Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3PlayGames_1.1.5.exe
windows10-1703-x64
7$PLUGINSDI...er.dll
windows10-1703-x64
1$PLUGINSDI...ls.dll
windows10-1703-x64
3$PLUGINSDI...em.dll
windows10-1703-x64
3LICENSES.c...m.html
windows10-1703-x64
1d3dcompiler_47.dll
windows10-1703-x64
1felipe.exe
windows10-1703-x64
7ffmpeg.dll
windows10-1703-x64
1libEGL.dll
windows10-1703-x64
1libGLESv2.dll
windows10-1703-x64
1locales/af.ps1
windows10-1703-x64
3locales/uk.ps1
windows10-1703-x64
3resources/elevate.exe
windows10-1703-x64
1vk_swiftshader.dll
windows10-1703-x64
1vulkan-1.dll
windows10-1703-x64
1$PLUGINSDI...ec.dll
windows10-1703-x64
3$PLUGINSDI...ss.dll
windows10-1703-x64
3$PLUGINSDI...7z.dll
windows10-1703-x64
3$R0/Uninst...pe.exe
windows10-1703-x64
7$PLUGINSDI...ls.dll
windows10-1703-x64
3$PLUGINSDI...em.dll
windows10-1703-x64
3$PLUGINSDIR/UAC.dll
windows10-1703-x64
3$PLUGINSDI...ll.dll
windows10-1703-x64
3$PLUGINSDI...ec.dll
windows10-1703-x64
3$PLUGINSDI...ss.dll
windows10-1703-x64
3Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
16/05/2024, 17:46
Static task
static1
Behavioral task
behavioral1
Sample
PlayGames_1.1.5.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral2
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral5
Sample
LICENSES.chromium.html
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral6
Sample
d3dcompiler_47.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral7
Sample
felipe.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral8
Sample
ffmpeg.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral9
Sample
libEGL.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral10
Sample
libGLESv2.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral11
Sample
locales/af.ps1
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral12
Sample
locales/uk.ps1
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral13
Sample
resources/elevate.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral14
Sample
vk_swiftshader.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral15
Sample
vulkan-1.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral16
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral17
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral18
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral19
Sample
$R0/Uninstall felipe.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral20
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral21
Sample
$PLUGINSDIR/System.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral22
Sample
$PLUGINSDIR/UAC.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral23
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral24
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral25
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win10-20240404-en
windows10-1703-x64
General
-
Target
felipe.exe
-
Size
152.7MB
-
MD5
19ce72230b3b6bfd9d879d32bb392684
-
SHA1
1ab8028bd918aefdc91570f933f93d5548324601
-
SHA256
91eee2b2dea04bbc78c9bbccf05b3698e0a12f691cce42986e16db0ab10e853f
-
SHA512
03da8b5fbef54f3b2aeeead91a0a0550e153b9e523835933a2ca9876f8000fba7f0cc5fc632ed83c4d4dc5a1c1d9443416eaeed5b478dbe862cf608cf074f284
-
SSDEEP
1572864:KLBZB52nvuZ7wVuMbgR7Sp6kYdEctmhoLsPagBsgkx52HYhwj+vfIBUdoJnP9Dj0:KypCmJctBjj2+Jv
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
pid Process 4708 felipe.exe 4708 felipe.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 ipinfo.io -
pid Process 512 powershell.exe 4156 powershell.exe 4304 powershell.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
