Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
27/04/2024, 04:52
General
-
Target
GenshinImpact_install_ua_7eff087a034a.exe
-
Size
141.1MB
-
MD5
33efe69a2ef40cffef7781c58d09fe24
-
SHA1
438d407abaf1bae466fd1378cd2fa63e634c7a72
-
SHA256
cbd06603e2969af667aca05c7eacd89c8206447dac979a2817e5731079731b65
-
SHA512
12337eb3d14ed55a1323df4936424ab603dc495415ab5a3bd845775937d3009323d3a2680d0fac519aaf5ba20b871ca7a5b3a76838afdaf8118e3af96b247867
-
SSDEEP
3145728:9lb/uyMBKKU5FQr7HODgH6dmpnVEZuoTj03zMgRdPlgA2c+Z:zXGKfFRo6d2V0TjuMWdPea+Z
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 49 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates processes with tasklist 1 TTPs 3 IoCs
-
Modifies registry class 49 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 10 IoCs
-
Suspicious use of FindShellTrayWindow 5 IoCs
-
Suspicious use of SendNotifyMessage 5 IoCs
-
Suspicious use of SetWindowsHookEx 9 IoCs
-
Suspicious use of WriteProcessMemory 16 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\GenshinImpact_install_ua_7eff087a034a.exe"C:\Users\Admin\AppData\Local\Temp\GenshinImpact_install_ua_7eff087a034a.exe"1⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\tasklist.exetasklist /FI "imagename eq crashreport.exe"2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist /FI "imagename eq launcher.exe"2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist /FI "imagename eq QtWebEngineProcess.exe"2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Genshin Impact-bdfKiY\7z.exe7z.exe l "C:/Users/Admin/AppData/Local/Temp/Genshin Impact-bdfKiY/app.7z"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Genshin Impact-bdfKiY\7z.exe7z.exe x "C:/Users/Admin/AppData/Local/Temp/Genshin Impact-bdfKiY/app.7z" "-oC:\Program Files\Genshin Impact" -aoa -bsp12⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\Genshin Impact\launcher.exe"C:\Program Files\Genshin Impact\launcher.exe"2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Genshin Impact\QtWebEngineProcess.exe"C:\Program Files\Genshin Impact\QtWebEngineProcess.exe" --type=renderer --no-sandbox --disable-gpu-memory-buffer-video-frames --enable-threaded-compositing --enable-features=AllowContentInitiatedDataUrlNavigations --disable-features=MojoVideoCapture,SurfaceSynchronization,UseModernMediaControls,UseVideoCaptureApiForDevToolsSnapshots --disable-gpu-compositing --service-pipe-token=11033100099151843134 --lang=en-US --webengine-schemes=qrc:sLV --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --service-request-channel-token=11033100099151843134 --renderer-client-id=2 --mojo-platform-channel-handle=2532 /prefetch:13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.8MB
MD58a417025e06c1375cbeb3883d06e1d8f
SHA133b6064eeecc6efeeae691093df08e99467a1e48
SHA2562febeb6b202a9ed4b74372e4fbe142310993f39a5b76661b862d24d6f3eefc30
SHA5129b384f54e90aa947b6481979ad2666f4f7a0ff5e9f1353c9219fc287d4147ff19f2de2d40743992114e924add9a954e9ec65032b50fc9ef05e169625704f848b
