Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
6Gajim.exe
windows7-x64
7Gajim.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
1$PLUGINSDI...LL.dll
windows10-2004-x64
1$PLUGINSDI...nu.dll
windows7-x64
1$PLUGINSDI...nu.dll
windows10-2004-x64
1$PLUGINSDI...em.dll
windows7-x64
1$PLUGINSDI...em.dll
windows10-2004-x64
1$PLUGINSDI...gs.dll
windows7-x64
1$PLUGINSDI...gs.dll
windows10-2004-x64
1Uninstall.exe
windows7-x64
7Uninstall.exe
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
1$PLUGINSDI...em.dll
windows10-2004-x64
1$PLUGINSDI...gs.dll
windows7-x64
1$PLUGINSDI...gs.dll
windows10-2004-x64
1bin/Gajim-Debug.exe
windows7-x64
1bin/Gajim-Debug.exe
windows10-2004-x64
7bin/Gajim.exe
windows7-x64
1bin/Gajim.exe
windows10-2004-x64
7bin/avcodec-60.dll
windows7-x64
1bin/avcodec-60.dll
windows10-2004-x64
1bin/avfilter-9.dll
windows7-x64
1bin/avfilter-9.dll
windows10-2004-x64
1bin/avformat-60.dll
windows7-x64
1bin/avformat-60.dll
windows10-2004-x64
1bin/avutil-58.dll
windows7-x64
1bin/avutil-58.dll
windows10-2004-x64
1bin/gdbus.exe
windows7-x64
1bin/gdbus.exe
windows10-2004-x64
1bin/gspawn...er.exe
windows7-x64
1bin/gspawn...er.exe
windows10-2004-x64
1Analysis
-
max time kernel
141s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
09/06/2024, 06:58
Behavioral task
behavioral1
Sample
Gajim.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Gajim.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win7-20240215-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240220-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
Uninstall.exe
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
Uninstall.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20231129-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
bin/Gajim-Debug.exe
Resource
win7-20240419-en
Behavioral task
behavioral18
Sample
bin/Gajim-Debug.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
bin/Gajim.exe
Resource
win7-20240215-en
Behavioral task
behavioral20
Sample
bin/Gajim.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
bin/avcodec-60.dll
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
bin/avcodec-60.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral23
Sample
bin/avfilter-9.dll
Resource
win7-20240508-en
Behavioral task
behavioral24
Sample
bin/avfilter-9.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
bin/avformat-60.dll
Resource
win7-20240220-en
Behavioral task
behavioral26
Sample
bin/avformat-60.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
bin/avutil-58.dll
Resource
win7-20240508-en
Behavioral task
behavioral28
Sample
bin/avutil-58.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
bin/gdbus.exe
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
bin/gdbus.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral31
Sample
bin/gspawn-win64-helper.exe
Resource
win7-20231129-en
Behavioral task
behavioral32
Sample
bin/gspawn-win64-helper.exe
Resource
win10v2004-20240426-en
General
-
Target
bin/Gajim.exe
-
Size
373KB
-
MD5
33a90bd70e8bf2527df9f25a0d8168f7
-
SHA1
e642ffbab5e091814ad21d769ab13144d651db15
-
SHA256
4135679db5005bd78bd9207c4c430522a1581da4a80895518deb62a987117ca6
-
SHA512
ce1835811133a605ce4978eed37ee63fb59f27b05bbcfb6ca1256c084cb1f0b472c76d95d4135790779d97b97fad57bd0cc8500b978130acaa10cb52e7213ece
-
SSDEEP
6144:oLY6SNR6nMFeqY+gPe8TxMm1D+9gYuHBaez0q5ItWxL+dxLaJDBjmZ88N+ZdbAi:ISNq8eqY+gPe8TxMmx+9gYuHBLz0aItV
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2804 Gajim.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 2804 Gajim.exe 2804 Gajim.exe 2804 Gajim.exe 2804 Gajim.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 2804 Gajim.exe 2804 Gajim.exe 2804 Gajim.exe 2804 Gajim.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2804 wrote to memory of 1884 2804 Gajim.exe 28 PID 2804 wrote to memory of 1884 2804 Gajim.exe 28 PID 2804 wrote to memory of 1884 2804 Gajim.exe 28 PID 2804 wrote to memory of 2892 2804 Gajim.exe 30 PID 2804 wrote to memory of 2892 2804 Gajim.exe 30 PID 2804 wrote to memory of 2892 2804 Gajim.exe 30 PID 2804 wrote to memory of 2692 2804 Gajim.exe 31 PID 2804 wrote to memory of 2692 2804 Gajim.exe 31 PID 2804 wrote to memory of 2692 2804 Gajim.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\bin\Gajim.exe"C:\Users\Admin\AppData\Local\Temp\bin\Gajim.exe"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"2⤵PID:1884
-
-
C:\Users\Admin\AppData\Local\Temp\bin\gdbus.exe"C:\Users\Admin\AppData\Local\Temp\bin\gdbus.exe" _win32_run_session_bus2⤵PID:2892
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"2⤵PID:2692
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
78B
MD502a3d1861dc756cd3a0afe2966471a99
SHA10df9166680e363e134231bcf120b52c18fb51b04
SHA256d706ef79faf22b9749e2a9d98abb6d2a5bc9312b6df853103580a52f7c73683f
SHA5126460e8940b8617713388ca86761c88e16a1ec0b9f8c988020900d9071212389025c2b9fad4dc486dde7bc7239e49beed48f380373234447955314a859795a051
-
Filesize
16B
MD5bf57e62d9d280652ec380a6b74b9628d
SHA17c565315ddfcf3291f1d53635859c9f2ec6dee9f
SHA256e5b35e853483760e171373db02a5d169e6d37ea1f5bddaa0d82fb49c8ea8eb99
SHA512ee68f14a0c35b2a10a8c6c7c5ca9041f88bb42e41724b6efd9fdf66e08da661efc7a4a8eef4427d0dc721e445eb61b50d10f2e52c90fa6c3220545ddb9e578f8