Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3X2 2021 20...al.zip
windows11-21h2-x64
1X2 2021 Of...Bin.db
windows11-21h2-x64
3X2 2021 Of...in.dll
windows11-21h2-x64
3X2 2021 Of...rm.dll
windows11-21h2-x64
3X2 2021 Of...21.exe
windows11-21h2-x64
1X2 2021 Of...23.exe
windows11-21h2-x64
10X2 2021 Of...2A.exp
windows11-21h2-x64
3X2 2021 Of...2A.lib
windows11-21h2-x64
3X2 2021 Of...2A.pdb
windows11-21h2-x64
3X2 2021 Of...ns.exe
windows11-21h2-x64
1X2 2021 Of...mp.dat
windows11-21h2-x64
3X2 2021 Of...ac.zip
windows11-21h2-x64
1src/MacGyv...et.cap
windows11-21h2-x64
3src/MacGyv...ss.cap
windows11-21h2-x64
3src/MacGyv...ol.cap
windows11-21h2-x64
3src/MacGyv...or.cap
windows11-21h2-x64
3src/MacGyv...ry.cap
windows11-21h2-x64
3src/MacGyv...er.cap
windows11-21h2-x64
3src/MacGyv...rt.cap
windows11-21h2-x64
3src/MacGyv...od.cap
windows11-21h2-x64
3src/MacGyv...on.cap
windows11-21h2-x64
3src/MacGyv...ld.cap
windows11-21h2-x64
3X2 2021 Of...c2.zip
windows11-21h2-x64
1main/javac...et.cap
windows11-21h2-x64
3main/javac...ss.cap
windows11-21h2-x64
3main/javac...ol.cap
windows11-21h2-x64
3main/javac...ug.cap
windows11-21h2-x64
3main/javac...or.cap
windows11-21h2-x64
3main/javac...ry.cap
windows11-21h2-x64
3main/javac...er.cap
windows11-21h2-x64
3X2 2021 Of...e3.dll
windows11-21h2-x64
3X2 2021 Of...b1.dll
windows11-21h2-x64
3Analysis
-
max time kernel
453s -
max time network
1179s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
04/04/2024, 20:32
Static task
static1
Behavioral task
behavioral1
Sample
X2 2021 2023 Official.zip
Resource
win11-20240221-en
Behavioral task
behavioral2
Sample
X2 2021 Official/Bin.db
Resource
win11-20240221-en
Behavioral task
behavioral3
Sample
X2 2021 Official/GPPcScConnectionPlugin.dll
Resource
win11-20240214-en
Behavioral task
behavioral4
Sample
X2 2021 Official/GlobalPlatform.dll
Resource
win11-20240221-en
Behavioral task
behavioral5
Sample
X2 2021 Official/X2 2021.exe
Resource
win11-20240221-en
Behavioral task
behavioral6
Sample
X2 2021 Official/X2 2023.exe
Resource
win11-20240221-en
Behavioral task
behavioral7
Sample
X2 2021 Official/X2A.exp
Resource
win11-20240221-en
Behavioral task
behavioral8
Sample
X2 2021 Official/X2A.lib
Resource
win11-20240221-en
Behavioral task
behavioral9
Sample
X2 2021 Official/X2A.pdb
Resource
win11-20240221-en
Behavioral task
behavioral10
Sample
X2 2021 Official/bins.exe
Resource
win11-20240214-en
Behavioral task
behavioral11
Sample
X2 2021 Official/cardtemp.dat
Resource
win11-20240221-en
Behavioral task
behavioral12
Sample
X2 2021 Official/mac.zip
Resource
win11-20240221-en
Behavioral task
behavioral13
Sample
src/MacGyver/javacard/Applet.cap
Resource
win11-20240221-en
Behavioral task
behavioral14
Sample
src/MacGyver/javacard/Class.cap
Resource
win11-20240221-en
Behavioral task
behavioral15
Sample
src/MacGyver/javacard/ConstantPool.cap
Resource
win11-20240221-en
Behavioral task
behavioral16
Sample
src/MacGyver/javacard/Descriptor.cap
Resource
win11-20240221-en
Behavioral task
behavioral17
Sample
src/MacGyver/javacard/Directory.cap
Resource
win11-20240221-en
Behavioral task
behavioral18
Sample
src/MacGyver/javacard/Header.cap
Resource
win11-20240221-en
Behavioral task
behavioral19
Sample
src/MacGyver/javacard/Import.cap
Resource
win11-20240214-en
Behavioral task
behavioral20
Sample
src/MacGyver/javacard/Method.cap
Resource
win11-20240221-en
Behavioral task
behavioral21
Sample
src/MacGyver/javacard/RefLocation.cap
Resource
win11-20240221-en
Behavioral task
behavioral22
Sample
src/MacGyver/javacard/StaticField.cap
Resource
win11-20240319-en
Behavioral task
behavioral23
Sample
X2 2021 Official/mac2.zip
Resource
win11-20240221-en
Behavioral task
behavioral24
Sample
main/javacard/Applet.cap
Resource
win11-20240221-en
Behavioral task
behavioral25
Sample
main/javacard/Class.cap
Resource
win11-20240221-en
Behavioral task
behavioral26
Sample
main/javacard/ConstantPool.cap
Resource
win11-20240221-en
Behavioral task
behavioral27
Sample
main/javacard/Debug.cap
Resource
win11-20240221-en
Behavioral task
behavioral28
Sample
main/javacard/Descriptor.cap
Resource
win11-20240221-en
Behavioral task
behavioral29
Sample
main/javacard/Directory.cap
Resource
win11-20240221-en
Behavioral task
behavioral30
Sample
main/javacard/Header.cap
Resource
win11-20240221-en
Behavioral task
behavioral31
Sample
X2 2021 Official/sqlite3.dll
Resource
win11-20240221-en
Behavioral task
behavioral32
Sample
X2 2021 Official/zlib1.dll
Resource
win11-20240221-en
General
-
Target
X2 2021 Official/GlobalPlatform.dll
-
Size
767KB
-
MD5
4696b9fae32c96d487daa887d830261b
-
SHA1
e01f46ed39108d0fb7b57d7ec50fc688fbceb72b
-
SHA256
d516e641e63f4195c374ecedbee074c345af178d703fa0761c990141e056b992
-
SHA512
0b31bed9e8003ea915013d16561557d46e0ae6e7809d578e27f91dc346379cb47c3f2e50d815f3f49f8135eee5ca72693984eec428137eea2f77e581d1bfb7ac
-
SSDEEP
12288:tFmm3ESOWLzt9+5uxqUHudv3p6hUhJO4NdKVAZD53pqYK6oKs:Dx3ESM5uxqUHuJDhJO4n4AZ93pqYK6oJ
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4692 4832 WerFault.exe 76 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4624 wrote to memory of 4832 4624 rundll32.exe 76 PID 4624 wrote to memory of 4832 4624 rundll32.exe 76 PID 4624 wrote to memory of 4832 4624 rundll32.exe 76
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\X2 2021 Official\GlobalPlatform.dll",#11⤵
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\X2 2021 Official\GlobalPlatform.dll",#12⤵PID:4832
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 4763⤵
- Program crash
PID:4692
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4832 -ip 48321⤵PID:3252