Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

7

730f72a1bd...18.exe

windows7-x64

7

730f72a1bd...18.exe

windows10-2004-x64

7

$LOCALAPPD...ly.exe

windows7-x64

7

$LOCALAPPD...ly.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...dl.dll

windows7-x64

3

$PLUGINSDI...dl.dll

windows10-2004-x64

3

$PLUGINSDI...om.dll

windows7-x64

7

$PLUGINSDI...om.dll

windows10-2004-x64

7

$PLUGINSDI...dt.dll

windows7-x64

3

$PLUGINSDI...dt.dll

windows10-2004-x64

3

$PLUGINSDI...ry.dll

windows7-x64

3

$PLUGINSDI...ry.dll

windows10-2004-x64

3

$PLUGINSDI...on.dll

windows7-x64

7

$PLUGINSDI...on.dll

windows10-2004-x64

7

$_0_/exten...lts.js

windows7-x64

3

$_0_/exten...lts.js

windows10-2004-x64

3

background.html

windows7-x64

3

background.html

windows10-2004-x64

3

DealPlyIE.dll

windows7-x64

6

DealPlyIE.dll

windows10-2004-x64

6

vn-zugo.exe

windows7-x64

7

vn-zugo.exe

windows10-2004-x64

7

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDIR/Math.dll

windows7-x64

3

$PLUGINSDIR/Math.dll

windows10-2004-x64

3

$PLUGINSDI...dl.dll

windows7-x64

3

$PLUGINSDI...dl.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    730f72a1bdb444ee5be0c9610c97358b_JaffaCakes118

  • Size

    2.2MB

  • Sample

    240726-hz9qfatbkp

  • MD5

    730f72a1bdb444ee5be0c9610c97358b

  • SHA1

    38d68e7e8df25bfefa05a84a22914c5ba6fa78f5

  • SHA256

    d2accfbb7bc0a970d03a7c455be15f31a973cfd5d0950de324df2711d069083f

  • SHA512

    b4a549ba6c7c8e532d620913206618633515f221bdd5ab2a865abb98b541f2bf01dc5e531c250e9afd474b2f9ec2b42f2ccba7a266aa92a1b1c602db4df639a3

  • SSDEEP

    49152:FCnGlLFDOpX0F9aPm6sOyQr8qHg6Gbul/V71b1dzYfjw:FOGzDOuGP9sOypugTO7F1dzj

Score
7/10
adwarediscoveryexecutionspywarestealerupx

Malware Config

Targets

    • Target

      730f72a1bdb444ee5be0c9610c97358b_JaffaCakes118

    • Size

      2.2MB

    • MD5

      730f72a1bdb444ee5be0c9610c97358b

    • SHA1

      38d68e7e8df25bfefa05a84a22914c5ba6fa78f5

    • SHA256

      d2accfbb7bc0a970d03a7c455be15f31a973cfd5d0950de324df2711d069083f

    • SHA512

      b4a549ba6c7c8e532d620913206618633515f221bdd5ab2a865abb98b541f2bf01dc5e531c250e9afd474b2f9ec2b42f2ccba7a266aa92a1b1c602db4df639a3

    • SSDEEP

      49152:FCnGlLFDOpX0F9aPm6sOyQr8qHg6Gbul/V71b1dzYfjw:FOGzDOuGP9sOypugTO7F1dzj

    Score
    7/10
    discoveryupx

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

    • Target

      $LOCALAPPDATA/dealply.exe

    • Size

      923KB

    • MD5

      caaca3d3783173998fbb157fdd07a846

    • SHA1

      92e8b1d702c8b8411a33f9497f8bfba72628522d

    • SHA256

      8854c7a980c5489d1dd6bec436369c14d1264e2f04e3d46a5d78ac9a875629c6

    • SHA512

      d77915dc3b7f3182a64625f778e921716dbe0226fb90a425c685fd95c07696872b46b199b42835b77ed1eb6bf602fc4f8e2f0de2f1b8e25b00d07e8c33c8aec8

