ddb62fe8611e6e37b8b37413dea5e5f813f441e1601f8c805787a2d94265a8cb

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

office2019...us.exe

windows7-x64

office2019...us.exe

windows10-2004-x64

office2019...za.dll

windows7-x64

office2019...za.dll

windows10-2004-x64

office2019...za.exe

windows7-x64

office2019...za.exe

windows10-2004-x64

office2019...xa.dll

windows7-x64

office2019...xa.dll

windows10-2004-x64

office2019...rm.exe

windows7-x64

office2019...rm.exe

windows10-2004-x64

office2019...2c.exe

windows7-x64

office2019...2c.exe

windows10-2004-x64

office2019...71.dll

windows7-x64

office2019...71.dll

windows10-2004-x64

office2019...id.dll

windows7-x64

office2019...id.dll

windows10-2004-x64

office2019...ne.dll

windows7-x64

office2019...ne.dll

windows10-2004-x64

office2019...71.dll

windows7-x64

office2019...71.dll

windows10-2004-x64

office2019...71.dll

windows7-x64

office2019...71.dll

windows10-2004-x64

office2019...dl.dll

windows7-x64

office2019...dl.dll

windows10-2004-x64

office2019...b1.dll

windows7-x64

office2019...b1.dll

windows10-2004-x64

office2019...PP.vbs

windows7-x64

office2019...PP.vbs

windows10-2004-x64

office2019...cn.vbs

windows7-x64

office2019...cn.vbs

windows10-2004-x64

office2019...RM.exe

windows7-x64

office2019...RM.exe

windows10-2004-x64

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 11:56

Sharing

Copy URL

Twitter E-mail

Static task

static1

upx

3 signatures

Behavioral task

behavioral1

Sample

office2019pjb_9435/office2019pjb/OTool/Office Tool Plus.exe

Resource

win7-20240221-en

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral2

Sample

office2019pjb_9435/office2019pjb/OTool/Office Tool Plus.exe

Resource

win10v2004-20240508-en

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral3

Sample

office2019pjb_9435/office2019pjb/OTool/files/7-zip/7za.dll

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral4

Sample

office2019pjb_9435/office2019pjb/OTool/files/7-zip/7za.dll

Resource

win10v2004-20240508-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral5

Sample

office2019pjb_9435/office2019pjb/OTool/files/7-zip/7za.exe

Resource

win7-20240221-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral6

Sample

office2019pjb_9435/office2019pjb/OTool/files/7-zip/7za.exe

Resource

win10v2004-20240508-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral7

Sample

office2019pjb_9435/office2019pjb/OTool/files/7-zip/7zxa.dll

Resource

win7-20240215-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral8

Sample

office2019pjb_9435/office2019pjb/OTool/files/7-zip/7zxa.dll

Resource

win10v2004-20240426-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral9

Sample

office2019pjb_9435/office2019pjb/OTool/files/Thunder/MiniThunderPlatform.exe

Resource

win7-20240221-en

bootkit persistence upx

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral10

Sample

office2019pjb_9435/office2019pjb/OTool/files/Thunder/MiniThunderPlatform.exe

Resource

win10v2004-20240508-en

bootkit persistence upx

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral11

Sample

office2019pjb_9435/office2019pjb/OTool/files/Thunder/aria2c.exe

Resource

win7-20231129-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral12

Sample

office2019pjb_9435/office2019pjb/OTool/files/Thunder/aria2c.exe

Resource

win10v2004-20240426-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral13

Sample

office2019pjb_9435/office2019pjb/OTool/files/Thunder/atl71.dll

Resource

win7-20240221-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral14

Sample

office2019pjb_9435/office2019pjb/OTool/files/Thunder/atl71.dll

Resource

win10v2004-20240508-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral15

Sample

office2019pjb_9435/office2019pjb/OTool/files/Thunder/dl_peer_id.dll

Resource

win7-20240419-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral16

Sample

office2019pjb_9435/office2019pjb/OTool/files/Thunder/dl_peer_id.dll

