Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
8Static
static
3a936074587...18.exe
windows7-x64
6a936074587...18.exe
windows10-2004-x64
6$PLUGINSDI...nt.dll
windows7-x64
3$PLUGINSDI...nt.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDI...0_.dll
windows7-x64
1$PLUGINSDI...0_.dll
windows10-2004-x64
1$PLUGINSDI...os.dll
windows7-x64
3$PLUGINSDI...os.dll
windows10-2004-x64
3$PLUGINSDI...18.exe
windows7-x64
8$PLUGINSDI...18.exe
windows10-2004-x64
8$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...16.exe
windows7-x64
4$PLUGINSDI...16.exe
windows10-2004-x64
4$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$TEMP/Goog...69.exe
windows7-x64
4$TEMP/Goog...69.exe
windows10-2004-x64
4$PLUGINSDI...ll.dll
windows7-x64
1$PLUGINSDI...ll.dll
windows10-2004-x64
1$PLUGINSDI...5.html
windows7-x64
1$PLUGINSDI...5.html
windows10-2004-x64
1$PLUGINSDI...6.html
windows7-x64
1$PLUGINSDI...6.html
windows10-2004-x64
1$PLUGINSDI...7.html
windows7-x64
1$PLUGINSDI...7.html
windows10-2004-x64
1$PLUGINSDI...8.html
windows7-x64
1$PLUGINSDI...8.html
windows10-2004-x64
1Analysis
-
max time kernel
124s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
14/06/2024, 10:32
Static task
static1
Behavioral task
behavioral1
Sample
a9360745871d11e86208dfc05389ed87_JaffaCakes118.exe
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral2
Sample
a9360745871d11e86208dfc05389ed87_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/ButtonEvent.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/ButtonEvent.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/a/$_110_.dll
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/a/$_110_.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
$PLUGINSDIR/execDos.dll
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral12
Sample
$PLUGINSDIR/execDos.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
$PLUGINSDIR/g/PF-Chrome-2018.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral14
Sample
$PLUGINSDIR/g/PF-Chrome-2018.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral16
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
$PLUGINSDIR/g/PF-Toolbar-2016.exe
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral18
Sample
$PLUGINSDIR/g/PF-Toolbar-2016.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral20
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
$TEMP/GoogleUpdateSetup_1.3.21.169.exe
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral22
Sample
$TEMP/GoogleUpdateSetup_1.3.21.169.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
$PLUGINSDIR/g/gcapi_dll.dll
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral24
Sample
$PLUGINSDIR/g/gcapi_dll.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
$PLUGINSDIR/g/gcombo/ComboOffer_1025.html
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral26
Sample
$PLUGINSDIR/g/gcombo/ComboOffer_1025.html
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
$PLUGINSDIR/g/gcombo/ComboOffer_1026.html
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral28
Sample
$PLUGINSDIR/g/gcombo/ComboOffer_1026.html
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
$PLUGINSDIR/g/gcombo/ComboOffer_1027.html
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral30
Sample
$PLUGINSDIR/g/gcombo/ComboOffer_1027.html
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
$PLUGINSDIR/g/gcombo/ComboOffer_1028.html
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral32
Sample
$PLUGINSDIR/g/gcombo/ComboOffer_1028.html
Resource
win10v2004-20240508-en
windows10-2004-x64
General
-
Target
$TEMP/GoogleUpdateSetup_1.3.21.169.exe
-
Size
799KB
-
MD5
7abad5635830cb8af3ea5b88e76f728d
-
SHA1
7809cb7c62fb6c95e7dd244bc480f3f93e695a25
-
SHA256
27785c7b3825d73149794527a8be2dbdedd737ad3d47ecc6eb30be7546c1bdff
-
SHA512
09c3e2b4726974db4ffd46c58f7177a52fcea2c85a8a22196555cfeefda7c6f4cb453de196f919a1e2ca2441379a36a9b40bb3d70d64c4148c31b58d0ce50be3
-
SSDEEP
12288:wSAQRtXumsaKQ912aA+o8kohKldN8NDSjcX2HdhhMxI7NGfWna490XAsNy+0O:wSA8teemzL8vKfNGSGq7NGen990xys
Malware Config
Signatures
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_da.dll GoogleUpdateSetup_1.3.21.169.exe File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_en-GB.dll GoogleUpdateSetup_1.3.21.169.exe File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_et.dll GoogleUpdateSetup_1.3.21.169.exe File created C:\Program Files (x86)\GUME7A1.tmp\psmachine.dll GoogleUpdateSetup_1.3.21.169.exe File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_ja.dll GoogleUpdateSetup_1.3.21.169.exe File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_no.dll GoogleUpdateSetup_1.3.21.169.exe File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_sk.dll GoogleUpdateSetup_1.3.21.169.exe File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_te.dll GoogleUpdateSetup_1.3.21.169.exe File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_zh-TW.dll GoogleUpdateSetup_1.3.21.169.exe File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_fr.dll GoogleUpdateSetup_1.3.21.169.exe File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_es-419.dll GoogleUpdateSetup_1.3.21.169.exe File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_hi.dll GoogleUpdateSetup_1.3.21.169.exe File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_id.dll GoogleUpdateSetup_1.3.21.169.exe File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_iw.dll