-
Filesize
5.9MB
MD54c3236d3e6f6b3a4864da5b297f9a78b
SHA1c549527f47e158b1a387a5d552e1437278a7a6df
SHA25671fa7909f9e384dc86611b47632a0621490bb193369bb8bd82d5c8cc9401a513
SHA5122c7b670c579d3a1a643648a892eecb77662a13a8cfc415b141d9541d4589a57741b6d6b88147c14c57ddd3f844eabf22f0277f8e8bf8154f795e9261ca356742
-
Filesize
6.2MB
MD57e8f07c380fa4fbe07fb5aadfc0d86b3
SHA10fb58c9e46b79aec81c219384d76a8cab5ba94c2
SHA256e3756056f3df026540a2cb03e2835ad2192e83f2a382e1140c68336343528c46
SHA512d7df8762302894b0529de438e92405c7c664fd06a6030577424beb180ed483fe8850a3a4fb1cf64d9171fdfd5abcd727c4fb5c721616e679312253daf1530dab
-
Filesize
1.3MB
MD5cc214788c1659b6589cfe627ae10d348
SHA168ff3d326943c5405be5c509415db54e9eeeb287
SHA2566b9df21f01d278608e3f5376e2cbb6933d9ebc560b3722d39148151840a8237c
SHA512009dfda81c4b9a29a645593bed3dc52e2eff2063bae6426689bdd1c4bbac4a87e1f1c89dbff27a12fb3007749c1bdd4cd0acf2150a6dda0744e17e62fdea8e0b
-
Filesize
330KB
MD5c3aec825e9dc0fc8abb33ff55ca37663
SHA1348d11cadb92510e415fc55536f38e0433773ad5
SHA25655034de66194c4149f2b4009214179f1050a64d7b99788e2eb983905a25534e9
SHA51288a8738cde54ec6b58523323fb065942f7a7199496a40e5091a54b7f3232e9c8865b8cbf5491d8e1a8c4f15b6f70d296aef587810244e7f7009370d57b5473be
-
Filesize
331KB
MD56bb48bf938f34bae011916d8f91ecc43
SHA10d578b6c9556a8355c4932f3c672c1c312764f2b
SHA256bca34de929ccc4cff0212efef1cbfa1bdc857f4884979d8c6ac3a4646f3457f6
SHA512bea64e4e30ac955f9ee22e65d2135093bbef0f4ced1242844cb82bebf0a43530a31b7a272ffaa7d7e1f48127950e367e7aa93559d6309ba5c606ede5bd13a4bc
-
Filesize
3.9MB
MD58db374952ca80930b74cf9bcb030ec75
SHA12a1f16dcc19fbaa74c3d93338bfbf24116014d82
SHA2563170509561064ae0f683265e55eeea08ef3bb8b72882017fb70bd97a4f5a61c5
SHA512ec5b00d6a0258ca1a69860855a87fcb6c91e96982dd4593e0e1bf5c187ed8b135a5a02722d19e8b67690231702c6d36611bcbbb099dc7e9a7ca8c4c36de2ca27
-
Filesize
3.6MB
MD5c367be6f99e44f9766c32f41013fe936
SHA1de6d1f1042ccb939d22ccb597deef20064d48c33
SHA2560a4346a4dda93309b8c07e30641c158d2d9b8ff0d61a6e7fe873a47c2772db68
SHA5128b9beef59ccc95a177e029948dec591c2eb300b635349cce8db159445c34df0866c584168fa6c51ca30f597e0df98a37598b4655ccfbda299eddc140b1c00469
-
Filesize
92KB
MD5bff3879b9daf123fcd1200521b23ae9a
SHA10758acd6d14d56f25ad2b701247cd644905d2659
SHA256ca1bfa459f521da61d2f1bb5d20e2f31bcc935149ac317873227c85e28006a32
SHA51208bf6447c3ddb89b300dfa7504c71e816bd538dbae2f042c44828c694575e268b465f18854f7a4722f80cbf380b84ed1a14c1acc41a54fa7f633b6203c562765
-
Filesize
134KB
MD57d09625e4f8ff294f5827a29ffbd882d
SHA192dcaf3fff3c44cbe8c168e7609ff2ae5514e419
SHA25667cf1104d5bcce62b4e8ce0f747ca7c8b3906d69f8d508c277e046fd76de42ac
SHA5124f0ea8c44bbdc5b16cdb04425f65bad227a37488276ac52300c2690803927c34bee11258163c9911431dab70313fd8d44e248be5efad005875120f90d5d24315
-
Filesize
76.3MB
MD56c3e89dfd553a91055959f5f21584931
SHA170aba4b55db009c9fbfc430960d732104c897912
