Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

1

PlantsVsZo...or.exe

windows7-x64

7

PlantsVsZo...or.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    117s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    08/07/2024, 05:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    PlantsVsZombiesSetup_instalador.exe

  • Size

    40.8MB

  • MD5

    95c188d0e4bff425431bcdfd49d06d25

  • SHA1

    c46979be135ef1c486144fa062466cdc51b740f5

  • SHA256

    4b4bb4d19fb639e5698983e39d7ad061c7667bcec19056560532c7ad0d67d0e4

  • SHA512

    804943b85f968cea2cbc9f0f7a2d55c5d53d00d777e251f6662c60172a3bd8017c4de6ce17d25f58dd8d3031f86f025727f7fa31859eeb50b755a2f61570c839

  • SSDEEP

    786432:kz5Jx9wem1r+qHk/rYmfZ6f8/39RsAaZh9BLTtYHmc9iLMnH:kz5Jzi0ZfZP9iAsBLBYHv6eH

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 61 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 52 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PlantsVsZombiesSetup_instalador.exe
    "C:\Users\Admin\AppData\Local\Temp\PlantsVsZombiesSetup_instalador.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2144
    • C:\Users\Admin\AppData\Local\Temp\popcfg2\vcredist_x86.exe
      "C:\Users\Admin\AppData\Local\Temp\popcfg2\vcredist_x86.exe" /q
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:444
      • \??\c:\2188ebb19110121f7905\install.exe
        c:\2188ebb19110121f7905\.\install.exe /q
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        PID:2560
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2452

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI4F50.txt
    Filesize

    1KB

    MD5

    5e63d90baacecef4f4169b7fcaafadc6

    SHA1

    f77db54956c6b6b532121452d12a61eb164254b5

    SHA256

    87f454add3a04bd760ea0891508845f9a27c0a0aa9ba54d2309fadd2239f0b76

    SHA512

    12ed143b2a4ed2c4c47c5590d2d0a4c07e2aaa56b4ce1c382a62ec731b13f44c5d7e2378db36bef455af1e4c2c1da8f8e301e90e95261fc233417829331bc9ce

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\popcfg2\defines.xml
    Filesize

    1KB

    MD5

    cdaaebdfd3ef6bab4ee3638907902d49

    SHA1

    3b4e6316c89e1a24643e512d60118498c9c79853

    SHA256

    8ef0ec424b2a86f718829c67254f9f3cb14a750f72b9d2b711761bf6635cac3f

    SHA512

    ca125b8079058b2b0e3fdee38c758c8807738a0556293074a269ae018f4a8cb2aabe1ccadc0b2b3355144c897e8d6bfe6cbf667958d7ec76a0a68f83b50ce9ab

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\popcfg2\eula.rtf
    Filesize

    52KB

    MD5

    977e662aa64f82e18254938fc04e1cc4

    SHA1

    d33c0842896d8089037efb5b4924b7b12b5ebe3d

    SHA256

    5fe1559110c4cf1a53256bdb3d93ad9387295198530405b7d7ea1280c217ec2f

    SHA512

    90417e5ac7e7f4d1ce1d3d53972f5bdb58f0a57e6aeefb00ad85079991071e9f91a6a8468650e124583a4f5a59df181cde668e5d3aa3565ceb0235cd833ad45a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\popcfg2\install.xml
    Filesize

    3KB

    MD5

    ffae67978e87e939553b867210fa6f79

    SHA1

    0a3f34219055896a55ee97ebbb4a4ca30b5cb6f4

    SHA256

    ff0c1899d234fd0300e6953cc4202495db0b3f540c7131671e7e61f73671b165

    SHA512

    93f5f9d378ba434ea01748abe207ded9f3bc3c4a91945c536754f7a2a114d32e05a0b175c6172dd1d92dfeb0be7339d438e6e9d56640a025b74eede5e98d2931

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\popcfg2\logo.bmp
    Filesize

    24KB

    MD5

    1843d66328cedc1ce60cb98f3d593f4a

    SHA1

    d84a82214e498123609a13aa54164f972776d33a

    SHA256

    7f3e2f0ec8926e7911fe024271387657adf8bda95581c6235f995be57ff56ea1

    SHA512

    f1fa3aa6a62c868d69d17b6ab5e5cb39e4099f971c84c16f6857c6202016ad9104a5f2e188e8721be5ac3ab43c4bc45122e84fff473e4913aed60b4fa3e8c8c7

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\popcfg2\product.bmp
    Filesize

    19KB

    MD5

    967b5522d0a7e6c3864cc7239d0e2ba5

    SHA1

    b59c6c8b92ccfd270e003818c185a2ab556b14d9

    SHA256

    a46e016098d2322fdcb130e10f73e9c55195719623b7f1889edb5dba229e23c3

    SHA512

    c9f1f2f425fd3c5541aa5dc0944044923b7417755c3411cc6e50d14982b35a0c785a5c619f0cebcdcf32c9b049f8090b76bd3cb6adc78fe2f5e2df3a82972a81

