Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3GalaxiaViva.exe
windows7-x64
7GalaxiaViva.exe
windows10-2004-x64
7$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/app-64.7z
windows7-x64
3$PLUGINSDIR/app-64.7z
windows10-2004-x64
7Installer.exe
windows7-x64
7Installer.exe
windows10-2004-x64
7LICENSES.c...m.html
windows7-x64
1LICENSES.c...m.html
windows10-2004-x64
1chrome_100...nt.pak
windows7-x64
3chrome_100...nt.pak
windows10-2004-x64
3chrome_200...nt.pak
windows7-x64
3chrome_200...nt.pak
windows10-2004-x64
3d3dcompiler_47.dll
windows10-2004-x64
1ffmpeg.dll
windows7-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows7-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows7-x64
1libGLESv2.dll
windows10-2004-x64
1locales/de.ps1
windows7-x64
1locales/de.ps1
windows10-2004-x64
1resources/elevate.exe
windows7-x64
1resources/elevate.exe
windows10-2004-x64
1vk_swiftshader.dll
windows7-x64
1vk_swiftshader.dll
windows10-2004-x64
1vulkan-1.dll
windows7-x64
1vulkan-1.dll
windows10-2004-x64
1$PLUGINSDI...7z.dll
windows7-x64
3Resubmissions
09/04/2024, 22:11
240409-131wtaea38 809/04/2024, 21:43
240409-1k5r2scg65 709/04/2024, 21:18
240409-z5mxasbe59 706/04/2024, 10:55
240406-mz7nashc59 806/04/2024, 10:41
240406-mrjaqsgd6z 7Analysis
-
max time kernel
278s -
max time network
1013s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
09/04/2024, 21:18
Static task
static1
Behavioral task
behavioral1
Sample
GalaxiaViva.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
GalaxiaViva.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/app-64.7z
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/app-64.7z
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
Installer.exe
Resource
win7-20231129-en
Behavioral task
behavioral10
Sample
Installer.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
LICENSES.chromium.html
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
LICENSES.chromium.html
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
chrome_100_percent.pak
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
chrome_100_percent.pak
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
chrome_200_percent.pak
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
chrome_200_percent.pak
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
d3dcompiler_47.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral18
Sample
ffmpeg.dll
Resource
win7-20240221-en
Behavioral task
behavioral19
Sample
ffmpeg.dll
Resource
win10v2004-20240319-en
Behavioral task
behavioral20
Sample
libEGL.dll
Resource
win7-20240221-en
Behavioral task
behavioral21
Sample
libEGL.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral22
Sample
libGLESv2.dll
Resource
win7-20240221-en
Behavioral task
behavioral23
Sample
libGLESv2.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral24
Sample
locales/de.ps1
Resource
win7-20231129-en
Behavioral task
behavioral25
Sample
locales/de.ps1
Resource
win10v2004-20240226-en
Behavioral task
behavioral26
Sample
resources/elevate.exe
Resource
win7-20240221-en
Behavioral task
behavioral27
Sample
resources/elevate.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral28
Sample
vk_swiftshader.dll
Resource
win7-20240319-en
Behavioral task
behavioral29
Sample
vk_swiftshader.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral30
Sample
vulkan-1.dll
Resource
win7-20240221-en
Behavioral task
behavioral31
Sample
vulkan-1.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral32
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win7-20240221-en
General
-
Target
Installer.exe
-
Size
147.0MB
-
MD5
2fcb65fc8b2bc9505da8dd94033cc7ad
-
SHA1
ff12916a1d57eb26d9e5856d91c450b155a35f65
-
SHA256
708543f3ca34ffe8e4d33c09560d4e190fe35bd2aa7a57369291174d537ffc32
-
SHA512
4927ede0dead3f947513add783a150245185ae1872b0f59d8159448423b33e636956e69b8278c37f62dd9a6a4ca59247f83beea4d59d1a6832ce5ce4533ed585
-
SSDEEP
1572864:EgGRqQdeZ4K5M0PmL0g6dKXPRYGO1QwOVnMKVbmd6LpL28nHQ5OneFBlwb:OV6msmCUhN4lS
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