SHA2564d79267f17e119a64dd47ca375c709e7311541a0b80b3a6aef1177b855e8b3fc
SHA512d508326dbc13668ae310a709c914c670437b4da49a947aa678f3c7428b5b0d315f42b66356c2e08f501a43ecfd0f17ea35ff676e7ff6997b398cd9d4d000d0b0
-
Filesize
241KB
MD564ed5b188277a9df79cd0d0caa82fa00
SHA1fa1b4edca83bff5aea9797ec1b38e9b849394bb1
SHA256a38d8655ae6f01b03e3b1bc8332ff8296fa579be8c8b05d6a627ac9fb43aa50a
SHA51262af933f68d1977b63f756c86a5bbc7c7e83f5257be5b9ff5a9dabdc7b1431180ce6b6bb389f9fcc1828e0f795985f195d47ed9e05c440b971f0841ae7cb365f
-
Filesize
5.3MB
MD528dec8f964162cf2be3cfc61e46b311a
SHA1334ce37a4ece27815c2be81de237c6105a6ca726
SHA256cfda408925130bf97bd931ad0b8b7fe94a49a5874160c959d31fd051b02aa917
SHA51217c0dae78c270aca78baee0173943440eb76fe8f732f922fd75979dcbd2ce180ca9eaf4310b214a87ad058464185b618d9f88610715ff1b4491caddf9bb6e14e
-
Filesize
106KB
MD5d0df1bac72398d794bec867bffcd0ddf
SHA11c6a1f62fd07cccb7461a39178d7afcba4b0eba9
SHA25670661f44e0f9a2bb17ceaa2b798486b6a05feeb3eb8a41a94919d71720334051
SHA512584fa39037af9d716c45e228ff7710a7ea61ae449b95a8d7efe5578692555a502be6b2f490a6b161fb42f45af9f30f786390722c29bcac20c28f9348da24157b
-
Filesize
106B
MD5f58c3e877948f20b334c87766940ed24
SHA15cbf56888e3fc247c09fb4a7baa6100581905ba8
SHA256001135b303fd225e1b0acab6eeee9ed4caba9cfef9ccec34c4dc15b908c33533
SHA512b5b9420ae2811ba33c743fbc6534402c7d6808dc6093db6b71ddfda9752f1952a0c55328e2fdae8b19407f13e67b9d003cceaae41a8f1979fe2a83c21390db1d
-
Filesize
183B
MD525938f933c01e821f3e3f6a84687e7d4
SHA17ccc7c36c68b2ea439188921efd22bab65771e09
SHA256c9d85d1b02a139ef5e53171aa869be99573f3001cc678f3377607ae38186f5d2
SHA512a97a8691224a43d1d8912b8f634af46402089944981ea259c447f071e48b89a61f2ce44882292c9c9b76d391335a2e5dc73a2e77f05099c6723a36f03a2472fa
-
Filesize
61B
MD50c45dca68657fd2f08741a478bcfcbf6
SHA1fa918b21a2be5ae9944495054f66e49d9ea5beef
SHA2560b0bf135b9ddaffe44693de8285d72d4acb5ce7b7bcd14f75a11b9ecc2ae4bec
SHA5121f2d85b8caaa9e853e63a4c54c4d12ee41c48701cda13f26e8d11967e2b7260af9347b9ac9c52f252b8beb828762987fbd239a10fb01fe163a5a26ea48542ba2
-
Filesize
54KB
MD58a35ff609a9e4885b7953b140cf6723a
SHA15fdce3bf9ae36f1d816f4e58d82bff8432996087
SHA2566c9950ec6f0a0426fcefb582f25621fa6ef3bc34ed6c6bee94770322d122879a
SHA51290b8eb7ac9608946a56f561c0f005d14fa4b12dd7cf40d3e37aac75b65da73041aed87e2dea7d198bce447f1e351305d17086b055dd97b9409ef8e7afb4b1c1b
-
Filesize
51KB
MD598c610d255270dfe88294e5cc932d636
SHA178ae1077225b415225fe49b8a36718f4c44753db
SHA256651a739e02dd0c4e3e49e8548dc4569f5f0c748960d0781be73527151449b958
SHA512856bf9c616e8d1e6f31e561b45813569d55e8991e15e9a90e5335d0219fa6a69ac9c5b1c3c4edd826c33585a885ad03edf63d3b14170df779a813bdf0acc8904
-
Filesize
60KB
MD56564011eb00a88d5759f4069f90d58f5
SHA1f4afd06b811c9bd8f0f6173a54ce4a02fec7ebf5
SHA2562d655e61b669017e4600363e491b0c20b007bb1546a696090d5a199e6676cb98
SHA51212462328c7a74b24d4524e15fd86811a4d3dbc7b1e9d73ddb3d1bd26c4e95ec488da3f60ed018a667963033206286f409e34986b8b0491dee3ca1b8aba54e74f
