Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3feather.exe
windows7-x64
7feather.exe
windows10-2004-x64
7$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3LICENSES.c...m.html
windows7-x64
1LICENSES.c...m.html
windows10-2004-x64
1d3dcompiler_47.dll
windows10-2004-x64
1feather.exe
windows7-x64
1feather.exe
windows10-2004-x64
7ffmpeg.dll
windows7-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows7-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows7-x64
1libGLESv2.dll
windows10-2004-x64
1resources/elevate.exe
windows7-x64
1resources/elevate.exe
windows10-2004-x64
1vk_swiftshader.dll
windows7-x64
1vk_swiftshader.dll
windows10-2004-x64
1vulkan-1.dll
windows7-x64
1vulkan-1.dll
windows10-2004-x64
1$PLUGINSDI...7z.dll
windows7-x64
3$PLUGINSDI...7z.dll
windows10-2004-x64
3Analysis
-
max time kernel
121s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
12/06/2024, 11:53
Static task
static1
Behavioral task
behavioral1
Sample
feather.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
feather.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
LICENSES.chromium.html
Resource
win7-20240611-en
Behavioral task
behavioral8
Sample
LICENSES.chromium.html
Resource
win10v2004-20240611-en
Behavioral task
behavioral9
Sample
d3dcompiler_47.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral10
Sample
feather.exe
Resource
win7-20240220-en
Behavioral task
behavioral11
Sample
feather.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral12
Sample
ffmpeg.dll
Resource
win7-20240508-en
Behavioral task
behavioral13
Sample
ffmpeg.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral14
Sample
libEGL.dll
Resource
win7-20240508-en
Behavioral task
behavioral15
Sample
libEGL.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral16
Sample
libGLESv2.dll
Resource
win7-20231129-en
Behavioral task
behavioral17
Sample
libGLESv2.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral18
Sample
resources/elevate.exe
Resource
win7-20240611-en
Behavioral task
behavioral19
Sample
resources/elevate.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral20
Sample
vk_swiftshader.dll
Resource
win7-20240221-en
Behavioral task
behavioral21
Sample
vk_swiftshader.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral22
Sample
vulkan-1.dll
Resource
win7-20240611-en
Behavioral task
behavioral23
Sample
vulkan-1.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral24
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win7-20240221-en
Behavioral task
behavioral25
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win10v2004-20240508-en
General
-
Target
LICENSES.chromium.html
-
Size
8.8MB
-
MD5
2675b30d524b6c79b6cee41af86fc619
-
SHA1
407716c1bb83c211bcb51efbbcb6bf2ef1664e5b
-
SHA256
6a717038f81271f62318212f00b1a2173b9cb0cc435f984710ac8355eb409081
-
SHA512
3214341da8bf3347a6874535bb0ff8d059ee604e779491780f2b29172f9963e23acbe3c534d888f7a3b99274f46d0628962e1e72a5d3fc6f18ca2b62343df485
-
SSDEEP
24576:cpD6826x5kSWSsRinoHnmfm646a6N6z68SH4SApTJ:cHSek
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424355576" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a039050000000002000000000010660000000100002000000067c8f4c382dec9200ed4cc85f5a4117c38b86a974ae7bfecca5f8473fc45d7f1000000000e80000000020000200000008c3aeed4d287fcd78e9dcce53fbc6745f9c53643272821f6d0874320704000419000000040a07ab3b9a4c6587fae5b565dead8badd2d472b9e7107505a448586413f4a8e47bade2f595fe941081ecc84e69136c70f655a9112b30726618f744307726b14170fb027f9b5b7a3ef81cf2e57dca51c3677f1130b51cd57149f8f4a194b027232c1f2abdd4b4063c57feec2ff89bede4561880bc2316c5a8e47cc81143e5c069963ff4effc6df9e2c3a5718c6e2a39840000000648eaec0b378934d907a732de25edf486f540a0d49b290b8e950cc68943fef74976ed1ed5b1162043cd1674e846ebe559a8592af07d5e6721c7d0ba0da388127 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a039050000000002000000000010660000000100002000000054d389699a8cf897c82aeb8f2f617bb1b5fb8399c6a5a78dd71d2c35e33d428c000000000e8000000002000020000000b40790d2071c0fe72c0eef858cc7c05df931f02ddbcbcc003450a32ab571253620000000ead927db4704eb731a6351ef75f586b5ee0d50048b94f220733b672b244a804840000000fbf8578972063fc86688de08786130211197a70d74d8365ad83dc77b182c663be10586f7f15a49c47205867982913a080658edf529dbeb47ba3f36ab76c58832 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0754d61c0bcda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8C62A211-28B3-11EF-9302-CE03E2754020} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2468 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2468 iexplore.exe 2468 iexplore.exe 2196 IEXPLORE.EXE 2196 IEXPLORE.EXE 2196 IEXPLORE.EXE 2196 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2468 wrote to memory of 2196 2468 iexplore.exe 28 PID 2468 wrote to memory of 2196 2468 iexplore.exe 28 PID 2468 wrote to memory of 2196 2468 iexplore.exe 28 PID 2468 wrote to memory of 2196 2468 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2468 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2196
