Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
8Static
static
7office2019...us.exe
windows7-x64
1office2019...us.exe
windows10-2004-x64
1office2019...za.dll
windows7-x64
3office2019...za.dll
windows10-2004-x64
3office2019...za.exe
windows7-x64
1office2019...za.exe
windows10-2004-x64
1office2019...xa.dll
windows7-x64
3office2019...xa.dll
windows10-2004-x64
3office2019...rm.exe
windows7-x64
7office2019...rm.exe
windows10-2004-x64
7office2019...2c.exe
windows7-x64
1office2019...2c.exe
windows10-2004-x64
1office2019...71.dll
windows7-x64
1office2019...71.dll
windows10-2004-x64
1office2019...id.dll
windows7-x64
1office2019...id.dll
windows10-2004-x64
1office2019...ne.dll
windows7-x64
7office2019...ne.dll
windows10-2004-x64
7office2019...71.dll
windows7-x64
3office2019...71.dll
windows10-2004-x64
3office2019...71.dll
windows7-x64
3office2019...71.dll
windows10-2004-x64
3office2019...dl.dll
windows7-x64
7office2019...dl.dll
windows10-2004-x64
7office2019...b1.dll
windows7-x64
7office2019...b1.dll
windows10-2004-x64
7office2019...PP.vbs
windows7-x64
8office2019...PP.vbs
windows10-2004-x64
8office2019...cn.vbs
windows7-x64
8office2019...cn.vbs
windows10-2004-x64
8office2019...RM.exe
windows7-x64
1office2019...RM.exe
windows10-2004-x64
1Analysis
-
max time kernel
92s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
13/05/2024, 11:56
Behavioral task
behavioral1
Sample
office2019pjb_9435/office2019pjb/OTool/Office Tool Plus.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
office2019pjb_9435/office2019pjb/OTool/Office Tool Plus.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
office2019pjb_9435/office2019pjb/OTool/files/7-zip/7za.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
office2019pjb_9435/office2019pjb/OTool/files/7-zip/7za.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
office2019pjb_9435/office2019pjb/OTool/files/7-zip/7za.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
office2019pjb_9435/office2019pjb/OTool/files/7-zip/7za.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
office2019pjb_9435/office2019pjb/OTool/files/7-zip/7zxa.dll
Resource
win7-20240215-en
Behavioral task
behavioral8
Sample
office2019pjb_9435/office2019pjb/OTool/files/7-zip/7zxa.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
office2019pjb_9435/office2019pjb/OTool/files/Thunder/MiniThunderPlatform.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
office2019pjb_9435/office2019pjb/OTool/files/Thunder/MiniThunderPlatform.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
office2019pjb_9435/office2019pjb/OTool/files/Thunder/aria2c.exe
Resource
win7-20231129-en
Behavioral task
behavioral12
Sample
office2019pjb_9435/office2019pjb/OTool/files/Thunder/aria2c.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral13
Sample
office2019pjb_9435/office2019pjb/OTool/files/Thunder/atl71.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
office2019pjb_9435/office2019pjb/OTool/files/Thunder/atl71.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
office2019pjb_9435/office2019pjb/OTool/files/Thunder/dl_peer_id.dll
Resource
win7-20240419-en
Behavioral task
behavioral16
Sample
office2019pjb_9435/office2019pjb/OTool/files/Thunder/dl_peer_id.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
office2019pjb_9435/office2019pjb/OTool/files/Thunder/download_engine.dll
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
office2019pjb_9435/office2019pjb/OTool/files/Thunder/download_engine.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
office2019pjb_9435/office2019pjb/OTool/files/Thunder/msvcp71.dll
Resource
win7-20240419-en
Behavioral task
behavioral20
Sample
office2019pjb_9435/office2019pjb/OTool/files/Thunder/msvcp71.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
office2019pjb_9435/office2019pjb/OTool/files/Thunder/msvcr71.dll
Resource
win7-20240508-en
Behavioral task
behavioral22
Sample
office2019pjb_9435/office2019pjb/OTool/files/Thunder/msvcr71.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral23
Sample
office2019pjb_9435/office2019pjb/OTool/files/Thunder/xldl.dll
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
office2019pjb_9435/office2019pjb/OTool/files/Thunder/xldl.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
office2019pjb_9435/office2019pjb/OTool/files/Thunder/zlib1.dll
Resource
win7-20231129-en
Behavioral task
behavioral26
Sample
office2019pjb_9435/office2019pjb/OTool/files/Thunder/zlib1.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral27
Sample
office2019pjb_9435/office2019pjb/OTool/files/activate/OSPP.vbs
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
office2019pjb_9435/office2019pjb/OTool/files/activate/OSPP.vbs
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
office2019pjb_9435/office2019pjb/OTool/files/activate/OSPP.zh-cn.vbs
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
office2019pjb_9435/office2019pjb/OTool/files/activate/OSPP.zh-cn.vbs
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
office2019pjb_9435/office2019pjb/OTool/files/activate/OSPPREARM.exe
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
office2019pjb_9435/office2019pjb/OTool/files/activate/OSPPREARM.exe
Resource
win10v2004-20240508-en
General
-
Target
office2019pjb_9435/office2019pjb/OTool/files/Thunder/download_engine.dll
-
Size
875KB
-
MD5
c818df90f4eda9a4a048dd656d0a4ea7
-
SHA1
79d66f736df36b689ae9c3c4fd382d15f1dbcdba
-
SHA256
677596b043cfe0bcacf19d60ba202696b95830adecdeb2a3054fc625479623ec
-
SHA512
21382150e1ccf35559c1929d0fb482a9361cff869b500ceaa9c0a07928a66fa9fd28b767346877ffb02b87eea8b3e6e00f658c02243b33cd860adc288c7f600c
-
SSDEEP
24576:3Ong+jST5mDj6BJGOz36LAtvhb6t6x+8Bv1a:NzM3uZz368tvJ91a
Malware Config
Signatures
-
resource yara_rule behavioral18/memory/1016-1-0x00000000215B0000-0x00000000215C6000-memory.dmp upx behavioral18/memory/1016-0-0x0000000010000000-0x0000000010383000-memory.dmp upx behavioral18/memory/1016-3-0x00000000215B0000-0x00000000215C6000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4256 wrote to memory of 1016 4256 rundll32.exe 83 PID 4256 wrote to memory of 1016 4256 rundll32.exe 83 PID 4256 wrote to memory of 1016 4256 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\office2019pjb_9435\office2019pjb\OTool\files\Thunder\download_engine.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\office2019pjb_9435\office2019pjb\OTool\files\Thunder\download_engine.dll,#12⤵PID:1016
-