Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

GalaxiaViva.exe

windows7-x64

7

GalaxiaViva.exe

windows10-2004-x64

7

$PLUGINSDI...ls.dll

windows7-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDIR/app-64.7z

windows7-x64

3

$PLUGINSDIR/app-64.7z

windows10-2004-x64

7

Installer.exe

windows7-x64

7

Installer.exe

windows10-2004-x64

7

LICENSES.c...m.html

windows7-x64

1

LICENSES.c...m.html

windows10-2004-x64

1

chrome_100...nt.pak

windows7-x64

3

chrome_100...nt.pak

windows10-2004-x64

3

chrome_200...nt.pak

windows7-x64

3

chrome_200...nt.pak

windows10-2004-x64

3

d3dcompiler_47.dll

windows10-2004-x64

1

ffmpeg.dll

windows7-x64

1

ffmpeg.dll

windows10-2004-x64

1

libEGL.dll

windows7-x64

1

libEGL.dll

windows10-2004-x64

1

libGLESv2.dll

windows7-x64

1

libGLESv2.dll

windows10-2004-x64

1

locales/de.ps1

windows7-x64

1

locales/de.ps1

windows10-2004-x64

1

resources/elevate.exe

windows7-x64

1

resources/elevate.exe

windows10-2004-x64

1

vk_swiftshader.dll

windows7-x64

1

vk_swiftshader.dll

windows10-2004-x64

1

vulkan-1.dll

windows7-x64

1

vulkan-1.dll

windows10-2004-x64

1

$PLUGINSDI...7z.dll

windows7-x64

3

Resubmissions

09/04/2024, 22:11

240409-131wtaea38 8

09/04/2024, 21:43

240409-1k5r2scg65 7

09/04/2024, 21:18

240409-z5mxasbe59 7

06/04/2024, 10:55

240406-mz7nashc59 8

06/04/2024, 10:41

240406-mrjaqsgd6z 7

Analysis

  • max time kernel
    974s
  • max time network
    983s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/04/2024, 21:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Installer.exe

  • Size

    147.0MB

  • MD5

    2fcb65fc8b2bc9505da8dd94033cc7ad

  • SHA1

    ff12916a1d57eb26d9e5856d91c450b155a35f65

  • SHA256

    708543f3ca34ffe8e4d33c09560d4e190fe35bd2aa7a57369291174d537ffc32

  • SHA512

    4927ede0dead3f947513add783a150245185ae1872b0f59d8159448423b33e636956e69b8278c37f62dd9a6a4ca59247f83beea4d59d1a6832ce5ce4533ed585

  • SSDEEP

    1572864:EgGRqQdeZ4K5M0PmL0g6dKXPRYGO1QwOVnMKVbmd6LpL28nHQ5OneFBlwb:OV6msmCUhN4lS

Score
7/10
spywarestealer

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks processor information in registry 2 TTPs 7 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 46 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\Installer.exe"
    1⤵
    • Loads dropped DLL
    • Checks processor information in registry
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1856
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "tasklist"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3676
      • C:\Windows\system32\tasklist.exe
        tasklist
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:4968
    • C:\Users\Admin\AppData\Local\Temp\Installer.exe
      "C:\Users\Admin\AppData\Local\Temp\Installer.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\game" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1804 --field-trial-handle=1836,i,6418798356451950013,3660861732923458390,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      2⤵
        PID:3704
      • C:\Users\Admin\AppData\Local\Temp\Installer.exe
        "C:\Users\Admin\AppData\Local\Temp\Installer.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\game" --mojo-platform-channel-handle=2104 --field-trial-handle=1836,i,6418798356451950013,3660861732923458390,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
        2⤵
          PID:2728
        • C:\Users\Admin\AppData\Local\Temp\Installer.exe
          "C:\Users\Admin\AppData\Local\Temp\Installer.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\game" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1684 --field-trial-handle=1836,i,6418798356451950013,3660861732923458390,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3128

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\159ece27-5856-4c86-a28f-4161d5781c25.tmp.node
        Filesize

        1.8MB

        MD5

        beb8d911d40e8fe94770d9d341e0de11

        SHA1

        d24d31e5b44a4a80969e2a669fb9b0ed42cfd479

        SHA256

        ec41fc2fee2abcbf0559965501f54aae47cff24a87204fd3a85d86c7d53d53c7

        SHA512

        079c43c2533fa35411247dd091c5caedb4a0dbdeee7b8f9fbbba6f521d760856822d373f1e6682eff10bebc63168cb4a445aee7b23047e4d784ab28891d07bfe

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\3f0cc9db-b099-4991-a7eb-23e7dc634ed8.tmp.node
        Filesize

        654KB

        MD5

        36e0027f9e250df48c14d0c46cc69df7

        SHA1

        8c8c4dd7725a0ec877541d48ed5ceda97d8a3bd1

        SHA256

        1f6a635c64ef5e04826545b78d4796f2f00493c7fd7b06c9cdea956fd71afeaf

        SHA512

        eba9d6dfe72a7d606159a30968627f6bee22f81f00c722d40058ab6c880c880e040fb9f418e5154f30f20f5f8c9254c3ed9cfa93ea1f2eefa9b5d7ed4e9fea84

        Download Submit

      • memory/3128-45-0x000002CF77340000-0x000002CF77341000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3128-38-0x000002CF77340000-0x000002CF77341000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3128-39-0x000002CF77340000-0x000002CF77341000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3128-40-0x000002CF77340000-0x000002CF77341000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3128-44-0x000002CF77340000-0x000002CF77341000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3128-47-0x000002CF77340000-0x000002CF77341000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3128-48-0x000002CF77340000-0x000002CF77341000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3128-46-0x000002CF77340000-0x000002CF77341000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3128-50-0x000002CF77340000-0x000002CF77341000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3128-49-0x000002CF77340000-0x000002CF77341000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3704-11-0x00007FFCC3A30000-0x00007FFCC3A31000-memory.dmp

        Filesize

        4KB

        Download