pid Process 2988 Installer.exe 2988 Installer.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks processor information in registry 2 TTPs 7 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Installer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Installer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Installer.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 Installer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz Installer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString Installer.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 Installer.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 2672 tasklist.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2988 Installer.exe 2988 Installer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2672 tasklist.exe Token: SeShutdownPrivilege 2988 Installer.exe Token: SeShutdownPrivilege 2988 Installer.exe Token: SeShutdownPrivilege 2988 Installer.exe Token: SeShutdownPrivilege 2988 Installer.exe Token: SeShutdownPrivilege 2988 Installer.exe Token: SeShutdownPrivilege 2988 Installer.exe Token: SeShutdownPrivilege 2988 Installer.exe Token: SeShutdownPrivilege 2988 Installer.exe Token: SeShutdownPrivilege 2988 Installer.exe Token: SeShutdownPrivilege 2988 Installer.exe Token: SeShutdownPrivilege 2988 Installer.exe Token: SeShutdownPrivilege 2988 Installer.exe Token: SeShutdownPrivilege 2988 Installer.exe Token: SeShutdownPrivilege 2988 Installer.exe Token: SeShutdownPrivilege 2988 Installer.exe Token: SeShutdownPrivilege 2988 Installer.exe Token: SeShutdownPrivilege 2988 Installer.exe Token: SeShutdownPrivilege 2988 Installer.exe Token: SeShutdownPrivilege 2988 Installer.exe Token: SeShutdownPrivilege 2988 Installer.exe Token: SeShutdownPrivilege 2988 Installer.exe Token: SeShutdownPrivilege 2988 Installer.exe Token: SeShutdownPrivilege 2988 Installer.exe Token: SeShutdownPrivilege 2988 Installer.exe Token: SeShutdownPrivilege 2988 Installer.exe Token: SeShutdownPrivilege 2988 Installer.exe Token: SeShutdownPrivilege 2988 Installer.exe Token: SeShutdownPrivilege 2988 Installer.exe Token: SeShutdownPrivilege 2988 Installer.exe Token: SeShutdownPrivilege 2988 Installer.exe Token: SeShutdownPrivilege 2988 Installer.exe Token: SeShutdownPrivilege 2988 Installer.exe Token: SeShutdownPrivilege 2988 Installer.exe Token: SeShutdownPrivilege 2988 Installer.exe Token: SeShutdownPrivilege 2988 Installer.exe Token: SeShutdownPrivilege 2988 Installer.exe Token: SeShutdownPrivilege 2988 Installer.exe Token: SeShutdownPrivilege 2988 Installer.exe Token: SeShutdownPrivilege 2988 Installer.exe Token: SeShutdownPrivilege 2988 Installer.exe Token: SeShutdownPrivilege 2988 Installer.exe Token: SeShutdownPrivilege 2988 Installer.exe Token: SeShutdownPrivilege 2988 Installer.exe Token: SeShutdownPrivilege 2988 Installer.exe Token: SeShutdownPrivilege 2988 Installer.exe Token: SeShutdownPrivilege 2988 Installer.exe Token: SeShutdownPrivilege 2988 Installer.exe Token: SeShutdownPrivilege 2988 Installer.exe Token: SeShutdownPrivilege 2988 Installer.exe Token: SeShutdownPrivilege 2988 Installer.exe Token: SeShutdownPrivilege 2988 Installer.exe Token: SeShutdownPrivilege 2988 Installer.exe Token: SeShutdownPrivilege 2988 Installer.exe Token: SeShutdownPrivilege 2988 Installer.exe Token: SeShutdownPrivilege 2988 Installer.exe Token: SeShutdownPrivilege 2988 Installer.exe Token: SeShutdownPrivilege 2988 Installer.exe Token: SeShutdownPrivilege 2988 Installer.exe Token: SeShutdownPrivilege 2988 Installer.exe Token: SeShutdownPrivilege 2988 Installer.exe Token: SeShutdownPrivilege 2988 Installer.exe Token: SeShutdownPrivilege 2988 Installer.exe Token: SeShutdownPrivilege 2988 Installer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2988 wrote to memory of 3052 2988 Installer.exe 28 PID 2988 wrote to memory of 3052 2988 Installer.exe 28 PID 2988 wrote to memory of 3052 2988 Installer.exe 28 PID 3052 wrote to memory of 2672 3052 cmd.exe 30 PID 3052 wrote to memory of 2672 3052 cmd.exe 30 PID 3052 wrote to memory of 2672 3052 cmd.exe 30 PID 2988 wrote to memory of 2196 2988 Installer.exe 32 PID 2988 wrote to memory of 2196 2988 Installer.exe 32 PID 2988 wrote to memory of 2196 2988 Installer.exe 32 PID 2988 wrote to memory of 2196 2988 Installer.exe 32 PID 2988 wrote to memory of 2196 2988 Installer.exe 32 PID 2988 wrote to memory of 2196 2988 Installer.exe 32 PID 2988 wrote to memory of 2196 2988 Installer.exe 32 PID 2988 wrote to memory of 2196 2988 Installer.exe 32 PID 2988 wrote to memory of 2196 2988 Installer.exe 32 PID 2988 wrote to memory of 2196 2988 Installer.exe 32 PID 2988 wrote to memory of 2196 2988 Installer.exe 32 PID 2988 wrote to memory of 2196 2988 