pid Process 512 powershell.exe 4304 powershell.exe 4156 powershell.exe 512 powershell.exe 4304 powershell.exe 4156 powershell.exe 4156 powershell.exe 512 powershell.exe 4304 powershell.exe 504 felipe.exe 504 felipe.exe 788 felipe.exe 788 felipe.exe 788 felipe.exe 788 felipe.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4304 powershell.exe Token: SeDebugPrivilege 512 powershell.exe Token: SeDebugPrivilege 4156 powershell.exe Token: SeShutdownPrivilege 4708 felipe.exe Token: SeCreatePagefilePrivilege 4708 felipe.exe Token: SeIncreaseQuotaPrivilege 4304 powershell.exe Token: SeSecurityPrivilege 4304 powershell.exe Token: SeTakeOwnershipPrivilege 4304 powershell.exe Token: SeLoadDriverPrivilege 4304 powershell.exe Token: SeSystemProfilePrivilege 4304 powershell.exe Token: SeSystemtimePrivilege 4304 powershell.exe Token: SeProfSingleProcessPrivilege 4304 powershell.exe Token: SeIncBasePriorityPrivilege 4304 powershell.exe Token: SeCreatePagefilePrivilege 4304 powershell.exe Token: SeBackupPrivilege 4304 powershell.exe Token: SeRestorePrivilege 4304 powershell.exe Token: SeShutdownPrivilege 4304 powershell.exe Token: SeDebugPrivilege 4304 powershell.exe Token: SeSystemEnvironmentPrivilege 4304 powershell.exe Token: SeRemoteShutdownPrivilege 4304 powershell.exe Token: SeUndockPrivilege 4304 powershell.exe Token: SeManageVolumePrivilege 4304 powershell.exe Token: 33 4304 powershell.exe Token: 34 4304 powershell.exe Token: 35 4304 powershell.exe Token: 36 4304 powershell.exe Token: SeIncreaseQuotaPrivilege 512 powershell.exe Token: SeSecurityPrivilege 512 powershell.exe Token: SeTakeOwnershipPrivilege 512 powershell.exe Token: SeLoadDriverPrivilege 512 powershell.exe Token: SeSystemProfilePrivilege 512 powershell.exe Token: SeSystemtimePrivilege 512 powershell.exe Token: SeProfSingleProcessPrivilege 512 powershell.exe Token: SeIncBasePriorityPrivilege 512 powershell.exe Token: SeCreatePagefilePrivilege 512 powershell.exe Token: SeBackupPrivilege 512 powershell.exe Token: SeRestorePrivilege 512 powershell.exe Token: SeShutdownPrivilege 512 powershell.exe Token: SeDebugPrivilege 512 powershell.exe Token: SeSystemEnvironmentPrivilege 512 powershell.exe Token: SeRemoteShutdownPrivilege 512 powershell.exe Token: SeUndockPrivilege 512 powershell.exe Token: SeManageVolumePrivilege 512 powershell.exe Token: 33 512 powershell.exe Token: 34 512 powershell.exe Token: 35 512 powershell.exe Token: 36 512 powershell.exe Token: SeShutdownPrivilege 4708 felipe.exe Token: SeCreatePagefilePrivilege 4708 felipe.exe Token: SeShutdownPrivilege 4708 felipe.exe Token: SeCreatePagefilePrivilege 4708 felipe.exe Token: SeShutdownPrivilege 4708 felipe.exe Token: SeCreatePagefilePrivilege 4708 felipe.exe Token: SeShutdownPrivilege 4708 felipe.exe Token: SeCreatePagefilePrivilege 4708 felipe.exe Token: SeShutdownPrivilege 4708 felipe.exe Token: SeCreatePagefilePrivilege 4708 felipe.exe Token: SeShutdownPrivilege 4708 felipe.exe Token: SeCreatePagefilePrivilege 4708 felipe.exe Token: SeShutdownPrivilege 4708 felipe.exe Token: SeCreatePagefilePrivilege 4708 felipe.exe Token: SeShutdownPrivilege 4708 felipe.exe Token: SeCreatePagefilePrivilege 4708 felipe.exe Token: SeShutdownPrivilege 4708 felipe.exe -
Suspicious use of WriteProcessMemory 51 IoCs
description pid Process procid_target PID 4708 wrote to memory of 4336 4708 felipe.exe 72 PID 4708 wrote to memory of 4336 4708 felipe.exe 72 PID 4336 wrote to memory of 2340 4336 cmd.exe 74 PID 4336 wrote to memory of 2340 4336 cmd.exe 74 PID 4708 wrote to memory of 1272 4708 felipe.exe 75 PID 4708 wrote to memory of 1272 4708 felipe.exe 75 PID 4708 wrote to memory of 512 4708 felipe.exe 77 PID 4708 wrote to memory of 512 4708 felipe.exe 77 PID 4708 wrote to memory of 4304 4708 felipe.exe 78 PID 4708 wrote to memory of 4304 4708 felipe.exe 78 PID 4708 wrote to memory of 4156 4708 felipe.exe 79 PID 4708 wrote to memory of 4156 4708 felipe.exe 79 PID 4708 wrote to memory of 2848 4708 felipe.exe 83 PID 4708 wrote to memory of 2848 4708 felipe.exe 83 PID 4708 wrote to memory of 2848 4708 felipe.exe 83 PID 4708 wrote to memory of 2848 4708 felipe.exe 83 PID 4708 wrote to memory of 2848 4708 felipe.exe 83 PID 4708 wrote to memory of 2848 4708 felipe.exe 83 PID 4708 wrote to memory of 2848 4708 felipe.exe 83 PID 4708 wrote to memory of 2848 4708 felipe.exe 83 PID 4708 wrote to memory of 2848 4708 felipe.exe 83 PID 4708 wrote to memory of 2848 4708 felipe.exe 83 PID 4708 wrote to memory of 2848 4708 felipe.exe 83 PID 4708 wrote to memory of 2848 4708 felipe.exe 83 PID 4708 wrote to memory of 2848 4708 felipe.exe 83 PID 4708 wrote to memory of 2848 4708 felipe.exe 83 PID 4708 wrote to memory of 2848 4708 felipe.exe 83 PID 4708 wrote to memory of 2848 4708 felipe.exe 83 PID 4708 