Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3upgrade.exe
windows7-x64
7upgrade.exe
windows10-2004-x64
7$0/browserseek.dll
windows7-x64
1$0/browserseek.dll
windows10-2004-x64
1$0/browserseek.exe
windows7-x64
1$0/browserseek.exe
windows10-2004-x64
1$0/uninstall.exe
windows7-x64
7$0/uninstall.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01/07/2024, 21:30
Static task
static1
Behavioral task
behavioral1
Sample
upgrade.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
upgrade.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$0/browserseek.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$0/browserseek.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
$0/browserseek.exe
Resource
win7-20240611-en
Behavioral task
behavioral6
Sample
$0/browserseek.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
$0/uninstall.exe
Resource
win7-20240419-en
Behavioral task
behavioral8
Sample
$0/uninstall.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240611-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231129-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240611-en
General
-
Target
$0/uninstall.exe
-
Size
82KB
-
MD5
3f0967dccc27c0b022dd6be6a98fa390
-
SHA1
c57846d9800a9cf8c6a39170a6a045dc80d8dd29
-
SHA256
9834d7bfea7dc27409d0cebd59175c00a0ee51b64b558abb26c66fed50bc9825
-
SHA512
1d0bebf9a484ba7727c288156420be9f853537ceebb8d17450646f5e501f2f44d533f31df83c574c0bc8f13c0fe77980d95188a5f5a920cecaf24df8579887f0
-
SSDEEP
1536:xEkjY1zy214Qay0DGkJ7qAELVigJFBcp6hLeh8a+gZuNCtO2/D7J:+kjAJ4dDGkJ+AI0V4hChIg97/5
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2300 Au_.exe -
Loads dropped DLL 2 IoCs
pid Process 2300 Au_.exe 2300 Au_.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 1 IoCs
resource yara_rule behavioral8/files/0x00070000000233ff-4.dat nsis_installer_1 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1460 wrote to memory of 2300 1460 uninstall.exe 80 PID 1460 wrote to memory of 2300 1460 uninstall.exe 80 PID 1460 wrote to memory of 2300 1460 uninstall.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\$0\uninstall.exe"C:\Users\Admin\AppData\Local\Temp\$0\uninstall.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\$0\2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2300
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13KB
MD5d765c492c21689e3d9d61634371fd861
SHA1ac200933671ae52c9d5544d0e2e8e9144d286c83
SHA256551e6042dd494ea01549555ffc194ab9729da09058ec714eb368dd06642c9bbc
SHA5129919a9e848c8f1e26c75d0d29207571e4b86a4140bd554743d2c1f8bd7f386fe4919345b163d89a5d907fb165e435ba0ac5f6b1101713636141f156a420e2e0f
-
Filesize
10KB
MD5fe24766ba314f620d57d0cf7339103c0
SHA18641545f03f03ff07485d6ec4d7b41cbb898c269
SHA256802ef71440f662f456bed6283a5ff78066af016897fe6bfd29cac6edc2967bbd
SHA51260d36959895cebf29c4e7713e6d414980139c7aa4ed1c8c96fefb672c1263af0ce909fb409534355895649c0e8056635112efb0da2ba05694446aec2ca77e2e3
-
Filesize
697B
MD5dddae3fedb50149d273f297bb1ea223f
SHA1c573e349c2b435b3e11aa42740923ba07ca0c767
SHA25608a021ac67629a05b4036c965dcbbb25746df9fefa55d402d668ab383c49f155
SHA5129af0c99223d0e100a34b0fff811328b9334b5049b865084f993b6090062053d8558f6eac4803d6f0410cb8062694690372a5bfb190d21c1c7afe20444e5a195f
-
Filesize
82KB
MD53f0967dccc27c0b022dd6be6a98fa390
SHA1c57846d9800a9cf8c6a39170a6a045dc80d8dd29
SHA2569834d7bfea7dc27409d0cebd59175c00a0ee51b64b558abb26c66fed50bc9825
SHA5121d0bebf9a484ba7727c288156420be9f853537ceebb8d17450646f5e501f2f44d533f31df83c574c0bc8f13c0fe77980d95188a5f5a920cecaf24df8579887f0