Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
131s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
02/06/2024, 13:55
Static task
static1
Behavioral task
behavioral1
Sample
9553-Pillars.of.Eternity.CHS.Patch.v2.2.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
9553-Pillars.of.Eternity.CHS.Patch.v2.2.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
9553下载_官方软件下载_最放心的绿色安全下载站.url
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
9553下载_官方软件下载_最放心的绿色安全下载站.url
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
单机游戏下载_最新单机游戏下载.url
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
单机游戏下载_最新单机游戏下载.url
Resource
win10v2004-20240426-en
General
-
Target
9553-Pillars.of.Eternity.CHS.Patch.v2.2.exe
-
Size
7.0MB
-
MD5
7a0d8e4e0e45b061536eb4720c4c0808
-
SHA1
a68c5cfd85430f853e8a45e7e8aea9d4d47f238a
-
SHA256
366463dce96863737f8ca7b44cdbd94e3016e26d330cf59736319d429286b891
-
SHA512
a9b97ce0ae88f9eaa9a3897a91d42623a5eecc8f040649530c89fe893ea02fde76c2adcb23a94ca3439b1c5d5be7a930a9058d9b3767731d2f18da2664edff76
-
SSDEEP
196608:RTdsmxbd+gSP3LV9OTt6XSh1iH52cfyWNR:RpsmbdiV9OMXIiZ26
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000700000002342c-12.dat acprotect -
Loads dropped DLL 1 IoCs
pid Process 224 9553-Pillars.of.Eternity.CHS.Patch.v2.2.exe -
resource yara_rule behavioral2/files/0x000700000002342c-12.dat upx behavioral2/memory/224-19-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/224-22-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/224-21-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/224-17-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/224-23-0x0000000010000000-0x000000001003E000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 224 9553-Pillars.of.Eternity.CHS.Patch.v2.2.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
86KB
MD5114054313070472cd1a6d7d28f7c5002
SHA19a044986e6101df1a126035da7326a50c3fe9a23
SHA256e15d9e1b772fed3db19e67b8d54533d1a2d46a37f8b12702a5892c6b886e9db1
SHA512a2ff8481e89698dae4a1c83404105093472e384d7a3debbd7014e010543e08efc8ebb3f67c8a4ce09029e6b2a8fb7779bb402aae7c9987e61389cd8a72c73522
-
Filesize
19KB
MD57a3ac4ad2f13d7243aaa7077c08e6c3e
SHA117d1c6af9fcc3d9f9f1d3128a5d305b10acbcb7a
SHA256bc4051c9d6535f450a1a4f7cd67016e9446637f0ecff47082e9970a7e2331cd7
SHA5126bcb3b12f9660546a5db3ce9675bbb2f7b8f67ab2a0c6dc5586473566c8d358890b568cadfec78fa6d4e3cb4c8ef0797c4c0d1d2b6b84da9dbed52f4d2ec68ee