Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

7

droidkit-en-setup.exe

windows7-x64

6

droidkit-en-setup.exe

windows10-2004-x64

5

$PLUGINSDI...er.dll

windows7-x64

3

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...Vs.dll

windows7-x64

3

$PLUGINSDI...Vs.dll

windows10-2004-x64

3

$PLUGINSDI...ib.dll

windows7-x64

1

$PLUGINSDI...ib.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...up.exe

windows7-x64

7

$PLUGINSDI...up.exe

windows10-2004-x64

7

$PLUGINSDI...00.dll

windows7-x64

1

$PLUGINSDI...00.dll

windows10-2004-x64

1

$PLUGINSDI...00.dll

windows7-x64

1

$PLUGINSDI...00.dll

windows10-2004-x64

1

$PLUGINSDIR/nsDui.dll

windows7-x64

3

$PLUGINSDIR/nsDui.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows7-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$PLUGINSDI...ss.dll

windows7-x64

3

$PLUGINSDI...ss.dll

windows10-2004-x64

3

$PLUGINSDI...7z.dll

windows7-x64

3

$PLUGINSDI...7z.dll

windows10-2004-x64

3

$PLUGINSDI...ry.dll

windows7-x64

3

$PLUGINSDI...ry.dll

windows10-2004-x64

3

$PLUGINSDI...ll.exe

windows7-x64

4

$PLUGINSDI...ll.exe

windows10-2004-x64

5

$PLUGINSDI...er.dll

windows7-x64

3

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...ib.dll

windows7-x64

3

$PLUGINSDI...ib.dll

windows10-2004-x64

3

Analysis

  • max time kernel
    141s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/04/2024, 08:33 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    $PLUGINSDIR/nsis7z.dll

  • Size

    313KB

  • MD5

    06a47571ac922f82c098622b2f5f6f63

  • SHA1

    8a581c33b7f2029c41edaad55d024fc0d2d7c427

  • SHA256

    e4ab3064f2e094910ae80104ef9d371ccb74ebbeeed592582cf099acd83f5fe9

  • SHA512

    04b3d18042f1faa536e1393179f412a5644d2cf691fbc14970f79df5c0594eeedb0826b495807a3243f27aaa0380423c1f975fe857f32e057309bb3f2a529a83

  • SSDEEP

    6144:rA9ssOlBrbYr5UP4m3mC/FvBbhQ1JzI+yQKiJGxdNtsm0:r2S165UP4mL/FvBtC8zQdSDmm0

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsis7z.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3456
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsis7z.dll,#1
      2⤵
        PID:452
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 452 -s 600
          3⤵
          • Program crash
          PID:4544
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 452 -ip 452
      1⤵
        PID:2040
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4072 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8
        1⤵
          PID:2232

        Network

        • flag-us
          DNS
          240.197.17.2.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          240.197.17.2.in-addr.arpa
          IN PTR
          Response
          240.197.17.2.in-addr.arpa
          IN PTR
          a2-17-197-240deploystaticakamaitechnologiescom
        • flag-us
          DNS
          196.249.167.52.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          196.249.167.52.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          95.221.229.192.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          95.221.229.192.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          20.160.190.20.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          20.160.190.20.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          157.123.68.40.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          157.123.68.40.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          97.17.167.52.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          97.17.167.52.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          206.23.85.13.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          206.23.85.13.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          0.205.248.87.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          0.205.248.87.in-addr.arpa
          IN PTR
          Response
          0.205.248.87.in-addr.arpa
          IN PTR
          https-87-248-205-0lgwllnwnet
        • flag-us
          DNS
          249.197.17.2.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          249.197.17.2.in-addr.arpa
          IN PTR
          Response
          249.197.17.2.in-addr.arpa
          IN PTR
          a2-17-197-249deploystaticakamaitechnologiescom
        • flag-us
          DNS
          48.229.111.52.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          48.229.111.52.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          48.229.111.52.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          48.229.111.52.in-addr.arpa
          IN PTR
        • flag-us
          DNS
          88.16.208.104.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          88.16.208.104.in-addr.arpa
          IN PTR
          Response
        • 172.217.169.74:443
          46 B
           40 B
           1
          1
        • 13.107.253.64:443
          46 B
           40 B
           1
          1
        • 8.8.8.8:53
          240.197.17.2.in-addr.arpa
          dns
          71 B
           135 B
           1
          1

          DNS Request

          240.197.17.2.in-addr.arpa

        • 8.8.8.8:53
          196.249.167.52.in-addr.arpa
          dns
          73 B
           147 B
           1
          1

          DNS Request

          196.249.167.52.in-addr.arpa

        • 8.8.8.8:53
          95.221.229.192.in-addr.arpa
          dns
          73 B
           144 B
           1
          1

          DNS Request

          95.221.229.192.in-addr.arpa

        • 8.8.8.8:53
          20.160.190.20.in-addr.arpa
          dns
          72 B
           158 B
           1
          1

          DNS Request

          20.160.190.20.in-addr.arpa

        • 8.8.8.8:53
          157.123.68.40.in-addr.arpa
          dns
          72 B
           146 B
           1
          1

          DNS Request

          157.123.68.40.in-addr.arpa

        • 8.8.8.8:53
          97.17.167.52.in-addr.arpa
          dns
          71 B
           145 B
           1
          1

          DNS Request

          97.17.167.52.in-addr.arpa

        • 8.8.8.8:53
          206.23.85.13.in-addr.arpa
          dns
          71 B
           145 B
           1
          1

          DNS Request

          206.23.85.13.in-addr.arpa

        • 8.8.8.8:53
          0.205.248.87.in-addr.arpa
          dns
          71 B
           116 B
           1
          1

          DNS Request

          0.205.248.87.in-addr.arpa

        • 8.8.8.8:53
          249.197.17.2.in-addr.arpa
          dns
          71 B
           135 B
           1
          1

          DNS Request

          249.197.17.2.in-addr.arpa

        • 8.8.8.8:53
          48.229.111.52.in-addr.arpa
          dns
          144 B
           158 B
           2
          1

          DNS Request

          48.229.111.52.in-addr.arpa

          DNS Request

          48.229.111.52.in-addr.arpa

        • 8.8.8.8:53
          88.16.208.104.in-addr.arpa
          dns
          72 B
           146 B
           1
          1

          DNS Request

          88.16.208.104.in-addr.arpa

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        We care about your privacy.

        This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.