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bd224227de55cf7ff6deca3ca180b84e
SHA11d0e172505b9c71bf84b832be5259fc54c909f99
SHA2560be196e3c50323f792ad4c05122f9d936e48767a87bd69186f03df9aa4f8ae68
SHA512a5f432c93aca2012a9d4f2f0b6cf273eb92a5141299c883847680353c4d304c98ca7695e08276ff942e35ea1d1af48bc46f9961c5879a3d24183293d537137fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55fe56404e7c73584da530c4a174ddeb0
SHA11108e5aebfdbea74bdbfd781bc81653a56710974
SHA25688cff39142a2c4980e3301e6da637361dec3b4b9f77d7323b564a0d8e969e621
SHA5120b45a7ff2e8b233634fbdf5ad4fa06e6af32b9dc639a9e80f86c90f700e7686333253fc9fc28775bafe50bac12c8600c212131753788fcfa4cf41e8571deee43
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c2e38b108461c01d1d8ac5b7ef7bd035
SHA188e645d6c7637c87e9fa4c841d82bb7c7845f97c
SHA2562eb17c9c5ba87a98cef41a94bf9a5291bacc3736cce363e2763bf45072c8edcb
SHA512bdae7293a1198cb1dc39d8706456dab33ce48ba1209dc69f60aa188c4708a19c0814c07bd934924bec7626324219aee486336f1ef2a8751a4d496dcde1e3b866
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5049eb9893185c104e40f3ab58052cc39
SHA1d041d05a4aa9809f99f8f34f3392e7af2c72f6c2
SHA256e87962a8b03d398d817169482f376185f796ae8f040d2d540e7cc5ac162e5d4d
SHA512fdf83d8d88f0e6921bb95267f6a99987bf2def92d0aad8a6f149ffddee95c109b8e07b2a3054c7504b4de4a448274d63e235fdeaa8b1661401abf27940e008e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a9bbb58846d7f10dc1b476c182ff6039
SHA10836d08a51716c1cd7f69fb2d5b68931cdb82eff
SHA2568d0bb2c05e005abb368168c3e2155d8ae94d42838e9f002707c36b2df1751e40
SHA512436214851cf344bd1527e12ec20d19f7dd68ff3f62ccc5c076e1353bcf99d86f9f58b0fc0d2ad6f779ed0c5cdb1be0561d9424ee8ec7f0152c7905e2bf80c611
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD569c4fe063dace3c447eacb3b199e307b
SHA1a60327d46a222db81e236864faa90e6818e861f0
SHA2564d71773f4fd19ae3bfb106f7fbfa8075d7d4ce64324ab49b4397aa14dbba8db7
SHA5125089d4e2ef6925327f75a45e040d3c624bb2f706c8b8d08b06ec414de80d512317140a411306f424bb06156c07349e9db6d2540afde4192aabbb11b8a497a8d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50d1823bc41717af83c6cb55b92d56a6c
SHA1d0654b8851db55b3b0484e0bc177bcdcaafe4381
SHA25633ad76ccc75ccd9e5bf9ed31b2b7db3fac4180ba58eda1c865a04db5c6221542
SHA5129482a427cd43fff297bacaf9b32290a861c48cae24ecc47950391c48ea50e96a627de0441ac5ca52e7607c981ebb5064ab74494c90267789b0dcdad9dd76829b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50ae1329a1ff9a4c12ad1e7a35ca6e188
SHA1ac74b98c3f16b026d2530d49ae675ec24c02cab4
SHA256ee89583dab7301ac9d8cacb9508630773a33ef011a1f70e4f733c8f53203c2d8
SHA5129e8133ab0c75710a7dbd56bc1db3547381aa421afa13c92c34a30dd318e21d12e8162ea92ad654c4a80ec46020bd33a4e34b689f6306def1b7bca3847ee45c29
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a58ec6d47606783091026a8164c5b1b4
SHA1a5f83bdd8b77535cb994a87e9858ffeb239009d8
SHA2567457a6dc5f7c1ed8ed97d926dace1a8ead5ad7bd0bb0b3f04350ad1d0234dbf2
SHA5120d86671ec04b0fd5fa50ce55b98eb6489064707d59341db0bd3a7ef7b778bdd1140c52f77c7bdc16443e7e1243a62f40f1cdc86386beef181dc870aee24c6999
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55ab1e93b381367f0c81aa5f6e0a7a149
SHA150eca3ed660d749d39a472a67306e68895401ddf
SHA2561a51a6b8d0217b5ae6e56d885ec3fd0ae2391512bb24b71e151d7de2223c4c11
SHA5120df497e19f881849961d103165b66307a31f04c73113cf272df791fa0500b6fb2dc8c87201d0ff008b653c30db3760576559ae244fc90cd4f1b45ff5c264dc33
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5399550ed2b838c140ed8269a559c2662
SHA17e879f5f317729eebba479ddd8e30fe27b9baf6b
SHA25630ddf80c1567620c76e9fe50ce9a931433ed03c34226195a239465e8eda112be
SHA512798e44f289cf2696133a05d487517fa2676d48c2008382e20c539c15171a10200f5f28efb1d78605f63670efe3534c7375f4b0b3bab881248f048df6f2ced584
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD551a5a43b5c1413e331d7e6159d594e8c
SHA1d24113c883655d88fcc8f88844987ebb1ff69882
SHA256bc1fe93c5e18cb25c085bc6599e840f9ea7e30a5e34d555a06808081f556dcff
SHA5122f00c98a5cfe937f03b4354e230b5381681206e0a47fd59e9fcfa303de35e21ec5bb04f9b0ba5548ab7e06b8a6f7721d2f75e8c4af733be1470894de2c0cc52b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a9447e11dce7e1686bb3c623ff9b484c
SHA1e838246fcdb810bc01f2f2e6f9ee6e35e4ec0557
SHA25646316957d09bbab0d17a13cfa24f2715f12c1369243f10655e85fa98cba38225
SHA512e22d4a6f835095ca5d69df92312815634ca48d20d886aca348ee1938d90caa6a6750235f20389466336a681817bb713fef2f12f1fbef750b3c296931647f5609
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b