wrote to memory of 2848 4708 felipe.exe 83 PID 4708 wrote to memory of 2848 4708 felipe.exe 83 PID 4708 wrote to memory of 2848 4708 felipe.exe 83 PID 4708 wrote to memory of 2848 4708 felipe.exe 83 PID 4708 wrote to memory of 2848 4708 felipe.exe 83 PID 4708 wrote to memory of 2848 4708 felipe.exe 83 PID 4708 wrote to memory of 2848 4708 felipe.exe 83 PID 4708 wrote to memory of 2848 4708 felipe.exe 83 PID 4708 wrote to memory of 2848 4708 felipe.exe 83 PID 4708 wrote to memory of 2848 4708 felipe.exe 83 PID 4708 wrote to memory of 2848 4708 felipe.exe 83 PID 4708 wrote to memory of 2848 4708 felipe.exe 83 PID 4708 wrote to memory of 2848 4708 felipe.exe 83 PID 4708 wrote to memory of 2848 4708 felipe.exe 83 PID 4708 wrote to memory of 2848 4708 felipe.exe 83 PID 4708 wrote to memory of 504 4708 felipe.exe 84 PID 4708 wrote to memory of 504 4708 felipe.exe 84 PID 4708 wrote to memory of 1824 4708 felipe.exe 86 PID 4708 wrote to memory of 1824 4708 felipe.exe 86 PID 1824 wrote to memory of 1780 1824 cmd.exe 88 PID 1824 wrote to memory of 1780 1824 cmd.exe 88 PID 4708 wrote to memory of 788 4708 felipe.exe 89 PID 4708 wrote to memory of 788 4708 felipe.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\felipe.exe"C:\Users\Admin\AppData\Local\Temp\felipe.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp"2⤵
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Windows\system32\chcp.comchcp3⤵PID:2340
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"2⤵PID:1272
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:512
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4304
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4156
-
-
C:\Users\Admin\AppData\Local\Temp\felipe.exe"C:\Users\Admin\AppData\Local\Temp\felipe.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\felipe" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1788 --field-trial-handle=1792,i,12122784930836182014,15052828861708891471,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵PID:2848
-
-
C:\Users\Admin\AppData\Local\Temp\felipe.exe"C:\Users\Admin\AppData\Local\Temp\felipe.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\felipe" --mojo-platform-channel-handle=1848 --field-trial-handle=1792,i,12122784930836182014,15052828861708891471,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:504
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""2⤵
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Windows\system32\findstr.exefindstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"3⤵PID:1780
-
-
-
C:\Users\Admin\AppData\Local\Temp\felipe.exe"C:\Users\Admin\AppData\Local\Temp\felipe.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\felipe" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2304 --field-trial-handle=1792,i,12122784930836182014,15052828861708891471,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:788
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5900713b658f108100bb7aa144134dbca
SHA17a05dd4d5cd03542c5187c8a3036f30b9d79daf0
SHA256c59ad3c5b09e5adab5c6d20e70fc87edce830a1e696ea2b49b51fe99ae084da8
SHA51285a5b109a01035e1ac4dec839f6b84bd6a141c6938e51f78915748a9a593b011367f1d8c7c72060a986f993ca3206fde30929b18be8d51d60cc1525a73613f8d
-
Filesize
2KB
MD5c373cdb8236bb363319af570bd628dfc
SHA14f756c7d4a6f6e8494bd884bb9e00646e84e119b
SHA25668d7a477b2bc5a4bf0f3894860999fa442a5b8653579f8173391dcc43dcbaf47
SHA512cf8b041f6bfa9608191750a577bd86573656a017af61882db73f3e1f639411855038e3b761965cf04b26a0c0bbec1b6320482e787b7d667e0450c8ffb9ef1ee9
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
Filesize
137KB
MD504bfbfec8db966420fe4c7b85ebb506a
SHA1939bb742a354a92e1dcd3661a62d69e48030a335
SHA256da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd
SHA5124ea97a9a120ed5bee8638e0a69561c2159fc3769062d7102167b0e92b4f1a5c002a761bd104282425f6cee8d0e39dbe7e12ad4e4a38570c3f90f31b65072dd65
-
Filesize
1.8MB
MD566a65322c9d362a23cf3d3f7735d5430
SHA1ed59f3e4b0b16b759b866ef7293d26a1512b952e
SHA256f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c
SHA5120a44d12852fc4c74658a49f886c4bc7c715c48a7cb5a3dcf40c9f1d305ca991dd2c2cb3d0b5fd070b307a8f331938c5213188cbb2d27d47737cc1c4f34a1ea21