Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
7Archivariu...A3.dll
windows7-x64
1Archivariu...A3.dll
windows10-2004-x64
3Archivariu...ll.dll
windows7-x64
1Archivariu...ll.dll
windows10-2004-x64
1Archivariu...AI.dll
windows7-x64
6Archivariu...AI.dll
windows10-2004-x64
3Archivariu...00.exe
windows7-x64
6Archivariu...00.exe
windows10-2004-x64
1Archivariu...st.vbs
windows7-x64
1Archivariu...st.vbs
windows10-2004-x64
1Archivariu...ut.htm
windows7-x64
1Archivariu...ut.htm
windows10-2004-x64
1Archivariu...ts.htm
windows7-x64
1Archivariu...ts.htm
windows10-2004-x64
1Archivariu...te.htm
windows7-x64
1Archivariu...te.htm
windows10-2004-x64
1Archivariu...es.htm
windows7-x64
1Archivariu...es.htm
windows10-2004-x64
1Archivariu...ex.htm
windows7-x64
1Archivariu...ex.htm
windows10-2004-x64
1Archivariu...es.htm
windows7-x64
1Archivariu...es.htm
windows10-2004-x64
1Archivariu...ys.htm
windows7-x64
1Archivariu...ys.htm
windows10-2004-x64
1Archivariu...ng.htm
windows7-x64
1Archivariu...ng.htm
windows10-2004-x64
1Archivariu...es.htm
windows7-x64
1Archivariu...es.htm
windows10-2004-x64
1Archivariu...ts.htm
windows7-x64
1Archivariu...ts.htm
windows10-2004-x64
1Archivariu...er.htm
windows7-x64
1Archivariu...er.htm
windows10-2004-x64
1Analysis
-
max time kernel
140s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
25/06/2024, 16:31
Behavioral task
behavioral1
Sample
Archivarius 3000/A3.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Archivarius 3000/A3.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
Archivarius 3000/A3Shell.dll
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
Archivarius 3000/A3Shell.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
Archivarius 3000/AI.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
Archivarius 3000/AI.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
Archivarius 3000/Archivarius3000.exe
Resource
win7-20240611-en
Behavioral task
behavioral8
Sample
Archivarius 3000/Archivarius3000.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral9
Sample
Archivarius 3000/Data/StopList.vbs
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
Archivarius 3000/Data/StopList.vbs
Resource
win10v2004-20240611-en
Behavioral task
behavioral11
Sample
Archivarius 3000/Help/Dutch/About.htm
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
Archivarius 3000/Help/Dutch/About.htm
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
Archivarius 3000/Help/Dutch/Contacts.htm
Resource
win7-20240419-en
Behavioral task
behavioral14
Sample
Archivarius 3000/Help/Dutch/Contacts.htm
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
Archivarius 3000/Help/Dutch/Create.htm
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
Archivarius 3000/Help/Dutch/Create.htm
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
Archivarius 3000/Help/Dutch/Features.htm
Resource
win7-20240611-en
Behavioral task
behavioral18
Sample
Archivarius 3000/Help/Dutch/Features.htm
Resource
win10v2004-20240611-en
Behavioral task
behavioral19
Sample
Archivarius 3000/Help/Dutch/Index.htm
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
Archivarius 3000/Help/Dutch/Index.htm
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
Archivarius 3000/Help/Dutch/Indexes.htm
Resource
win7-20231129-en
Behavioral task
behavioral22
Sample
Archivarius 3000/Help/Dutch/Indexes.htm
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
Archivarius 3000/Help/Dutch/Keys.htm
Resource
win7-20240508-en
Behavioral task
behavioral24
Sample
Archivarius 3000/Help/Dutch/Keys.htm
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
Archivarius 3000/Help/Dutch/Ordering.htm
Resource
win7-20240419-en
Behavioral task
behavioral26
Sample
Archivarius 3000/Help/Dutch/Ordering.htm
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
Archivarius 3000/Help/Dutch/Queries.htm
Resource
win7-20240220-en
Behavioral task
behavioral28
Sample
Archivarius 3000/Help/Dutch/Queries.htm
Resource
win10v2004-20240611-en
Behavioral task
behavioral29
Sample
Archivarius 3000/Help/Dutch/Results.htm
Resource
win7-20240611-en
Behavioral task
behavioral30
Sample
Archivarius 3000/Help/Dutch/Results.htm
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
Archivarius 3000/Help/Dutch/Scheduler.htm
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
Archivarius 3000/Help/Dutch/Scheduler.htm
Resource
win10v2004-20240508-en
General
-
Target
Archivarius 3000/Archivarius3000.exe
-
Size
2.5MB
-
MD5
f74c7e5aac7bffb10a29c969c9417263
-
SHA1
43e43eb1e2a7d2ce9e58fd7c107e5a95330c125b
-
SHA256
2fdb9fb114fe9b6deb4adf958deb2436f59f779bb2ddaf6e75c2d5a4c7496adf
-
SHA512
b2f797e8828ad8ff4e04bf113eefe95cb70ac4527631d8b760729873a8c029d72401d3f7d632d5e30894527a0c7e8799c2887f76621bf402d2cfa96ac137d701
-
SSDEEP
49152:TiNAfpb+3bsbL6BD4US38JPAS9wHZAy184jfuBpTBOw/KC1nEpjKQa0jp:TiNARb8bsXVUS38pAS9IhrW3B5XW7p
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 Archivarius3000.exe -
