Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
729718855a5...18.exe
windows7-x64
729718855a5...18.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3Dll/Regdll.exe
windows7-x64
1Dll/Regdll.exe
windows10-2004-x64
1Dll/unRegdll.exe
windows7-x64
1Dll/unRegdll.exe
windows10-2004-x64
1Dll/web2pic_url.dll
windows7-x64
1Dll/web2pic_url.dll
windows10-2004-x64
1Help.chm
windows7-x64
1Help.chm
windows10-2004-x64
1Web2Pic_Pro.exe
windows7-x64
4Web2Pic_Pro.exe
windows10-2004-x64
4example.bat
windows7-x64
4example.bat
windows10-2004-x64
4uninstall.exe
windows7-x64
7uninstall.exe
windows10-2004-x64
7$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3Analysis
-
max time kernel
141s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
06/07/2024, 22:34
Behavioral task
behavioral1
Sample
29718855a5fdbc6fbcaefe19c9c2b820_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
29718855a5fdbc6fbcaefe19c9c2b820_JaffaCakes118.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral7
Sample
Dll/Regdll.exe
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
Dll/Regdll.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral9
Sample
Dll/unRegdll.exe
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
Dll/unRegdll.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral11
Sample
Dll/web2pic_url.dll
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
Dll/web2pic_url.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral13
Sample
Help.chm
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
Help.chm
Resource
win10v2004-20240704-en
Behavioral task
behavioral15
Sample
Web2Pic_Pro.exe
Resource
win7-20240705-en
Behavioral task
behavioral16
Sample
Web2Pic_Pro.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
example.bat
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
example.bat
Resource
win10v2004-20240704-en
Behavioral task
behavioral19
Sample
uninstall.exe
Resource
win7-20240704-en
Behavioral task
behavioral20
Sample
uninstall.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240705-en
Behavioral task
behavioral22
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240704-en
General
-
Target
Web2Pic_Pro.exe
-
Size
502KB
-
MD5
b2ccc32feac58a3750fe8974187f4b7d
-
SHA1
904ea756b1f840afccd6724566249615a53f2689
-
SHA256
edd9b18ee2dd49f5ffc38f4e3e0189391d8c3bb601ea61c229c185d3aed5b4bd
-
SHA512
4ba9ba07ba4b0df4fae99e197b7c0c821e88c2b971dccca136aec9a75f7e2921f363765e4617631774b1bd7e542b25a9fffb5c0e7709866146f19b0c98787d43
-
SSDEEP
12288:J8V4vfaDkBx4JYlIR1qqx4sl8M2EmlQoJ4RKQaa+O:J6ex5qxTWdHGk4RKlO
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\win.ini Web2Pic_Pro.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1312 Web2Pic_Pro.exe 1312 Web2Pic_Pro.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
700B
MD5a16b3c21c2136bc13323b1aa2c914975
SHA1ac8698eb403e20985b96173b196b9756fe7b7d27
SHA256adcfe1bece248fe6e7041dd01b4108bd608877e8761d1bffa4a6a72f5725f125
SHA51223b21a54faf4a2f837fdafd99156cf528989c278e03ac7af4bc492abfbdc24f8cffe2608516a0aa8a5a02740dfa0efd5921334663b75b5e2e098e515e90526d7
-
Filesize
700B
MD5cbed3b92ee5b7fbc9cf15820362f77b7
SHA1ca7c55a06d4a795584ad242e2c9f1e9df5111bf2
SHA2568365fb805d865c55bcc8c1ef732ef83d872221b8be7334f431e78de68fabd84c
SHA5121a66d8dd7ad7fb3f6766cb01cf7cf877856ff8384723525634156412ecc70d1abfa94796063090df512427be0613af7db38271bf48cba36dcd7c9550fa8000b4