Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

7

D0puslunar...de.rar

windows7-x64

7

D0puslunar...de.rar

windows10-2004-x64

7

32bit/Lang...hs.dll

windows7-x64

1

32bit/Lang...hs.dll

windows10-2004-x64

1

32bit/Lang...ht.dll

windows7-x64

1

32bit/Lang...ht.dll

windows10-2004-x64

1

32bit/Lang...ch.dll

windows7-x64

1

32bit/Lang...ch.dll

windows10-2004-x64

1

32bit/Lang...sk.dll

windows7-x64

1

32bit/Lang...sk.dll

windows10-2004-x64

1

32bit/Lang...ch.dll

windows7-x64

1

32bit/Lang...ch.dll

windows10-2004-x64

1

32bit/Lang...ch.dll

windows7-x64

1

32bit/Lang...ch.dll

windows10-2004-x64

1

32bit/Lang...ll.dll

windows7-x64

1

32bit/Lang...ll.dll

windows10-2004-x64

1

32bit/Lang...sh.dll

windows7-x64

1

32bit/Lang...sh.dll

windows10-2004-x64

1

32bit/Lang...sm.dll

windows7-x64

1

32bit/Lang...sm.dll

windows10-2004-x64

1

32bit/Lang...ol.dll

windows7-x64

1

32bit/Lang...ol.dll

windows10-2004-x64

1

32bit/Lang...is.dll

windows7-x64

1

32bit/Lang...is.dll

windows10-2004-x64

1

32bit/Lang...no.dll

windows7-x64

1

32bit/Lang...no.dll

windows10-2004-x64

1

32bit/Lang...pn.dll

windows7-x64

1

32bit/Lang...pn.dll

windows10-2004-x64

1

32bit/Lang...or.dll

windows7-x64

1

32bit/Lang...or.dll

windows10-2004-x64

1

32bit/Lang...ar.dll

windows7-x64

1

32bit/Lang...ar.dll

windows10-2004-x64

1

Analysis

  • max time kernel
    149s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    10/04/2024, 12:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    D0puslunar12.33-de.rar

  • Size

    65.7MB

  • MD5

    0c4bbf23849fa553ce1dd668dc5d0341

  • SHA1

    3d403740b24da559212928ca77e454ace41039fb

  • SHA256

    8166e9f4dde03649255b9fea4a9920ed2f55e18f05bb8cb68194bb9636e935a4

  • SHA512

    9f77b58afe46bb3565b9279090c6cd7848f2bf54d18c4e47f556b8a0f8bc596ab7d22b2ec4f481bd59ad7beb6838a515024a25397564d5a0280c674909fb416d

  • SSDEEP

    1572864:kXm5hMulWZMvRpggqEfakm2P6mwz4R/RdZVXNwEO+:kXmMC8MpmgqKpWzoRD9LO+

Score
7/10
discoverypersistence

Malware Config

Signatures

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 19 IoCs
  • Registers COM server for autorun 1 TTPs 45 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of WriteProcessMemory 50 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\D0puslunar12.33-de.rar
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2224
    • C:\Program Files\7-Zip\7zFM.exe
      "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\D0puslunar12.33-de.rar"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2604
      • C:\Users\Admin\AppData\Local\Temp\7zOC2AFFF27\DOpusInstall.exe
        "C:\Users\Admin\AppData\Local\Temp\7zOC2AFFF27\DOpusInstall.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:3004
        • C:\Users\Admin\AppData\Local\Temp\is-C9QIF.tmp\DOpusInstall.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-C9QIF.tmp\DOpusInstall.tmp" /SL5="$6015C,39321588,863232,C:\Users\Admin\AppData\Local\Temp\7zOC2AFFF27\DOpusInstall.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2856
          • C:\Users\Admin\AppData\Local\Temp\is-HKKK5.tmp\_isetup\_setup64.tmp
            helper 105 0x1EC
            5⤵
            • Executes dropped EXE
            PID:2212
          • C:\Windows\system32\regsvr32.exe
            "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\GPSoftware\Directory Opus\dopushlp.dll"
            5⤵
            • Loads dropped DLL
            • Registers COM server for autorun
            • Modifies registry class
            PID:1700
          • C:\Windows\system32\regsvr32.exe
            "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\GPSoftware\Directory Opus\dopuslib.dll"
            5⤵
            • Loads dropped DLL
            • Registers COM server for autorun
            • Modifies Internet Explorer settings
            • Modifies registry class
            PID:2640
          • C:\Windows\SysWOW64\regsvr32.exe
            "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\GPSoftware\Directory Opus\dopuslib32.dll"
            5⤵
            • Loads dropped DLL
            PID:1756
          • C:\Users\Admin\AppData\Local\Temp\is-HKKK5.tmp\SetAppUserModelId-x64.exe
            "C:\Users\Admin\AppData\Local\Temp\is-HKKK5.tmp\SetAppUserModelId-x64.exe" /cert2:262566:22 12400 "C:\Program Files\GPSoftware\Directory Opus"
            5⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            • NTFS ADS
            PID:2592
          • C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe
            "C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe" /fixappname
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2284