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\popcfg2\props.xml
    Filesize

    6KB

    MD5

    ed1a4daf65608f02a8bd5a1bb2e19ac6

    SHA1

    496643241d51f5347f53fc176c69858b65febe6a

    SHA256

    b0d21cd683d0982eff52f5fe42d8841377110806a2fd1b1d09ea7ccc1893fd14

    SHA512

    8998362f9fc37dbd535d3cd248aaa43abcbcdfc4dbee308890f41f0ca62073d7658ee398497f15e44a8ea0116a820ea6bf2b57bd7f2baebdf05bd46f49f72606

    Download Submit

  • \2188ebb19110121f7905\install.exe
    Filesize

    549KB

    MD5

    33c9213ff5849ef7346799cae4d8ac80

    SHA1

    5421169811570171e9d2d0a1cdca9665273e7b59

    SHA256

    3377e31d233ff41aea253e6221815820997763acdf40b005f8791400366cb8ff

    SHA512

    da0fc3f57156e06c0c37c1fb5176e1b147ce4aa21f519112123722496b04ad4bc3d366e2b51fd78de1ba0304d35bfd5e5fc95cabc2b3eb174f77636a8fa162a1

    Download Submit

  • \??\c:\2188ebb19110121f7905\globdata.ini
    Filesize

    1KB

    MD5

    0a6b586fabd072bd7382b5e24194eac7

    SHA1

    60e3c7215c1a40fbfb3016d52c2de44592f8ca95

    SHA256

    7912e3fcf2698cf4f8625e563cd8215c6668739cae18bd6f27af2d25bec5c951

    SHA512

    b96b0448e9f0e94a7867b6bb103979e9ef2c0e074bcb85988d450d63de6edcf21dc83bb154aafb7de524af3c3734f0bb1ba649db0408612479322e1aa85be9f4

    Download Submit

  • \??\c:\2188ebb19110121f7905\install.ini
    Filesize

    844B

    MD5

    5feaa6a36fea7dfdb88c18d69ba6d6a9

    SHA1

    7afd91a7b046d68b6ee9fd367bcd7a4fec546216

    SHA256

    67a50ffbb8a1d500eaa4d9f0227d6a8595a2750154e6b31662fc4f51286e47fc

    SHA512

    6c8c0456f232a02a49d51b3f1a830a18b9078e621cd0dc3f4f76f79b83035e8affac67bce3af9a37fa9096a34a8499c59cf982b63a4b2400b9190d2db293e682

    Download Submit

  • \??\c:\2188ebb19110121f7905\install.res.1033.dll
    Filesize

    89KB

    MD5

    8e97ea8a1ed69806232e8743f9a28706

    SHA1

    e911d3802e64f9be0e1ac68865bbcc92624d6a1f

    SHA256

    2893b1b9751f833d4a3ded7c1fba1a96cada2927a2349c5d751365eed647c100

    SHA512

    aa57fe0b822145aa1d8eb72f9735ef5d92036f24c4c80392799d701447d18ea510331f5653b39c43dc923cd0f1a61bf87be0f8a4927f6e3754d19ac76fd443c3

    Download Submit

  • \??\c:\2188ebb19110121f7905\vc_red.cab
    Filesize

    3.7MB

    MD5

    ecca3c1acb74cb73c600eabdd3f9c9d9

    SHA1

    f015759f623c377494a5996670204f1fcd0895e3

    SHA256

    43b7648183347374236296f2176c7c7da920da9c1a08adda761e12614efb299e

    SHA512

    2785b8e8cfc310ec114cee696c5b85900fc71186dcbf0c99a9c13f4f0fdcc9e9dd583c9d1fd82492a680efcd7071c3593b02b628bd947bc19b1302b931aca807

    Download Submit

  • \??\c:\2188ebb19110121f7905\vc_red.msi
    Filesize

    227KB

    MD5

    6e17361f8e53b47656bcf0ed90ade095

    SHA1

    bce290a700e31579356f7122fb38ce3be452628a

    SHA256

    8811e5fe167223d906701bc8deb789de0a731e888e285834bcae164b03d43c96

    SHA512

    a566fc8bbb4d354db32f13de2fde73a1210c61b1c30a1be22b16c7e98b8d51c673259c57a924b04035cb9f0bf4a087a3e8b32221e7ff87032cddc840ffe3ed2f

    Download Submit

  • \Users\Admin\AppData\Local\Temp\popcfg2\vcredist_x86.exe
    Filesize

    4.0MB

    MD5

    5689d43c3b201dd3810fa3bba4a6476a

    SHA1

    6939100e397cef26ec22e95e53fcd9fc979b7bc9

    SHA256

    41f45a46ee56626ff2699d525bb56a3bb4718c5ca5f4fb5b3b38add64584026b

    SHA512

    4875134c664503242ec60717232f2917edca20286fc4b675223edbbe5dc0239ebfaf8f67edd76fedcaa2be5419490dc6f47930ca260e6c9988ccf242416c204b

    Download Submit