioral26
Sample
main/javacard/ConstantPool.cap
Resource
win11-20240221-en
Behavioral task
behavioral27
Sample
main/javacard/Debug.cap
Resource
win11-20240221-en
Behavioral task
behavioral28
Sample
main/javacard/Descriptor.cap
Resource
win11-20240221-en
Behavioral task
behavioral29
Sample
main/javacard/Directory.cap
Resource
win11-20240221-en
Behavioral task
behavioral30
Sample
main/javacard/Header.cap
Resource
win11-20240221-en
Behavioral task
behavioral31
Sample
X2 2021 Official/sqlite3.dll
Resource
win11-20240221-en
Behavioral task
behavioral32
Sample
X2 2021 Official/zlib1.dll
Resource
win11-20240221-en
General
-
Target
X2 2021 Official/GPPcScConnectionPlugin.dll
-
Size
12KB
-
MD5
d65463fc8a37261b6bf5afbc4139bdd5
-
SHA1
954076a2b56da1ff82eebe0c0c287110137f7cb1
-
SHA256
789734bbab7b606e27fab43f4706250399108dba98e4428d1b95589db0a42ea2
-
SHA512
cd3673e1feb07dfc86a33d499cddf7f34368bcacbbe8207826b81f9a96d9ebc74e7455170e195ae316785b42dcc871f842dfa1d0949df9f77e8738b8906339b0
-
SSDEEP
192:udqzHW3G3Vxv3bV/4DaRWu1Fh8+5FseTqt1emjQjA11Tml3X+EqEvaKGZ:udqzHW3G3DvbV/4Daw27vtTqtQU1xm5D
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 3796 4908 WerFault.exe 77 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4028 wrote to memory of 4908 4028 rundll32.exe 77 PID 4028 wrote to memory of 4908 4028 rundll32.exe 77 PID 4028 wrote to memory of 4908 4028 rundll32.exe 77
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\X2 2021 Official\GPPcScConnectionPlugin.dll",#11⤵
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\X2 2021 Official\GPPcScConnectionPlugin.dll",#12⤵PID:4908
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 4883⤵
- Program crash
PID:3796
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4908 -ip 49081⤵PID:1908