-
Filesize
51KB
MD557d13a5e45eb86ef6af041e9b853d64a
SHA12ef3e80317328915883993c813441460b1a06b97
SHA256c8106ae81208cb62d594af33d705a6c02baee06e8aed089e0eafe8d3ac2307c7
SHA512b01e5622fac4d897c4563566269e5770798dda8bcf6e302aca6e83d7b738e115df1addcc41466e5a6126eebf16dd6c262464f255c6df0f586c5990361f398f9f
-
Filesize
408KB
MD52e45cf9c78c106ebeaa5e0cb80a76bca
SHA1704692206519590ff5cddfbbff771fd1476c3348
SHA256af1d0c15c8562ee0ced6097239a73a87ceff3e2ae86bc32231cbf455c87f5901
SHA512444930ffb07428c30e3483d57e05c1c83fc6c4b0022025f1e12eca5dcfee1fcc36f8caa9d3ea0670f2b6821835211472ed80dfffd57cf6545a8dc7e5eae57142
-
Filesize
45KB
MD5d665da48bced9f0cd0c5e36f9def0535
SHA13078353b5653ae76a143cf231d0c35461614a83b
SHA256858156d03db0a2692ddca124f6972029fae4eef4de7ec80d8c4eb60ba7a99e62
SHA512c73162bc10126a597aede881cdaa03eab43c4eec5e763223823c366954fcbda823016a1f913beb58db0c52c9047e8ae6178d28b2168810e7a2a3603c9c6eeb04
-
Filesize
44KB
MD51a0453d1dadff39ff669f490a4f17919
SHA19fa8c782e20d8cd237e772ef16baba661090b73b
SHA256bbb147c140256b96d78a84af14763792c0496781c6c1546609b66322c2e3b03e
SHA5122294b3b5628576c12e090224cc2ef72b22b3a9b002f56cf307f24886efd6a21938e195f028077e07516e09ccaef1093301eb524c00a7a4d16ebfdd98f1af24cc
-
Filesize
385KB
MD5f42824723c3a3a4f25a17c5fe4639422
SHA172858b6ba469897d93bcea12a6dd9469b624eac9
SHA2563ad00ff038a7679c502a62b0e711fca595f549621a7ecb92e85025b6eff3e82a
SHA512d95aeac243de702528459bf05bec0690cd5015b02342d7ee1c5a12017178f47d07848c9ad5c914c2bf2765dc3c731536b4c21831633762ff913cc39357ee8e03
-
Filesize
43KB
MD5a639499139cc4f43a63eca0a818dc490
SHA119b89f308da87191ee23a93ec97dd058b5087992
SHA25622ccbccb699902490e47d8eabc3cc13b34570ccb651d98ac312dd3b37c8d136b
SHA5129b6e49d227fc561fdeda2b7c72662c19988f8ffcacd77f57bc812abac42857718f44cc2c6a555e44f8f8062275dd113799953454f5fcbfa47690f86909175749
-
Filesize
500KB
MD5e7ab90afb74df3e4c1329cf07610fe7f
SHA1309eff5dc654f6ac2112c4c183250a0581307dee
SHA2566ae16ed9312743fce5730f3030381e4d2b87418dd007dee8497971d71efdf0b2
SHA5124e531ae0b3b5517b87ab972114c503b11db85f36f3d3b2dc9f227248001079c79cd6ce4d1704145f09b963e0f92847ef949d0a055dcb5ad597bc128d4896f99b
-
Filesize
68KB
MD57ed320005a304eea5e0f6f2aa6e39061
SHA180b7987edbac86857d619547d04922f1ffcd5398
SHA25682be3bf2a4a5829559c17cd98f5ea5ecfb0d189d0cd1f92b9976e10f060f6eba
SHA512609214394244b6cc316fab8a77cc01260739ab0bc6a70bb72a8efa36337ddefa4da58557a8e26454e17740ae267a9e21a86332a5a915a4602914125f6a1c5c4b
-
Filesize
4.5MB
MD5d70004d74af0a01d82f1521b0d23ae60
SHA14b6a23592b1e96bb869c1130dcbc86ff0fdf26f3
SHA2566babcc36f396892a5d72d17fe1898f6dfb7ae9d0552908301d0c9da28d21a56d
SHA51218eac6438e1f20c5b79a68f492e48d570dddf900948fc08458c47b8d031411221fe207940987fd0111a5caa74d08d335031833cbe2e2dfa7304943317d17b496
-
Filesize
38KB
MD575785100e4d63ce2e83a05becab33451
SHA1c87274ddee30ccb962a260723b5e0e99647b3388
SHA2569cc91b1f35c20f748f015cf7b000b05ef345ee3291fc9d90de7beb206b32f056