    • SSDEEP

      24576:tKkd4HgrpbPhyiE4gIMcXFKW3O+GxodwJz:QBHgrpbcizcc15LGxo2x

    Score
    7/10
    discovery

    • Loads dropped DLL

    behavioral3behavioral4

    • Target

      $PLUGINSDIR/InstallOptions.dll

    • Size

      14KB

    • MD5

      325b008aec81e5aaa57096f05d4212b5

    • SHA1

      27a2d89747a20305b6518438eff5b9f57f7df5c3

    • SHA256

      c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

    • SHA512

      18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

    • SSDEEP

      192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo

    Score
    3/10
    discovery
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/LangDLL.dll

    • Size

      5KB

    • MD5

      9384f4007c492d4fa040924f31c00166

    • SHA1

      aba37faef30d7c445584c688a0b5638f5db31c7b

    • SHA256

      60a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5

    • SHA512

      68f158887e24302673227adffc688fd3edabf097d7f5410f983e06c6b9c7344ca1d8a45c7fa05553adcc5987993df3a298763477168d4842e554c4eb93b9aaaf

    • SSDEEP

      48:iV6pAvmNC6iMPUptxEZK65x/AmvycNSmwVsOYJyvrpXptp/JvR0Jlof5d2:2811GED5ZTvycNSmwVsTJuftpZR0Sd2

    Score
    3/10
    discovery
    behavioral7behavioral8

    • Target

      $PLUGINSDIR/NSISdl.dll

    • Size

      14KB

    • MD5

      a5f8399a743ab7f9c88c645c35b1ebb5

    • SHA1

      168f3c158913b0367bf79fa413357fbe97018191

    • SHA256

      dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

    • SHA512

      824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

    • SSDEEP

      192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go

    Score
    3/10
    discovery
    behavioral10behavioral9

    • Target

      $PLUGINSDIR/nsRandom.dll

    • Size

      21KB

    • MD5

      ab467b8dfaa660a0f0e5b26e28af5735

    • SHA1

      596abd2c31eaff3479edf2069db1c155b59ce74d

    • SHA256

      db267d9920395b4badc48de04df99dfd21d579480d103cae0f48e6578197ff73

    • SHA512

      7d002dc203997b8a4d8ec20c92cd82848e29d746414f4a61265c76d4afb12c05bce826fc63f4d2bd3d527f38506c391855767d864c37584df11b5db9ca008301

    • SSDEEP

      384:LCHDPMs4GdtyO5roguusMxUXiO3wOw95euooP2UgKbd9BvNtf:LCHD6Gh87MKXil/5r2U3z

    Score
    7/10
    discoveryupx

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral11behavioral12

    • Target

      $PLUGINSDIR/nsisdt.dll

    • Size

      5KB

    • MD5

      df4795dfabe3bc9278a73d496cc4b40d

    • SHA1

      2648ded47e29ecf3e1a1cc20c631e83caf566897

    • SHA256

      2261027077f23c8dba6b72af28862832aaa059740d0f5634b46cabb14326dd10

    • SHA512

      013d9712c3d699a7f41ab3e55931c9abb421fb2eda3542da5a4831ad2f073a1b0643120cc78147db0bfcd01df98ade3045ecb2f1e252fff1dc40be845e5ae303

    • SSDEEP

      24:etGSyYi61xyMmuEwv61OVXOwr+t5blXgO8ELnD3TPrHjf7Xz5CY1aeBEW58q6TvK:6y2xyNuEwWwU5blmPeB958xTvT7L/

    Score
    3/10
    discovery
    behavioral13behavioral14

    • Target

      $PLUGINSDIR/registry.dll

    • Size

      24KB

    • MD5

      2b7007ed0262ca02ef69d8990815cbeb

    • SHA1

      2eabe4f755213666dbbbde024a5235ddde02b47f

    • SHA256

      0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d

    • SHA512

      aa75ee59ca0b8530eb7298b74e5f334ae9d14129f603b285a3170b82103cfdcc175af8185317e6207142517769e69a24b34fcdf0f58ed50a4960cbe8c22a0aca

    • SSDEEP

      384:W2mvyNjH3rPnAZ4wu2QbnC7qB7PnrvScaeYA4CIDEge/QqL2AQ:/75w/OfrzB4CUxuQfA

    Score
    3/10
    discovery
    behavioral15behavioral16

    • Target

      $PLUGINSDIR/version.dll

    • Size

      6KB

    • MD5

      ebc5bb904cdac1c67ada3fa733229966

    • SHA1

      3c6abfa0ddef7f3289f38326077a5041389b15d2

    • SHA256

      3eba921ef649b71f98d9378dee8105b38d2464c9ccde37a694e4a0cd77d22a75

    • SHA512

      fa71afcc166093fbd076a84f10d055f5a686618711d053ab60d8bd060e78cb2fdc15fa35f363822c9913413251c718d01ddd6432ab128816d98f9aabf5612c9f

    • SSDEEP

      96:nPtMckE1e91BopVyXwUhn3f1I0vOKeoqO4d8QvS9:n1MMuOUhdI0c04yV9

    Score
    7/10
    discoveryupx

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral17behavioral18

    • Target

      $_0_/extensions/{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF}/defaults/preferences/defaults.js

    • Size

      90B

    • MD5

      0539649dfb977fcb9a6f9818524ee150

    • SHA1

      5754dda1453246119b3c130b70a7c61a90c9ee0c

    • SHA256

      4fb8d38e19a950ea24098dfded5f46bee24581a0ddd20e759bd76c40c358a653

    • SHA512

      4cca23a2ee74bac095e217aa5151368f230a08119f51f5a0561c5b03d6ad47132e131cf82dc05709527de6b0a8bcd9c7c5087230749af0aa52d3ce8c5dcb134c

    Score
    3/10
    execution
    behavioral19behavioral20

    • Target

      background.html

    • Size

      1KB

    • MD5

      b283e8f75dcc4349e1d88e72358ea3b8

    • SHA1

      b017c920e90daeae106ad152ecfb42a1d8d203a7

    • SHA256

      67cb79577f26d6632168145a2b7b4d3ad6b46247f0244a9f6f25b45fceaeddc3

    • SHA512

      c714233bc1d7ae252695d7b56213523525beb4b8e198b11377213647418a76824e89c49dd75b82beb0fa205646ca458ba7f14d42fc350d6836a6921aa9524402

    Score
    3/10
    discovery
    behavioral21behavioral22

    • Target

      DealPlyIE.dll

    • Size

      81KB

    • MD5

      53905cd4461961f341c0b41d4d0ec02b

    • SHA1

      aa9d6284707f25a4ad35336ed6c131ac56f175aa

    • SHA256

      c28c50700c5560d834b058e0ca816e1ccd003e77fb58777f55cd4b9d015f9013

    • SHA512

      84da2711dbeed65043150ed5afc23a6482ebb13e080a2e311f687ede136751c5f6e5fbeb947c0380e8b29ac64cb5741226a8ec23d69cd340ed8070fd48177248

    • SSDEEP

      1536:FXEdWDidDMsRs/sbOyDsxbU3Q+HUWY9f5YJ+/W5P:F0iX/AyS3HHi9f5YJ+yP

    Score
    6/10
    adwarediscoverystealer

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware
    behavioral23behavioral24

    • Target

      vn-zugo.exe

    • Size

      720KB

    • MD5

      6ee75d20b907780781e90fa97897b8ed

    • SHA1

      03c0ce29326ceef11b237c91ca0922f3dc6ac0b4

    • SHA256

      a2efbc9b9a4d99cf60bd3e3b631dbe6116f31c15ccefc9f28ba3c95404afd63f

    • SHA512

      36eb2dc03ec76756a92aca72b3827105344b4ee2b179b4abf9432828505ee6d151df6959b2280d4086952ebefa4b273f83ab25ae1e2299bb4c3ef859483f1e08

    • SSDEEP

      12288:CU1qWMBibgTEX4MXAoQu7uIpKfHB/mY+oCIPR08gu+8uRj2d4Gp57m63OM0u:CIqWeibgoIaUCoh+/ZyudGp5/3JB

    Score
    7/10
    discoveryspywarestealer

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral25behavioral26

    • Target

      $PLUGINSDIR/KillProcDLL.dll

    • Size

      20KB

    • MD5

      de2b06d8abcd4a1d3330e415ce638a6a

    • SHA1

      2f1bf738915b288530dedb861f4ea4f60069a91f

    • SHA256

      8f62633831a326174f05e89503e42a493aa834fa6d7ba7138d9d57ac5873512d

    • SHA512

      8dbc0edb71d6acc327418270b33d5627d7940ce406e54152af9f6c8f6d90c7239aa647a0e1f4769d0aa8bd3e38d60643e6356ff7a5ccf7dc44c5617f72277b70

    • SSDEEP

      96:J1szPlsFYmIGExrjwIqiwZePAYyU76b+4d:Juztr+8wzg7xN4

    Score
    3/10
    discovery
    behavioral27behavioral28

    • Target

      $PLUGINSDIR/Math.dll

    • Size

      66KB

    • MD5

      b140459077c7c39be4bef249c2f84535

    • SHA1

      c56498241c2ddafb01961596da16d08d1b11cd35

    • SHA256

      0598f7d83db44929b7170c1285457b52b4281185f63ced102e709bf065f10d67

    • SHA512

      fbcb19a951d96a216d73b6b3e005338bbb6e11332c6cc8c3f179ccd420b4db0e5682dc4245bd120dcb67bc70960eab368e74c68c7c165a485a12a7d0d8a00328

    • SSDEEP

      1536:0P43WZ4Ql60gam+2MwRmPeqFVHbQH0ZZ1Iet:0wU609VMH0T/t

    Score
    3/10
    discovery
    behavioral29behavioral30

    • Target

      $PLUGINSDIR/NSISdl.dll

    • Size

      14KB

    • MD5

      a5f8399a743ab7f9c88c645c35b1ebb5

    • SHA1

      168f3c158913b0367bf79fa413357fbe97018191

    • SHA256

      dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

    • SHA512

      824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

    • SSDEEP

      192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go

    Score
    3/10
    discovery
    behavioral31behavioral32

MITRE ATT&CK Enterprise v15

Tasks

static1

upx
Score
7/10

behavioral1

discoveryupx
Score
7/10

behavioral2

discoveryupx
Score
7/10

behavioral3

discovery
Score
7/10

behavioral4

discovery
Score
7/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
3/10

behavioral11

discoveryupx
Score
7/10

behavioral12

discoveryupx
Score
7/10

behavioral13

discovery
Score
3/10

behavioral14

discovery
Score
3/10

behavioral15

discovery
Score
3/10

behavioral16

discovery
Score
3/10

behavioral17

discoveryupx
Score
7/10

behavioral18

discoveryupx
Score
7/10

behavioral19

execution
Score
3/10

behavioral20

execution
Score
3/10

behavioral21

discovery
Score
3/10

behavioral22

discovery
Score
3/10

behavioral23

adwarediscoverystealer
Score
6/10

behavioral24

adwarediscoverystealer
Score
6/10

behavioral25

discoveryspywarestealer
Score
7/10

behavioral26

discoveryspywarestealer
Score
7/10

behavioral27

discovery
Score
3/10

behavioral28

discovery
Score
3/10

behavioral29

discovery
Score
3/10

behavioral30

discovery
Score
3/10

behavioral31

discovery
Score
3/10

behavioral32

discovery
Score
3/10