Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
3apo/Editor_64.exe
windows7-x64
1apo/Editor_64.exe
windows10-2004-x64
1apo/Qt5Core.dll
windows7-x64
1apo/Qt5Core.dll
windows10-2004-x64
1apo/Qt5Gui.dll
windows7-x64
1apo/Qt5Gui.dll
windows10-2004-x64
1apo/Qt5Widgets.dll
windows7-x64
1apo/Qt5Widgets.dll
windows10-2004-x64
1apo/libfftw3f-3.dll
windows7-x64
1apo/libfftw3f-3.dll
windows10-2004-x64
1apo/qt/ima...if.dll
windows7-x64
1apo/qt/ima...if.dll
windows10-2004-x64
1apo/qt/ima...co.dll
windows7-x64
1apo/qt/ima...co.dll
windows10-2004-x64
1apo/qt/ima...eg.dll
windows7-x64
1apo/qt/ima...eg.dll
windows10-2004-x64
1apo/qt/pla...ws.dll
windows7-x64
1apo/qt/pla...ws.dll
windows10-2004-x64
1apo/qt/sty...le.dll
windows7-x64
1apo/qt/sty...le.dll
windows10-2004-x64
1apo/sndfile.dll
windows7-x64
1apo/sndfile.dll
windows10-2004-x64
1Analysis
-
max time kernel
41s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
29/06/2024, 04:29
Static task
static1
Behavioral task
behavioral1
Sample
apo/Editor_64.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
apo/Editor_64.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
apo/Qt5Core.dll
Resource
win7-20240611-en
Behavioral task
behavioral4
Sample
apo/Qt5Core.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
apo/Qt5Gui.dll
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
apo/Qt5Gui.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
apo/Qt5Widgets.dll
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
apo/Qt5Widgets.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
apo/libfftw3f-3.dll
Resource
win7-20240220-en
Behavioral task
behavioral10
Sample
apo/libfftw3f-3.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
apo/qt/imageformats/qgif.dll
Resource
win7-20240611-en
Behavioral task
behavioral12
Sample
apo/qt/imageformats/qgif.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
apo/qt/imageformats/qico.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
apo/qt/imageformats/qico.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral15
Sample
apo/qt/imageformats/qjpeg.dll
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
apo/qt/imageformats/qjpeg.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral17
Sample
apo/qt/platforms/qwindows.dll
Resource
win7-20240508-en
Behavioral task
behavioral18
Sample
apo/qt/platforms/qwindows.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral19
Sample
apo/qt/styles/qwindowsvistastyle.dll
Resource
win7-20240508-en
Behavioral task
behavioral20
Sample
apo/qt/styles/qwindowsvistastyle.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
apo/sndfile.dll
Resource
win7-20231129-en
Behavioral task
behavioral22
Sample
apo/sndfile.dll
Resource
win10v2004-20240508-en
General
-
Target
apo/Editor_64.exe
-
Size
1.4MB
-
MD5
ed71aee1c2945dc84715cc5d9957e1da
-
SHA1
4fe09d60c1502d78f8b640b29dc1cb6ebe68c71b
-
SHA256
1af097c2ad78e36c20a3d4249c68ce70185b80558daf619af4ce0edc6e54c508
-
SHA512
cf03962bad4def0123d2277a82f9c449cad210d7a96cd74e0f679e2d53608179fa96f00a19eecb3fd9b13d601b1b048562320f30b133c2284edbe0ed5bde200e
-
SSDEEP
24576:zibaG3pv1sLhBGSYA964ZL/yeaJghgWBkeH6wWwVjZja5:CaoQLeSfB2eaJghgWBkeVnZ
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2296 Editor_64.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2296 Editor_64.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2296 wrote to memory of 1708 2296 Editor_64.exe 28 PID 2296 wrote to memory of 1708 2296 Editor_64.exe 28 PID 2296 wrote to memory of 1708 2296 Editor_64.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\apo\Editor_64.exe"C:\Users\Admin\AppData\Local\Temp\apo\Editor_64.exe"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2296 -s 5482⤵PID:1708
-