SHA512e91b80bc1e85b996edc0c0f837400f48df68d79ad4b21137a68856a762fbb15faac25b34de03205f382f514f68345af1ef59135dc9869d7c9cec7fdfdaf8832d
-
Filesize
3.4MB
MD55085ccdf8619b9780c930226a548fc49
SHA1d632cd54999f6ce1e8bddce7f9905c85bad155ba
SHA25697770b933b6a966298cc4b19d6f84f2bff816567b511b69f64e5025375730f75
SHA512c4beea9cd3959fd416e57e7197008c5dd1cb660c546201b3233a4e59177d9844518e5234b1e038714df12e45af1ca209869a0a64ddc03c53159c5b4d3165dc2e
-
Filesize
580KB
MD562a538f342ff490ddf5b7c7d354e36bf
SHA1b166ed0fd43f054b59f1843d4b1af336810f8832
SHA2561345b1f74cf1dd3677bcf3499462714795788eaaa20b9702cdc7baafa4beaf8d
SHA512598907ab4e37a0092a1f651215a7581ad0d0281e6511c06408ad0f93af65892876e4075c73063da0772cc962bacf5900d862a805384887ea5daf52490e5ff51a
-
Filesize
1.4MB
MD5d5878a01f8f13b6dc8dd89d40a8f80af
SHA16ac8e66d18c2f8260d4e49416d12430ccb5b4275
SHA2560a11d124673193226533471d96e1065005ace4b02d668459341fa8e2a3df0595
SHA5120cee796505b22d71022e9771b0973813ed433b28752db79609b1bc4b46b24581d1244a23d51b11725f1c584af684e0a749e1c950fa57ca3feeded44823006618
-
Filesize
154KB
MD5295f8abf7f836fb994b0a97344996b6f
SHA1f1c22e27601a4cd2bfc9b2185893222b77e69bb7
SHA2560c940d1d6989caad0f18f62202cc36721300fbaba35ef478a580f9f54b2dbec4
SHA512873013dec180ed55cbfbfb138b0372eb840773882cd3539cf4994b9e4941c7f158915a1e1d8b40ee6d78fc7114319e09755114d56cd7b46335dad6ecf1f48bfd
-
Filesize
23.6MB
MD5776030f59f098190a7f42449bc458068
SHA13681b433f460eafee73bdfa0a25a6d6f887a429e
SHA2567cf8238dcbfa2610ec351f9478feb409a5f4f4b979186d001f8ae6407c94da12
SHA512deb8cd435b939655bd63e3c414ec34869f9c69e1ac5608bac32f10f127fdf4c2ba758c2dc9368584ae9a0791c4763901eebc4d707bc925c7b4515b3ad4210cd6
-
Filesize
47KB
MD50ae97fbade4c1129b72c5ac5a289c56e
SHA198d91cbfb93302a6d7f455086d63ea6d195f1564
SHA2569f06f592706f6a9382a9949d9d82f151bb8d854aa6d2c1e33f08e1e69716c3e1
SHA512fffc65cc298d59eafde79221109d76aa3fa21c0d80fc64797bff24a48012774563f6605d15ab0e2408709395357c3e1ab094709e10e5101fead7132e98d93fcc
-
Filesize
1.1MB
MD5e7ae42ea24cff97bdead0c560ef2add1
SHA1866f380a62622ab1b6c7705ddc116635e6e3cc86
SHA256db2897eeea65401ee1bd8feeebd0dbae8867a27ff4575f12b0b8a613444a5ef7
SHA512a4a27b2be70e9102d95ee319ec365b0dc434d4e8cd25589ce8a75b73bbe4f06b071caa907c7a61387b2ce6a35a70873593564499b88598f77a7c25c47448fb0a
-
Filesize
286KB
MD5afc08ce359e79887e45b8460e124d63e
SHA1e8dcddb302f01d51da3bcbfa6707d025a896aa57
SHA256a20d93e7dc3711e8b8a8f63bd148ddc70de8c952de882c5495ac121bfedb749f
SHA51232d3b8d964711a5706f8cf9f87bc6e33670bba2cb3ab88603dec399652ac7fe297a4692f0865a0bdcbd06515d6b0a84e5a96d1b7fda48f556543536889ba387a
-
Filesize
115.8MB
MD583d7fc67da4bf2602d974319b6714393
SHA153ac4ada1f51c759a85d3049a71bc04be8aadb9e
SHA2569eceb9e599c60f473d6559408dbef841e24c611a050d4a82d89edf50b197660e
SHA51287853c1947077b8afb1b812c36bd3ee2d6a9fc988348fbf4e3561342e3701cec9845fe000c2be66847d6d0c9b5f108e34581fc800cc1fb2fc2833d97417c8328
-
Filesize
5.4MB
-
Filesize
3.6MB
-
Filesize
3.6MB