Resource

win10v2004-20240226-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral17

Sample

office2019pjb_9435/office2019pjb/OTool/files/Thunder/download_engine.dll

Resource

win7-20240221-en

upx

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral18

Sample

office2019pjb_9435/office2019pjb/OTool/files/Thunder/download_engine.dll

Resource

win10v2004-20240508-en

upx

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral19

Sample

office2019pjb_9435/office2019pjb/OTool/files/Thunder/msvcp71.dll

Resource

win7-20240419-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral20

Sample

office2019pjb_9435/office2019pjb/OTool/files/Thunder/msvcp71.dll

Resource

win10v2004-20240508-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral21

Sample

office2019pjb_9435/office2019pjb/OTool/files/Thunder/msvcr71.dll

Resource

win7-20240508-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral22

Sample

office2019pjb_9435/office2019pjb/OTool/files/Thunder/msvcr71.dll

Resource

win10v2004-20240426-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral23

Sample

office2019pjb_9435/office2019pjb/OTool/files/Thunder/xldl.dll

Resource

win7-20240221-en

upx

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral24

Sample

office2019pjb_9435/office2019pjb/OTool/files/Thunder/xldl.dll

Resource

win10v2004-20240508-en

upx

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral25

Sample

office2019pjb_9435/office2019pjb/OTool/files/Thunder/zlib1.dll

Resource

win7-20231129-en

upx

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral26

Sample

office2019pjb_9435/office2019pjb/OTool/files/Thunder/zlib1.dll

Resource

win10v2004-20240426-en

upx

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral27

Sample

office2019pjb_9435/office2019pjb/OTool/files/activate/OSPP.vbs

Resource

win7-20240221-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral28

Sample

office2019pjb_9435/office2019pjb/OTool/files/activate/OSPP.vbs

Resource

win10v2004-20240508-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral29

Sample

office2019pjb_9435/office2019pjb/OTool/files/activate/OSPP.zh-cn.vbs

Resource

win7-20240221-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral30

Sample

office2019pjb_9435/office2019pjb/OTool/files/activate/OSPP.zh-cn.vbs

Resource

win10v2004-20240226-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral31

Sample

office2019pjb_9435/office2019pjb/OTool/files/activate/OSPPREARM.exe

Resource

win7-20240221-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral32

Sample

office2019pjb_9435/office2019pjb/OTool/files/activate/OSPPREARM.exe

Resource

win10v2004-20240508-en

windows10-2004-x64

0 signatures

150 seconds

Report Analysis Logs

General

Target

office2019pjb_9435/office2019pjb/OTool/files/Thunder/atl71.dll
Size

87KB
MD5

79cb6457c81ada9eb7f2087ce799aaa7
SHA1

322ddde439d9254182f5945be8d97e9d897561ae
SHA256

a68e1297fae2bcf854b47ffa444f490353028de1fa2ca713b6cf6cc5aa22b88a
SHA512

eca4b91109d105b2ce8c40710b8e3309c4cc944194843b7930e06daf3d1df6ae85c1b7063036c7e5cd10276e5e5535b33e49930adbad88166228316283d011b8
SSDEEP

1536:kIlL9T5Xx1ogKMvw5Br7KLKLI+Xe+QnyH4Cc0tR6nGVp/VTbkE0DJ4ZwmroV:BtvBOI+FQny5R6nG//SdaZwms

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 3000	2988	rundll32.exe	28
PID 2988 wrote to memory of 3000	2988	rundll32.exe	28
PID 2988 wrote to memory of 3000	2988	rundll32.exe	28
PID 2988 wrote to memory of 3000	2988	rundll32.exe	28
PID 2988 wrote to memory of 3000	2988	rundll32.exe	28
PID 2988 wrote to memory of 3000	2988	rundll32.exe	28
PID 2988 wrote to memory of 3000	2988	rundll32.exe	28

Processes

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\office2019pjb_9435\office2019pjb\OTool\files\Thunder\atl71.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\office2019pjb_9435\office2019pjb\OTool\files\Thunder\atl71.dll,#1
  2⤵
  PID:3000

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads