Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3f034640560...c0.exe
windows7-x64
10f034640560...c0.exe
windows10-2004-x64
7$PLUGINSDI...nt.dll
windows7-x64
3$PLUGINSDI...nt.dll
windows10-2004-x64
3$PLUGINSDI...md.dll
windows7-x64
3$PLUGINSDI...md.dll
windows10-2004-x64
3$PLUGINSDI...os.dll
windows7-x64
3$PLUGINSDI...os.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows7-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3$PLUGINSDI...ML.dll
windows7-x64
3$PLUGINSDI...ML.dll
windows10-2004-x64
3$SYSDIR/$S...on.scr
windows7-x64
1$SYSDIR/$S...on.scr
windows10-2004-x64
1$TEMP/$SYS...on.scr
windows7-x64
1$TEMP/$SYS...on.scr
windows10-2004-x64
1$TEMP/Dump.dll
windows7-x64
5$TEMP/Dump.dll
windows10-2004-x64
5$TEMP/getm...ss.dll
windows7-x64
1$TEMP/getm...ss.dll
windows10-2004-x64
1$TEMP/xml2fspdata.exe
windows7-x64
1$TEMP/xml2fspdata.exe
windows10-2004-x64
1General
-
Target
f034640560565580e9233100f97d3e6a594915bd7d900cff444fd1c2c48c2cc0
-
Size
5.4MB
-
Sample
240714-vk1kfazanp
-
MD5
46acc3fd90233d5b2fc9dffc05733eac
-
SHA1
4061c7f486ae44fdee3a35a2c69740c753963596
-
SHA256
f034640560565580e9233100f97d3e6a594915bd7d900cff444fd1c2c48c2cc0
-
SHA512
14fc0071288256ba8ad3c32c0f387da10c16d0ec3a1cbb292ca57f0bc2923fae6ca2d6821d5461f9f2fd2f52c2e75480ae488a255f59cc3588cad122ce5de39a
-
SSDEEP
98304:E2KNVQyPDrBdfSNW40xhlkauVz1/c490/8+rc+NFs4eR7ThbxrS3nZ0g:YYsd6HehlkVP488Q4eRbxmJn
Static task
static1
Behavioral task
behavioral1
Sample
f034640560565580e9233100f97d3e6a594915bd7d900cff444fd1c2c48c2cc0.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
f034640560565580e9233100f97d3e6a594915bd7d900cff444fd1c2c48c2cc0.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/ButtonEvent.dll
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/ButtonEvent.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/ExecCmd.dll
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/ExecCmd.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/ExecDos.dll
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/ExecDos.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/md5dll.dll
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/md5dll.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral21
Sample
$PLUGINSDIR/nsisXML.dll
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
$PLUGINSDIR/nsisXML.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral23
Sample
$SYSDIR/$SYSDIR/Funshion.scr
Resource
win7-20240704-en
Behavioral task
behavioral24
Sample
$SYSDIR/$SYSDIR/Funshion.scr
Resource
win10v2004-20240709-en
Behavioral task
behavioral25
Sample
$TEMP/$SYSDIR/Funshion.scr
Resource
win7-20240705-en
Behavioral task
behavioral26
Sample
$TEMP/$SYSDIR/Funshion.scr
Resource
win10v2004-20240709-en
Behavioral task
behavioral27
Sample
$TEMP/Dump.dll
Resource
win7-20240705-en
Behavioral task
behavioral28
Sample
$TEMP/Dump.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral29
Sample
$TEMP/getmacaddress.dll
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
$TEMP/getmacaddress.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral31
Sample
$TEMP/xml2fspdata.exe
Resource
win7-20240705-en
Behavioral task
behavioral32
Sample
$TEMP/xml2fspdata.exe
Resource
win10v2004-20240709-en
Malware Config
Targets
-
-
Target
f034640560565580e9233100f97d3e6a594915bd7d900cff444fd1c2c48c2cc0
-
Size
5.4MB
-
MD5
46acc3fd90233d5b2fc9dffc05733eac
-
SHA1
4061c7f486ae44fdee3a35a2c69740c753963596
-
SHA256
f034640560565580e9233100f97d3e6a594915bd7d900cff444fd1c2c48c2cc0
-
SHA512
14fc0071288256ba8ad3c32c0f387da10c16d0ec3a1cbb292ca57f0bc2923fae6ca2d6821d5461f9f2fd2f52c2e75480ae488a255f59cc3588cad122ce5de39a
-
SSDEEP
98304:E2KNVQyPDrBdfSNW40xhlkauVz1/c490/8+rc+NFs4eR7ThbxrS3nZ0g:YYsd6HehlkVP488Q4eRbxmJn
Score10/10-
Modifies firewall policy service
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
-
-
-
Target
$PLUGINSDIR/ButtonEvent.dll
-
Size
4KB
-
MD5
fad9d09fc0267e8513b8628e767b2604
-
SHA1
bea76a7621c07b30ed90bedef4d608a5b9e15300
-
SHA256
5d913c6be9c9e13801acc5d78b11d9f3cd42c1b3b3cad8272eb6e1bfb06730c2
-
SHA512
b39c5ea8aea0640f5a32a1fc03e8c8382a621c168980b3bc5e2897932878003b2b8ef75b3ad68149c35420d652143e2ef763b6a47d84ec73621017f0273e2805
Score3/10 -
-
-
Target
$PLUGINSDIR/ExecCmd.dll
-
Size
4KB
-
MD5
b9380b0bea8854fd9f93cc1fda0dfeac
-
SHA1
edb8d58074e098f7b5f0d158abedc7fc53638618
-
SHA256
1f4bd9c9376fe1b6913baeca7fb6df6467126f27c9c2fe038206567232a0e244
-
SHA512
45c3ab0f2bce53b75e72e43bac747dc0618342a3f498be8e2eb62a6db0b137fcdb1735da83051b14824996b5287109aa831e5859d6f21f0ed21b76b3d335418c
-
SSDEEP
48:ifXNtGNjFizsU35iej7luiwa28mDJmDKUOMQH0glay/Aa4r/:5Fef5iej5txKJKenlV4r/
Score3/10 -
-
-
Target
$PLUGINSDIR/ExecDos.dll
-
Size
5KB
-
MD5
a7cd6206240484c8436c66afb12bdfbf
-
SHA1
0bb3e24a7eb0a9e5a8eae06b1c6e7551a7ec9919
-
SHA256
69ac56d2fdf3c71b766d3cc49b33b36f1287cc2503310811017467dfcb455926
-
SHA512
b9ee7803301e50a8ec20ab3f87eb9e509ea24d11a69e90005f30c1666acc4ed0a208bd56e372e2e5c6a6d901d45f04a12427303d74761983593d10b344c79904
-
SSDEEP
48:6jOBtU/BXN8kUByyy/Aklkcrkyg7Vg5RibGoTCTo0gqVeeaeQqzM5rv774YRljmB:y/DMy4ncrkyg7tbpQFLUEYRxe
Score3/10 -
-
-
Target
$PLUGINSDIR/FindProcDLL.dll
-
Size
31KB
-
MD5
83cd62eab980e3d64c131799608c8371
-
SHA1
5b57a6842a154997e31fab573c5754b358f5dd1c
-
SHA256
a6122e80f1c51dc72770b4f56c7c482f7a9571143fbf83b19c4d141d0cb19294
-
SHA512
91cfbcc125600ec341f5571dcf1e4a814cf7673f82cf42f32155bd54791bbf32619f2bb14ae871d7996e9ddecdfcc5db40caa0979d6dfba3e73cfe8e69c163c9
-
SSDEEP
384:1NWlNdqdAnhTKMLE2oIM05fnqCiWg3Yy9kflIinokN:1NWtqdihTKCldkYwkdpnoy
Score3/10 -
-
-
Target
$PLUGINSDIR/InstallOptions.dll
-
Size
14KB
-
MD5
325b008aec81e5aaa57096f05d4212b5
-
SHA1
27a2d89747a20305b6518438eff5b9f57f7df5c3
-
SHA256
c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
-
SHA512
18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
-
SSDEEP
192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
Score3/10 -
-
-
Target
$PLUGINSDIR/KillProcDLL.dll
-
Size
32KB
-
MD5
83142eac84475f4ca889c73f10d9c179
-
SHA1
dbe43c0de8ef881466bd74861b2e5b17598b5ce8
-
SHA256
ae2f1658656e554f37e6eac896475a3862841a18ffc6fad2754e2d3525770729
-
SHA512
1c66eab21f0c9e0b99ecc3844516a6978f52e0c7f489405a427532ecbe78947c37dac5b4c8b722cc8bc1edfb74ba4824519d56099e587e754e5c668701e83bd1
-
SSDEEP
384:3rYz6grZodORNWATt4TBmlk5ooyzFh7BukAUdJoUtSOSR:3QggDWATWNCFh7BNddJoxO+
Score3/10 -
-
-
Target
$PLUGINSDIR/NSISdl.dll
-
Size
14KB
-
MD5
a5f8399a743ab7f9c88c645c35b1ebb5
-
SHA1
168f3c158913b0367bf79fa413357fbe97018191
-
SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
-
SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
-
SSDEEP
192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
Score3/10 -
-
-
Target
$PLUGINSDIR/System.dll
-
Size
11KB
-
MD5
c17103ae9072a06da581dec998343fc1
-
SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
-
SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
-
SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
SSDEEP
192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
Score3/10 -
-
-
Target
$PLUGINSDIR/md5dll.dll
-
Size
8KB
-
MD5
a7d710e78711d5ab90e4792763241754
-
SHA1
f31cecd926c5d497aba163a17b75975ec34beb13
-
SHA256
9b05dd603f13c196f3f21c43f48834208fed2294f7090fcd1334931014611fb2
-
SHA512
f0ca2d6f9a8aeac84ef8b051154a041adffc46e3e9aced142e9c7bf5f7272b047e1db421d38cb2d9182d7442bee3dd806618b019ec042a23ae0e71671d2943c0
-
SSDEEP
96:YV2qpbvYSflug0Dvxn6GuKM9sh1gdrN9+oB7FT9WibOoBZcko5N/:Yt5lugRK8hlvbwkKV
Score3/10 -
-
-
Target
$PLUGINSDIR/nsisXML.dll
-
Size
11KB
-
MD5
13deb9a0f4e4286df01abc85e1895e09
-
SHA1
3174853b32407fd85220de844b390a18a8a76c97
-
SHA256
c40ef0b41c035b6d29656616ddc113a717bfd1bb78c9fcac75d7b6eefdc7bf83
-
SHA512
604aa82a9c4818d2f63fb11bbde561afc137a77e9f3108dfd7f4596524e46ce71b6dc31606bce534b600b250c3b4092a311fd1eced83da01156d5bcfaad7aade
-
SSDEEP
192:GRTSl/ex70OJp3U5WtRqRLnOyhb6hz801Sux3ulXhDQR:GRTSl/kfzWIRqRLnOy3mxaX1E
Score3/10 -
-
-
Target
$SYSDIR/$SYSDIR/Funshion.scr
-
Size
504KB
-
MD5
f6fb0456e5083b41eb970d1ec4de2d76
-
SHA1
b1ef6414e651c06a79d36cd21eb88b69f7ea0851
-
SHA256
9a436d862a56174373be465a05dc477c9a1f96be52f01a8606e3d890f6b7cb0d
-
SHA512
b348a14f4a91905d9f1dd730a731553581a18a7646176763075a5e66abb2639fb02477d913db177c0ab19ebba4f891fa937cac1afe99fd3bd8b59bd0cb99bb97
-
SSDEEP
6144:UKhrsGRZubVktVTZ1mNjqmJk+Lf+n9sQTfioxE2J3nybMOsPvhApvvUb:FhrRRZuB8znmyW+ndJxEW3ishcu
Score1/10 -
-
-
Target
$TEMP/$SYSDIR/Funshion.scr
-
Size
504KB
-
MD5
f6fb0456e5083b41eb970d1ec4de2d76
-
SHA1
b1ef6414e651c06a79d36cd21eb88b69f7ea0851
-
SHA256
9a436d862a56174373be465a05dc477c9a1f96be52f01a8606e3d890f6b7cb0d
-
SHA512
b348a14f4a91905d9f1dd730a731553581a18a7646176763075a5e66abb2639fb02477d913db177c0ab19ebba4f891fa937cac1afe99fd3bd8b59bd0cb99bb97
-
SSDEEP
6144:UKhrsGRZubVktVTZ1mNjqmJk+Lf+n9sQTfioxE2J3nybMOsPvhApvvUb:FhrRRZuB8znmyW+ndJxEW3ishcu
Score1/10 -
-
-
Target
$TEMP/Dump.dll
-
Size
292KB
-
MD5
eccc601de1be530ab586f67a7746a1d7
-
SHA1
2fe1eb70c44e9bfe7f7b989501d397e2ab0af94e
-
SHA256
7b8ddc02606124e198e8c333d0e39a1f7c5d8233b42db42352206bde59178319
-
SHA512
0fa9044aa44532949a2009cc37ced65c1c75a56619680a95ac53c9bdcc7c61d7d874bb3f01e1c62987a6c777f2008a5a9a7605d8fd327010ededcdad874a94e4
-
SSDEEP
3072:BvQSSX/jiSHqVM0bwTAxwYpjdk233cHtqOCnXayRa9L7IC4NYZ+o8MpFBPG5SJ+D:BvnSX/jfaw0xbG2ncHkXbg+0t8D
Score5/10-
Drops file in System32 directory
-
-
-
Target
$TEMP/getmacaddress.dll
-
Size
156KB
-
MD5
860e633786ad08a8013327052695d669
-
SHA1
67eb0e35b86e677b99ff5947e28c8b55a9d81690
-
SHA256
d6017709adc7f6bed36c3ad932d5e68c699418c9baade81dca0c145d4661cc46
-
SHA512
2acde6cccab29aab16d0b6235351b0239eda19ae568553bdb8f80c8fc49ece72deafd1237e08f14c1d4ea3facbade97db8c442ecb500d7d5928a7e920fd3f85a
-
SSDEEP
3072:DLLYx20PcAAtmt0O7GcezOIUiTdrqBWnBfFw5bPlRp:Dn0phV7d+dT3BQtL
Score1/10 -
-
-
Target
$TEMP/xml2fspdata.exe
-
Size
124KB
-
MD5
135aa003b748c1aa76c0610fee3f980e
-
SHA1
edf79f78c6fb39cf632c9ffd5bb1436016d5852f
-
SHA256
cbf8551809f88b3602f4a29b2e04920fc8ff4674d38da93d769bbbfe1683241c
-
SHA512
6d36e0a8fcaa544fd4f8a1656e8c23cadcdb4a83734822bbcfcc0fca97861ebd13d08b36a448065e01948c9bf7df07204fe9f2cf226314ad20469b396a85bbe8
-
SSDEEP
3072:8BGnF5O6zuqlseceLqGtbNiD+MQQyDa5u4:eu5O6HlTVLbNiB8F4
Score1/10 -
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1