GoogleUpdateSetup_1.3.21.169.exe File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_sw.dll GoogleUpdateSetup_1.3.21.169.exe File created C:\Program Files (x86)\GUME7A1.tmp\GoogleUpdateOnDemand.exe GoogleUpdateSetup_1.3.21.169.exe File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_lt.dll GoogleUpdateSetup_1.3.21.169.exe File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_pl.dll GoogleUpdateSetup_1.3.21.169.exe File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_pt-BR.dll GoogleUpdateSetup_1.3.21.169.exe File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_bn.dll GoogleUpdateSetup_1.3.21.169.exe File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_ms.dll GoogleUpdateSetup_1.3.21.169.exe File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_ru.dll GoogleUpdateSetup_1.3.21.169.exe File created C:\Program Files (x86)\GUME7A1.tmp\GoogleUpdateHelper.msi GoogleUpdateSetup_1.3.21.169.exe File created C:\Program Files (x86)\GUME7A1.tmp\GoogleCrashHandler.exe GoogleUpdateSetup_1.3.21.169.exe File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_gu.dll GoogleUpdateSetup_1.3.21.169.exe File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_sl.dll GoogleUpdateSetup_1.3.21.169.exe File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_th.dll GoogleUpdateSetup_1.3.21.169.exe File created C:\Program Files (x86)\GUME7A1.tmp\GoogleUpdate.exe GoogleUpdateSetup_1.3.21.169.exe File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_ro.dll GoogleUpdateSetup_1.3.21.169.exe File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_vi.dll GoogleUpdateSetup_1.3.21.169.exe File created C:\Program Files (x86)\GUME7A1.tmp\GoogleUpdateBroker.exe GoogleUpdateSetup_1.3.21.169.exe File opened for modification C:\Program Files (x86)\GUME7A1.tmp\GoogleUpdateSetup.exe GoogleUpdateSetup_1.3.21.169.exe File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_mr.dll GoogleUpdateSetup_1.3.21.169.exe File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_is.dll GoogleUpdateSetup_1.3.21.169.exe File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_it.dll GoogleUpdateSetup_1.3.21.169.exe File created C:\Program Files (x86)\GUME7A1.tmp\GoogleUpdateSetup.exe GoogleUpdateSetup_1.3.21.169.exe File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_ca.dll GoogleUpdateSetup_1.3.21.169.exe File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_am.dll GoogleUpdateSetup_1.3.21.169.exe File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_fa.dll GoogleUpdateSetup_1.3.21.169.exe File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_sr.dll GoogleUpdateSetup_1.3.21.169.exe File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_uk.dll GoogleUpdateSetup_1.3.21.169.exe File opened for modification C:\Program Files (x86)\GUTE7A2.tmp GoogleUpdateSetup_1.3.21.169.exe File created C:\Program Files (x86)\GUME7A1.tmp\goopdate.dll GoogleUpdateSetup_1.3.21.169.exe File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_en.dll GoogleUpdateSetup_1.3.21.169.exe File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_kn.dll GoogleUpdateSetup_1.3.21.169.exe File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_ml.dll GoogleUpdateSetup_1.3.21.169.exe File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_nl.dll GoogleUpdateSetup_1.3.21.169.exe File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_pt-PT.dll GoogleUpdateSetup_1.3.21.169.exe File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_el.dll GoogleUpdateSetup_1.3.21.169.exe File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_fil.dll GoogleUpdateSetup_1.3.21.169.exe File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_ko.dll GoogleUpdateSetup_1.3.21.169.exe File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_lv.dll GoogleUpdateSetup_1.3.21.169.exe File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_sv.dll GoogleUpdateSetup_1.3.21.169.exe File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_es.dll GoogleUpdateSetup_1.3.21.169.exe File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_bg.dll GoogleUpdateSetup_1.3.21.169.exe File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_cs.dll GoogleUpdateSetup_1.3.21.169.exe File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_fi.dll GoogleUpdateSetup_1.3.21.169.exe File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_hr.dll GoogleUpdateSetup_1.3.21.169.exe File created C:\Program Files (x86)\GUME7A1.tmp\npGoogleUpdate3.dll GoogleUpdateSetup_1.3.21.169.exe File created C:\Program Files (x86)\GUME7A1.tmp\GoogleCrashHandler64.exe GoogleUpdateSetup_1.3.21.169.exe File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_ar.dll GoogleUpdateSetup_1.3.21.169.exe File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_de.dll GoogleUpdateSetup_1.3.21.169.exe File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_hu.dll GoogleUpdateSetup_1.3.21.169.exe File created C:\Program Files (x86)\GUME7A1.tmp\goopdateres_ta.dll GoogleUpdateSetup_1.3.21.169.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe"C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleUpdateSetup_1.3.21.169.exe"1⤵
- Drops file in Program Files directory
PID:2880
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3584,i,6041070687820623968,3004230300437737550,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:81⤵PID:1732