Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3archive/Setup.exe
windows7-x64
10archive/Setup.exe
windows10-2004-x64
10archive/ap...ds.dll
windows7-x64
1archive/ap...ds.dll
windows10-2004-x64
1archive/ap...er.dll
windows7-x64
1archive/ap...er.dll
windows10-2004-x64
1archive/ap...if.dll
windows7-x64
1archive/ap...if.dll
windows10-2004-x64
1archive/ap...ns.dll
windows7-x64
1archive/ap...ns.dll
windows10-2004-x64
1archive/ap...co.dll
windows7-x64
1archive/ap...co.dll
windows10-2004-x64
1archive/ap...eg.dll
windows7-x64
1archive/ap...eg.dll
windows10-2004-x64
1archive/ap...er.dll
windows7-x64
1archive/ap...er.dll
windows10-2004-x64
1archive/ap...vg.dll
windows7-x64
1archive/ap...vg.dll
windows10-2004-x64
1archive/ap...ga.dll
windows7-x64
1archive/ap...ga.dll
windows10-2004-x64
1archive/ap...ff.dll
windows7-x64
1archive/ap...ff.dll
windows10-2004-x64
1archive/ap...mp.dll
windows7-x64
1archive/ap...mp.dll
windows10-2004-x64
1archive/ap...bp.dll
windows7-x64
1archive/ap...bp.dll
windows10-2004-x64
1archive/libGLESv2.dll
windows7-x64
3archive/libGLESv2.dll
windows10-2004-x64
3archive/qsvgicon.dll
windows7-x64
1archive/qsvgicon.dll
windows10-2004-x64
1archive/tr...es.dll
windows7-x64
1archive/tr...es.dll
windows10-2004-x64
1Analysis
-
max time kernel
125s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
11/07/2024, 18:09
Static task
static1
Behavioral task
behavioral1
Sample
archive/Setup.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
archive/Setup.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
archive/appsremote/qdds.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
archive/appsremote/qdds.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
archive/appsremote/qgenericbearer.dll
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
archive/appsremote/qgenericbearer.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
archive/appsremote/qgif.dll
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
archive/appsremote/qgif.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
archive/appsremote/qicns.dll
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
archive/appsremote/qicns.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
archive/appsremote/qico.dll
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
archive/appsremote/qico.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
archive/appsremote/qjpeg.dll
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
archive/appsremote/qjpeg.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral15
Sample
archive/appsremote/qnativewifibearer.dll
Resource
win7-20240705-en
Behavioral task
behavioral16
Sample
archive/appsremote/qnativewifibearer.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral17
Sample
archive/appsremote/qsvg.dll
Resource
win7-20240705-en
Behavioral task
behavioral18
Sample
archive/appsremote/qsvg.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral19
Sample
archive/appsremote/qtga.dll
Resource
win7-20240705-en
Behavioral task
behavioral20
Sample
archive/appsremote/qtga.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral21
Sample
archive/appsremote/qtiff.dll
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
archive/appsremote/qtiff.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral23
Sample
archive/appsremote/qwbmp.dll
Resource
win7-20240705-en
Behavioral task
behavioral24
Sample
archive/appsremote/qwbmp.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral25
Sample
archive/appsremote/qwebp.dll
Resource
win7-20240704-en
Behavioral task
behavioral26
Sample
archive/appsremote/qwebp.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral27
Sample
archive/libGLESv2.dll
Resource
win7-20240708-en
Behavioral task
behavioral28
Sample
archive/libGLESv2.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral29
Sample
archive/qsvgicon.dll
Resource
win7-20240705-en
Behavioral task
behavioral30
Sample
archive/qsvgicon.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral31
Sample
archive/translations/Common7/IDE/CommonExtensions/Microsoft/NuGet/cs/Microsoft.Build.NuGetSdkResolver.resources.dll
Resource
win7-20240704-en
Behavioral task
behavioral32
Sample
archive/translations/Common7/IDE/CommonExtensions/Microsoft/NuGet/cs/Microsoft.Build.NuGetSdkResolver.resources.dll
Resource
win10v2004-20240709-en
General
-
Target
archive/Setup.exe
-
Size
792.5MB
-
MD5
882c754fb952c8abb850dc3c11c7fde2
-
SHA1
668d6cd355a11ca4af98275b89be3ed27af1a918
-
SHA256
9c6d924afa3b84241a00762d243b156a2af26374154de67a89cda3e4ef37a2c8
-
SHA512
7f9fea9b477f3eba99db92cd076320b29db1e603797c4ade3f5bba1543cb7711f92a19b73c214ed92443218a805a4ed3ea4bf4d46eed1c43486801481b186b9b
-
SSDEEP
98304:94zumTUVxOTJeP4tQt26kDyy14zv6rsps+eZPvHlZ7K:94M8JBta26kGyM3ni/lZ7
Malware Config
Signatures
-
Modifies firewall policy service 3 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1" Setup.exe -
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 14 api.myip.com 15 api.myip.com 19 ipinfo.io 20 ipinfo.io -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\System32\GroupPolicy Setup.exe File opened for modification C:\Windows\System32\GroupPolicy\gpt.ini Setup.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol Setup.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI Setup.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4860 Setup.exe 4860 Setup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\archive\Setup.exe"C:\Users\Admin\AppData\Local\Temp\archive\Setup.exe"1⤵
- Modifies firewall policy service
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:4860
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵PID:1676
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵PID:5028