Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

f034640560...c0.exe

windows7-x64

10

f034640560...c0.exe

windows10-2004-x64

7

$PLUGINSDI...nt.dll

windows7-x64

3

$PLUGINSDI...nt.dll

windows10-2004-x64

3

$PLUGINSDI...md.dll

windows7-x64

3

$PLUGINSDI...md.dll

windows10-2004-x64

3

$PLUGINSDI...os.dll

windows7-x64

3

$PLUGINSDI...os.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...dl.dll

windows7-x64

3

$PLUGINSDI...dl.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...ll.dll

windows7-x64

3

$PLUGINSDI...ll.dll

windows10-2004-x64

3

$PLUGINSDI...ML.dll

windows7-x64

3

$PLUGINSDI...ML.dll

windows10-2004-x64

3

$SYSDIR/$S...on.scr

windows7-x64

1

$SYSDIR/$S...on.scr

windows10-2004-x64

1

$TEMP/$SYS...on.scr

windows7-x64

1

$TEMP/$SYS...on.scr

windows10-2004-x64

1

$TEMP/Dump.dll

windows7-x64

5

$TEMP/Dump.dll

windows10-2004-x64

5

$TEMP/getm...ss.dll

windows7-x64

1

$TEMP/getm...ss.dll

windows10-2004-x64

1

$TEMP/xml2fspdata.exe

windows7-x64

1

$TEMP/xml2fspdata.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f034640560565580e9233100f97d3e6a594915bd7d900cff444fd1c2c48c2cc0

  • Size

    5.4MB

  • Sample

    240714-vk1kfazanp

  • MD5

    46acc3fd90233d5b2fc9dffc05733eac

  • SHA1

    4061c7f486ae44fdee3a35a2c69740c753963596

  • SHA256

    f034640560565580e9233100f97d3e6a594915bd7d900cff444fd1c2c48c2cc0

  • SHA512

    14fc0071288256ba8ad3c32c0f387da10c16d0ec3a1cbb292ca57f0bc2923fae6ca2d6821d5461f9f2fd2f52c2e75480ae488a255f59cc3588cad122ce5de39a

  • SSDEEP

    98304:E2KNVQyPDrBdfSNW40xhlkauVz1/c490/8+rc+NFs4eR7ThbxrS3nZ0g:YYsd6HehlkVP488Q4eRbxmJn

Score
10/10
adwarediscoveryevasionpersistencestealer

Malware Config

Targets

    • Target

      f034640560565580e9233100f97d3e6a594915bd7d900cff444fd1c2c48c2cc0

    • Size

      5.4MB

    • MD5

      46acc3fd90233d5b2fc9dffc05733eac

    • SHA1

      4061c7f486ae44fdee3a35a2c69740c753963596

    • SHA256

      f034640560565580e9233100f97d3e6a594915bd7d900cff444fd1c2c48c2cc0

    • SHA512

      14fc0071288256ba8ad3c32c0f387da10c16d0ec3a1cbb292ca57f0bc2923fae6ca2d6821d5461f9f2fd2f52c2e75480ae488a255f59cc3588cad122ce5de39a

    • SSDEEP

      98304:E2KNVQyPDrBdfSNW40xhlkauVz1/c490/8+rc+NFs4eR7ThbxrS3nZ0g:YYsd6HehlkVP488Q4eRbxmJn

    Score
    10/10
    adwarediscoveryevasionpersistencestealer

    • Modifies firewall policy service

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Drops file in System32 directory

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/ButtonEvent.dll

    • Size

      4KB

    • MD5

      fad9d09fc0267e8513b8628e767b2604

    • SHA1

      bea76a7621c07b30ed90bedef4d608a5b9e15300

    • SHA256

      5d913c6be9c9e13801acc5d78b11d9f3cd42c1b3b3cad8272eb6e1bfb06730c2

    • SHA512

      b39c5ea8aea0640f5a32a1fc03e8c8382a621c168980b3bc5e2897932878003b2b8ef75b3ad68149c35420d652143e2ef763b6a47d84ec73621017f0273e2805

    Score
    3/10
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/ExecCmd.dll

    • Size

      4KB

    • MD5

      b9380b0bea8854fd9f93cc1fda0dfeac

    • SHA1

      edb8d58074e098f7b5f0d158abedc7fc53638618

    • SHA256

      1f4bd9c9376fe1b6913baeca7fb6df6467126f27c9c2fe038206567232a0e244

    • SHA512

      45c3ab0f2bce53b75e72e43bac747dc0618342a3f498be8e2eb62a6db0b137fcdb1735da83051b14824996b5287109aa831e5859d6f21f0ed21b76b3d335418c

    • SSDEEP

      48:ifXNtGNjFizsU35iej7luiwa28mDJmDKUOMQH0glay/Aa4r/:5Fef5iej5txKJKenlV4r/

    Score
    3/10
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/ExecDos.dll

    • Size

      5KB

    • MD5

      a7cd6206240484c8436c66afb12bdfbf

    • SHA1

      0bb3e24a7eb0a9e5a8eae06b1c6e7551a7ec9919

    • SHA256

      69ac56d2fdf3c71b766d3cc49b33b36f1287cc2503310811017467dfcb455926

    • SHA512

      b9ee7803301e50a8ec20ab3f87eb9e509ea24d11a69e90005f30c1666acc4ed0a208bd56e372e2e5c6a6d901d45f04a12427303d74761983593d10b344c79904

    • SSDEEP

      48:6jOBtU/BXN8kUByyy/Aklkcrkyg7Vg5RibGoTCTo0gqVeeaeQqzM5rv774YRljmB:y/DMy4ncrkyg7tbpQFLUEYRxe

    Score
    3/10
    behavioral7behavioral8

    • Target

      $PLUGINSDIR/FindProcDLL.dll

    • Size

      31KB

    • MD5

      83cd62eab980e3d64c131799608c8371

    • SHA1

      5b57a6842a154997e31fab573c5754b358f5dd1c

    • SHA256

      a6122e80f1c51dc72770b4f56c7c482f7a9571143fbf83b19c4d141d0cb19294

    • SHA512

      91cfbcc125600ec341f5571dcf1e4a814cf7673f82cf42f32155bd54791bbf32619f2bb14ae871d7996e9ddecdfcc5db40caa0979d6dfba3e73cfe8e69c163c9

    • SSDEEP

      384:1NWlNdqdAnhTKMLE2oIM05fnqCiWg3Yy9kflIinokN:1NWtqdihTKCldkYwkdpnoy

    Score
    3/10
    behavioral10behavioral9

    • Target

      $PLUGINSDIR/InstallOptions.dll

    • Size

      14KB

    • MD5

      325b008aec81e5aaa57096f05d4212b5

    • SHA1

      27a2d89747a20305b6518438eff5b9f57f7df5c3

    • SHA256

      c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

    • SHA512

      18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

    • SSDEEP

      192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo

    Score
    3/10
    behavioral11behavioral12

    • Target

      $PLUGINSDIR/KillProcDLL.dll

    • Size

      32KB

    • MD5

      83142eac84475f4ca889c73f10d9c179

    • SHA1

      dbe43c0de8ef881466bd74861b2e5b17598b5ce8

    • SHA256

      ae2f1658656e554f37e6eac896475a3862841a18ffc6fad2754e2d3525770729

    • SHA512

      1c66eab21f0c9e0b99ecc3844516a6978f52e0c7f489405a427532ecbe78947c37dac5b4c8b722cc8bc1edfb74ba4824519d56099e587e754e5c668701e83bd1

    • SSDEEP

      384:3rYz6grZodORNWATt4TBmlk5ooyzFh7BukAUdJoUtSOSR:3QggDWATWNCFh7BNddJoxO+

    Score
    3/10
    behavioral13behavioral14

    • Target

      $PLUGINSDIR/NSISdl.dll

    • Size

      14KB

    • MD5

      a5f8399a743ab7f9c88c645c35b1ebb5

    • SHA1

      168f3c158913b0367bf79fa413357fbe97018191

    • SHA256

      dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

    • SHA512

      824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

    • SSDEEP

      192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go

    Score
    3/10
    behavioral15behavioral16

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      c17103ae9072a06da581dec998343fc1

    • SHA1

      b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

    • SHA256

      dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

    • SHA512

      d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

    • SSDEEP

      192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw

    Score
    3/10
    behavioral17behavioral18

    • Target

      $PLUGINSDIR/md5dll.dll

    • Size

      8KB

    • MD5

      a7d710e78711d5ab90e4792763241754

    • SHA1

      f31cecd926c5d497aba163a17b75975ec34beb13

    • SHA256

      9b05dd603f13c196f3f21c43f48834208fed2294f7090fcd1334931014611fb2

    • SHA512

      f0ca2d6f9a8aeac84ef8b051154a041adffc46e3e9aced142e9c7bf5f7272b047e1db421d38cb2d9182d7442bee3dd806618b019ec042a23ae0e71671d2943c0

    • SSDEEP

      96:YV2qpbvYSflug0Dvxn6GuKM9sh1gdrN9+oB7FT9WibOoBZcko5N/:Yt5lugRK8hlvbwkKV

    Score
    3/10
    behavioral19behavioral20

    • Target

      $PLUGINSDIR/nsisXML.dll

    • Size

      11KB

    • MD5

      13deb9a0f4e4286df01abc85e1895e09

    • SHA1

      3174853b32407fd85220de844b390a18a8a76c97

    • SHA256

      c40ef0b41c035b6d29656616ddc113a717bfd1bb78c9fcac75d7b6eefdc7bf83

    • SHA512

      604aa82a9c4818d2f63fb11bbde561afc137a77e9f3108dfd7f4596524e46ce71b6dc31606bce534b600b250c3b4092a311fd1eced83da01156d5bcfaad7aade

    • SSDEEP

      192:GRTSl/ex70OJp3U5WtRqRLnOyhb6hz801Sux3ulXhDQR:GRTSl/kfzWIRqRLnOy3mxaX1E

    Score
    3/10
    behavioral21behavioral22

    • Target

      $SYSDIR/$SYSDIR/Funshion.scr

    • Size

      504KB

    • MD5

      f6fb0456e5083b41eb970d1ec4de2d76

    • SHA1

      b1ef6414e651c06a79d36cd21eb88b69f7ea0851

    • SHA256

      9a436d862a56174373be465a05dc477c9a1f96be52f01a8606e3d890f6b7cb0d

    • SHA512

      b348a14f4a91905d9f1dd730a731553581a18a7646176763075a5e66abb2639fb02477d913db177c0ab19ebba4f891fa937cac1afe99fd3bd8b59bd0cb99bb97

    • SSDEEP

      6144:UKhrsGRZubVktVTZ1mNjqmJk+Lf+n9sQTfioxE2J3nybMOsPvhApvvUb:FhrRRZuB8znmyW+ndJxEW3ishcu

    Score
    1/10
    behavioral23behavioral24

    • Target

      $TEMP/$SYSDIR/Funshion.scr

    • Size

      504KB

    • MD5

      f6fb0456e5083b41eb970d1ec4de2d76

    • SHA1

      b1ef6414e651c06a79d36cd21eb88b69f7ea0851

    • SHA256

      9a436d862a56174373be465a05dc477c9a1f96be52f01a8606e3d890f6b7cb0d

    • SHA512

      b348a14f4a91905d9f1dd730a731553581a18a7646176763075a5e66abb2639fb02477d913db177c0ab19ebba4f891fa937cac1afe99fd3bd8b59bd0cb99bb97

    • SSDEEP

      6144:UKhrsGRZubVktVTZ1mNjqmJk+Lf+n9sQTfioxE2J3nybMOsPvhApvvUb:FhrRRZuB8znmyW+ndJxEW3ishcu

    Score
    1/10
    behavioral25behavioral26

    • Target

      $TEMP/Dump.dll

    • Size

      292KB

    • MD5

      eccc601de1be530ab586f67a7746a1d7

    • SHA1

      2fe1eb70c44e9bfe7f7b989501d397e2ab0af94e

    • SHA256

      7b8ddc02606124e198e8c333d0e39a1f7c5d8233b42db42352206bde59178319

    • SHA512

      0fa9044aa44532949a2009cc37ced65c1c75a56619680a95ac53c9bdcc7c61d7d874bb3f01e1c62987a6c777f2008a5a9a7605d8fd327010ededcdad874a94e4

    • SSDEEP

      3072:BvQSSX/jiSHqVM0bwTAxwYpjdk233cHtqOCnXayRa9L7IC4NYZ+o8MpFBPG5SJ+D:BvnSX/jfaw0xbG2ncHkXbg+0t8D

    Score
    5/10

    • Drops file in System32 directory

    behavioral27behavioral28

    • Target

      $TEMP/getmacaddress.dll

    • Size

      156KB

    • MD5

      860e633786ad08a8013327052695d669

    • SHA1

      67eb0e35b86e677b99ff5947e28c8b55a9d81690

    • SHA256

      d6017709adc7f6bed36c3ad932d5e68c699418c9baade81dca0c145d4661cc46

    • SHA512

      2acde6cccab29aab16d0b6235351b0239eda19ae568553bdb8f80c8fc49ece72deafd1237e08f14c1d4ea3facbade97db8c442ecb500d7d5928a7e920fd3f85a

    • SSDEEP

      3072:DLLYx20PcAAtmt0O7GcezOIUiTdrqBWnBfFw5bPlRp:Dn0phV7d+dT3BQtL

    Score
    1/10
    behavioral29behavioral30

    • Target

      $TEMP/xml2fspdata.exe

    • Size

      124KB

    • MD5

      135aa003b748c1aa76c0610fee3f980e

    • SHA1

      edf79f78c6fb39cf632c9ffd5bb1436016d5852f

    • SHA256

      cbf8551809f88b3602f4a29b2e04920fc8ff4674d38da93d769bbbfe1683241c

    • SHA512

      6d36e0a8fcaa544fd4f8a1656e8c23cadcdb4a83734822bbcfcc0fca97861ebd13d08b36a448065e01948c9bf7df07204fe9f2cf226314ad20469b396a85bbe8

    • SSDEEP

      3072:8BGnF5O6zuqlseceLqGtbNiD+MQQyDa5u4:eu5O6HlTVLbNiB8F4

    Score
    1/10
    behavioral31behavioral32

MITRE ATT&CK Enterprise v15

Tasks

static1

Score
3/10

behavioral1

adwarediscoveryevasionpersistencestealer
Score
10/10

behavioral2

adwarediscoverypersistencestealer
Score
7/10

behavioral3

Score
3/10

behavioral4

Score
3/10

behavioral5

Score
3/10

behavioral6

Score
3/10

behavioral7

Score
3/10

behavioral8

Score
3/10

behavioral9

Score
3/10

behavioral10

Score
3/10

behavioral11

Score
3/10

behavioral12

Score
3/10

behavioral13

Score
3/10

behavioral14

Score
3/10

behavioral15

Score
3/10

behavioral16

Score
3/10

behavioral17

Score
3/10

behavioral18

Score
3/10

behavioral19

Score
3/10

behavioral20

Score
3/10

behavioral21

Score
3/10

behavioral22

Score
3/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
5/10

behavioral28

Score
5/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

Score
1/10

behavioral32

Score
1/10