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\GPSoftware\Directory Opus\dopushlp.dll
    Filesize

    479KB

    MD5

    a739f48d3d4dfa805ead5ececd253537

    SHA1

    8a9fe54ed719bf58f250bb70cb340f4a61f7fbc9

    SHA256

    cc81be90c2de1d475dfc4663ee5d59700d62d870a690301ce108e0d2c2893bbc

    SHA512

    6b06c01f511893acbf414289a6d9830555c859bd5743f6ad5ab6abc7af3ed8142c97cc15baed17e8a35ad81b11ec75c87778ee005f8f0e42eccf5f7c2cb73d6c

    Download Submit

  • C:\Program Files\GPSoftware\Directory Opus\dopuslib.dll
    Filesize

    1.9MB

    MD5

    141963e8fabca2510a48606a6df5b360

    SHA1

    cce760d0acac5ef0255ba5ddfbe30939bfc419fe

    SHA256

    4ec8112d788487f91bbfb2b0dd7245344c06ef8ddbd04a1445b02516e48f6c01

    SHA512

    1daaee511f8f4747d634bb6cfa8a1dff07a6d38f538f715b474a8cf994d9d5394e2aa06e5f269d5e1e4f64483fb329fdf36d95a80de9e194fb1fcfe79d540f7a

    Download Submit

  • C:\Program Files\GPSoftware\Directory Opus\stockcert.txt
    Filesize

    1KB

    MD5

    ba6ae2623c9f437dfffd4a0c8385b085

    SHA1

    70ec32695a49e78ba2e4940582ceccd5ab0bf949

    SHA256

    9d8a262fca2c58135b6be75378d3e4848ee9ad5d1b23381a826715067b661cc4

    SHA512

    89515c5bd90b1792c504b85112a08ff2b65d8f35ab40b482f7d6721ddbb520689d20ed00e570de9e32ff899abddb3e4ba5de5d943901971c1374506130b26f6b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\7zOC2AFFF27\DOpusInstall.exe
    Filesize

    38.5MB

    MD5

    99540b8e8d91ae5546fc24410a96c457

    SHA1

    f36a5a85c041126a48d7486420bf35da8c31d922

    SHA256

    4d385b9fde266f9685f95949c60ec9f5b29d1bde22de2eb0c882bca8eac71293

    SHA512

    4400f7bb0a2e78c729228149cd8d47ea55c9b5f3207fc95478c4e31316c42423c4bbf7eece178b316a9153230bc0ac87873ba203d01ff39eb348fdf72b7d14a5

    Download Submit

  • \Program Files\GPSoftware\Directory Opus\dopus.exe
    Filesize

    24.2MB

    MD5

    ba8bc3cbcb5bc5a381f88ed7baa1b0f3

    SHA1

    d7bb714b3d2f7d53950d30a324891a5c39b2ae7e

    SHA256

    8a3408960705f01145509a83505600e894c497faec38cc4b53b3fd8875f05500

    SHA512

    209190b73fea1f6e469fdbea2e5851be3158cdd768fc6d5791ae9bcfd03de0cd7949885808fc1fb66ffa13cbe25dc0e24719418c52f8f6125f3a54c49fb618ed

    Download Submit

  • \Program Files\GPSoftware\Directory Opus\dopuslib32.dll
    Filesize

    397KB

    MD5

    cd0852ae4e24a584fcf765b08228490c

    SHA1

    4293b284b7361835435c3cc31441270f1ff478ae

    SHA256

    c0116142d7bd12fcbf3afb8b0df40178c3e6e0608ff9a4f60a2a7e8be5cecb68

    SHA512

    4aa7b962ff499d6a226453024f03b682d021ee5448ed19f5bd32fcfb1e5a63d6125d2bf57acf25375a68e0530d060f7e83e65a9dda30a4836f2fb56da778a6c7