Installer.exe 32 PID 2988 wrote to memory of 2196 2988 Installer.exe 32 PID 2988 wrote to memory of 2196 2988 Installer.exe 32 PID 2988 wrote to memory of 2196 2988 Installer.exe 32 PID 2988 wrote to memory of 2196 2988 Installer.exe 32 PID 2988 wrote to memory of 2196 2988 Installer.exe 32 PID 2988 wrote to memory of 2196 2988 Installer.exe 32 PID 2988 wrote to memory of 2196 2988 Installer.exe 32 PID 2988 wrote to memory of 2196 2988 Installer.exe 32 PID 2988 wrote to memory of 2196 2988 Installer.exe 32 PID 2988 wrote to memory of 2196 2988 Installer.exe 32 PID 2988 wrote to memory of 2196 2988 Installer.exe 32 PID 2988 wrote to memory of 2196 2988 Installer.exe 32 PID 2988 wrote to memory of 2196 2988 Installer.exe 32 PID 2988 wrote to memory of 2196 2988 Installer.exe 32 PID 2988 wrote to memory of 2196 2988 Installer.exe 32 PID 2988 wrote to memory of 2196 2988 Installer.exe 32 PID 2988 wrote to memory of 2196 2988 Installer.exe 32 PID 2988 wrote to memory of 2196 2988 Installer.exe 32 PID 2988 wrote to memory of 2196 2988 Installer.exe 32 PID 2988 wrote to memory of 2196 2988 Installer.exe 32 PID 2988 wrote to memory of 2196 2988 Installer.exe 32 PID 2988 wrote to memory of 2196 2988 Installer.exe 32 PID 2988 wrote to memory of 2196 2988 Installer.exe 32 PID 2988 wrote to memory of 2196 2988 Installer.exe 32 PID 2988 wrote to memory of 2196 2988 Installer.exe 32 PID 2988 wrote to memory of 2196 2988 Installer.exe 32 PID 2988 wrote to memory of 2196 2988 Installer.exe 32 PID 2988 wrote to memory of 1332 2988 Installer.exe 33 PID 2988 wrote to memory of 1332 2988 Installer.exe 33 PID 2988 wrote to memory of 1332 2988 Installer.exe 33 PID 2988 wrote to memory of 1876 2988 Installer.exe 34 PID 2988 wrote to memory of 1876 2988 Installer.exe 34 PID 2988 wrote to memory of 1876 2988 Installer.exe 34 PID 2988 wrote to memory of 1876 2988 Installer.exe 34 PID 2988 wrote to memory of 1876 2988 Installer.exe 34 PID 2988 wrote to memory of 1876 2988 Installer.exe 34 PID 2988 wrote to memory of 1876 2988 Installer.exe 34 PID 2988 wrote to memory of 1876 2988 Installer.exe 34 PID 2988 wrote to memory of 1876 2988 Installer.exe 34 PID 2988 wrote to memory of 1876 2988 Installer.exe 34 PID 2988 wrote to memory of 1876 2988 Installer.exe 34 PID 2988 wrote to memory of 1876 2988 Installer.exe 34 PID 2988 wrote to memory of 1876 2988 Installer.exe 34 PID 2988 wrote to memory of 1876 2988 Installer.exe 34 PID 2988 wrote to memory of 1876 2988 Installer.exe 34 PID 2988 wrote to memory of 1876 2988 Installer.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\Installer.exe"C:\Users\Admin\AppData\Local\Temp\Installer.exe"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2672
-
-
-
C:\Users\Admin\AppData\Local\Temp\Installer.exe"C:\Users\Admin\AppData\Local\Temp\Installer.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\game" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1204 --field-trial-handle=1252,i,9839005242124597097,8254329196431629460,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵PID:2196
-
-
C:\Users\Admin\AppData\Local\Temp\Installer.exe"C:\Users\Admin\AppData\Local\Temp\Installer.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\game" --mojo-platform-channel-handle=1540 --field-trial-handle=1252,i,9839005242124597097,8254329196431629460,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:82⤵PID:1332
-
-
C:\Users\Admin\AppData\Local\Temp\Installer.exe"C:\Users\Admin\AppData\Local\Temp\Installer.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\game" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1552 --field-trial-handle=1252,i,9839005242124597097,8254329196431629460,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵PID:1876
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD5beb8d911d40e8fe94770d9d341e0de11
SHA1d24d31e5b44a4a80969e2a669fb9b0ed42cfd479
SHA256ec41fc2fee2abcbf0559965501f54aae47cff24a87204fd3a85d86c7d53d53c7
SHA512079c43c2533fa35411247dd091c5caedb4a0dbdeee7b8f9fbbba6f521d760856822d373f1e6682eff10bebc63168cb4a445aee7b23047e4d784ab28891d07bfe
-
Filesize
654KB
MD536e0027f9e250df48c14d0c46cc69df7
SHA18c8c4dd7725a0ec877541d48ed5ceda97d8a3bd1
SHA2561f6a635c64ef5e04826545b78d4796f2f00493c7fd7b06c9cdea956fd71afeaf
SHA512eba9d6dfe72a7d606159a30968627f6bee22f81f00c722d40058ab6c880c880e040fb9f418e5154f30f20f5f8c9254c3ed9cfa93ea1f2eefa9b5d7ed4e9fea84