Modifies registry class 46 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8998FD55-5666-437A-B49E-D7AE5D5681A9}\InprocServer32 Archivarius3000.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{99D962D7-2841-A140-47AE-7900E4CD0DE9}\1.0\HELPDIR Archivarius3000.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{99D962D7-2841-A140-47AE-7900E4CD0DE9}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\" Archivarius3000.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8998FD55-5666-437A-B49E-D7AE5D5681A9}\Version\ Archivarius3000.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8998FD55-5666-437A-B49E-D7AE5D5681A9}\HTMLControl Archivarius3000.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8998FD55-5666-437A-B49E-D7AE5D5681A9}\Implemented Categories\ Archivarius3000.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8998FD55-5666-437A-B49E-D7AE5D5681A9}\MiscStatus Archivarius3000.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{99D962D7-2841-A140-47AE-7900E4CD0DE9}\1.0\FLAGS\ Archivarius3000.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{99D962D7-2841-A140-47AE-7900E4CD0DE9}\1.0\FLAGS\ = "0" Archivarius3000.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8998FD55-5666-437A-B49E-D7AE5D5681A9}\Version\ = "2.0" Archivarius3000.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ Archivarius3000.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8998FD55-5666-437A-B49E-D7AE5D5681A9}\Implemented Categories Archivarius3000.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{99D962D7-2841-A140-47AE-7900E4CD0DE9}\1.0\0\win32 Archivarius3000.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{99D962D7-2841-A140-47AE-7900E4CD0DE9}\1.0\0\win32\ = "C:\\PROGRA~2\\MICROS~1\\Office14\\GROOVE.EXE\\150" Archivarius3000.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8998FD55-5666-437A-B49E-D7AE5D5681A9}\TypeLib\ = "{99D962D7-2841-A140-47AE-7900E4CD0DE9}" Archivarius3000.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8998FD55-5666-437A-B49E-D7AE5D5681A9}\ToolboxBitmap32\ = "C:\\Windows\\SysWOW64\\FM20.DLL, 285" Archivarius3000.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{99D962D7-2841-A140-47AE-7900E4CD0DE9} Archivarius3000.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key Archivarius3000.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8998FD55-5666-437A-B49E-D7AE5D5681A9}\InprocServer32\ = "C:\\Windows\\SysWOW64\\FM20.DLL" Archivarius3000.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8998FD55-5666-437A-B49E-D7AE5D5681A9}\MiscStatus\ Archivarius3000.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8998FD55-5666-437A-B49E-D7AE5D5681A9}\ProgID\ Archivarius3000.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8998FD55-5666-437A-B49E-D7AE5D5681A9}\ToolboxBitmap32 Archivarius3000.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8998FD55-5666-437A-B49E-D7AE5D5681A9}\DefaultIcon Archivarius3000.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{99D962D7-2841-A140-47AE-7900E4CD0DE9}\ Archivarius3000.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8998FD55-5666-437A-B49E-D7AE5D5681A9}\Version Archivarius3000.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8998FD55-5666-437A-B49E-D7AE5D5681A9}\InprocServer32\ Archivarius3000.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8998FD55-5666-437A-B49E-D7AE5D5681A9}\ToolboxBitmap32\ Archivarius3000.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{99D962D7-2841-A140-47AE-7900E4CD0DE9}\1.0\0\win32\ Archivarius3000.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{99D962D7-2841-A140-47AE-7900E4CD0DE9}\1.0\HELPDIR\ Archivarius3000.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{99D962D7-2841-A140-47AE-7900E4CD0DE9}\1.0\0\ Archivarius3000.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8998FD55-5666-437A-B49E-D7AE5D5681A9}\TypeLib Archivarius3000.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8998FD55-5666-437A-B49E-D7AE5D5681A9} Archivarius3000.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8998FD55-5666-437A-B49E-D7AE5D5681A9}\MiscStatus\ = "657809" Archivarius3000.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8998FD55-5666-437A-B49E-D7AE5D5681A9}\ProgID\ = "Forms.HTML:Image.1" Archivarius3000.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{99D962D7-2841-A140-47AE-7900E4CD0DE9}\1.0\ Archivarius3000.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{99D962D7-2841-A140-47AE-7900E4CD0DE9}\1.0\ = "Groove DataViewer Tool Type Library 1.0" Archivarius3000.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8998FD55-5666-437A-B49E-D7AE5D5681A9}\ProgID Archivarius3000.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{99D962D7-2841-A140-47AE-7900E4CD0DE9}\1.0 Archivarius3000.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{99D962D7-2841-A140-47AE-7900E4CD0DE9}\1.0\0 Archivarius3000.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" Archivarius3000.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8998FD55-5666-437A-B49E-D7AE5D5681A9}\ = "Palawhebgi Class" Archivarius3000.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8998FD55-5666-437A-B49E-D7AE5D5681A9}\DefaultIcon\ Archivarius3000.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8998FD55-5666-437A-B49E-D7AE5D5681A9}\DefaultIcon\ = "C:\\Windows\\SysWOW64\\FM20.DLL,0" Archivarius3000.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8998FD55-5666-437A-B49E-D7AE5D5681A9}\HTMLControl\ Archivarius3000.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{99D962D7-2841-A140-47AE-7900E4CD0DE9}\1.0\FLAGS Archivarius3000.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8998FD55-5666-437A-B49E-D7AE5D5681A9}\TypeLib\ Archivarius3000.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2108 Archivarius3000.exe 2108 Archivarius3000.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 2108 Archivarius3000.exe 2108 Archivarius3000.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2108 Archivarius3000.exe 2108 Archivarius3000.exe 2108 Archivarius3000.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Archivarius 3000\Archivarius3000.exe"C:\Users\Admin\AppData\Local\Temp\Archivarius 3000\Archivarius3000.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2108