    Download Submit

  • \Program Files\GPSoftware\Directory Opus\dopusrt.exe
    Filesize

    786KB

    MD5

    67210bad108fc3de79efc6eeabd09757

    SHA1

    92e4646f418f9d9e2fab9b9f352371ad1b5e714f

    SHA256

    4d9d3f7f55cca2f146bd2a710137ef41c9e61f996db4f4a3837d43d1723cf2c1

    SHA512

    8113462d115c1b23eb8a6fdd4bbd8b9564d1ee36a27b47bafc05f05f0705e9954f370c3a566c8f12b24d16f8a5301cb5430b433dd41bac4044d490487de2c6bd

    Download Submit

  • \Users\Admin\AppData\Local\Temp\is-C9QIF.tmp\DOpusInstall.tmp
    Filesize

    3.1MB

    MD5

    07ee2202fc2470c6e4d0fd912b769931

    SHA1

    39daf3eecf260954e44e30cee162ddbfa9ba337b

    SHA256

    c9859a64c8da1f512e6111dd028e47cdd50bae46af2e105c0a0a1e9668eb86f6

    SHA512

    0014812f8bbe3d18b038096d50ea5d75a70ba7858de6280a3d79118f205eba6982bd4e504f5eb5d455de79503992db10509012e93f73f0105126176c45da6bf8

    Download Submit

  • \Users\Admin\AppData\Local\Temp\is-HKKK5.tmp\SetAppUserModelId-x64.exe
    Filesize

    189KB

    MD5

    457aaf81b2bb2d365f4a14142472ad91

    SHA1

    723743083a939bf01e73bc475679ba017c8a47f0

    SHA256

    0404764b2cd5973199faca1e2b2b931a5abec8aacd833746d77386417b96b569

    SHA512

    6d7b4c9cfed4c7ab550748294b6ea152e9449b80583c60c01d13e8a21527e037ec56131f4d76642b254037564ee26d82394426f3bb18fd3bd3dc203716e086b6

    Download Submit

  • \Users\Admin\AppData\Local\Temp\is-HKKK5.tmp\_isetup\_setup64.tmp
    Filesize

    6KB

    MD5

    e4211d6d009757c078a9fac7ff4f03d4

    SHA1

    019cd56ba687d39d12d4b13991c9a42ea6ba03da

    SHA256

    388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95

    SHA512

    17257f15d843e88bb78adcfb48184b8ce22109cc2c99e709432728a392afae7b808ed32289ba397207172de990a354f15c2459b6797317da8ea18b040c85787e

    Download Submit

  • \Users\Admin\AppData\Local\Temp\is-HKKK5.tmp\innohelp.dll
    Filesize

    85KB

    MD5

    bcf8dafbc9188b00025e4425b86669cf

    SHA1

    a8ee26d9181a69694356b90b8c5ce00fab722486

    SHA256

    3a41354a740cd1e7f2ef27ec3249bfd9aa4f07eb803a2f1824b8ef7911b5464f

    SHA512

    234cfac5112e46ca89035c0cde811bddd480114fdffee5e56e7fef29f39c88327471516aad3c3112a8f489a065750cca4a13d4cbab676ecae02da54d65d61d0b

    Download Submit

  • memory/2856-52-0x0000000000400000-0x000000000071C000-memory.dmp

    Filesize

    3.1MB

    Download

  • memory/2856-45-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2856-313-0x0000000000400000-0x000000000071C000-memory.dmp

    Filesize

    3.1MB

    Download

  • memory/3004-51-0x0000000000400000-0x00000000004E0000-memory.dmp

    Filesize

    896KB

    Download

  • memory/3004-39-0x0000000000400000-0x00000000004E0000-memory.dmp

    Filesize

    896KB

    Download

  • memory/3004-36-0x0000000000400000-0x00000000004E0000-memory.dmp

    Filesize

    896KB

    Download

  • memory/3004-314-0x0000000000400000-0x00000000004E0000-memory.dmp

    Filesize

    896KB

    Download