Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
7730f72a1bd...18.exe
windows7-x64
7730f72a1bd...18.exe
windows10-2004-x64
7$LOCALAPPD...ly.exe
windows7-x64
7$LOCALAPPD...ly.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...om.dll
windows7-x64
7$PLUGINSDI...om.dll
windows10-2004-x64
7$PLUGINSDI...dt.dll
windows7-x64
3$PLUGINSDI...dt.dll
windows10-2004-x64
3$PLUGINSDI...ry.dll
windows7-x64
3$PLUGINSDI...ry.dll
windows10-2004-x64
3$PLUGINSDI...on.dll
windows7-x64
7$PLUGINSDI...on.dll
windows10-2004-x64
7$_0_/exten...lts.js
windows7-x64
3$_0_/exten...lts.js
windows10-2004-x64
3background.html
windows7-x64
3background.html
windows10-2004-x64
3DealPlyIE.dll
windows7-x64
6DealPlyIE.dll
windows10-2004-x64
6vn-zugo.exe
windows7-x64
7vn-zugo.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDIR/Math.dll
windows7-x64
3$PLUGINSDIR/Math.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26/07/2024, 07:11
Behavioral task
behavioral1
Sample
730f72a1bdb444ee5be0c9610c97358b_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
730f72a1bdb444ee5be0c9610c97358b_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
$LOCALAPPDATA/dealply.exe
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
$LOCALAPPDATA/dealply.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsRandom.dll
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsRandom.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/nsisdt.dll
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/nsisdt.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/registry.dll
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/registry.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/version.dll
Resource
win7-20240705-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/version.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral19
Sample
$_0_/extensions/{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF}/defaults/preferences/defaults.js
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
$_0_/extensions/{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF}/defaults/preferences/defaults.js
Resource
win10v2004-20240709-en
Behavioral task
behavioral21
Sample
background.html
Resource
win7-20240705-en
Behavioral task
behavioral22
Sample
background.html
Resource
win10v2004-20240709-en
Behavioral task
behavioral23
Sample
DealPlyIE.dll
Resource
win7-20240705-en
Behavioral task
behavioral24
Sample
DealPlyIE.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral25
Sample
vn-zugo.exe
Resource
win7-20240704-en
Behavioral task
behavioral26
Sample
vn-zugo.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral27
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win7-20240704-en
Behavioral task
behavioral28
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral29
Sample
$PLUGINSDIR/Math.dll
Resource
win7-20240705-en
Behavioral task
behavioral30
Sample
$PLUGINSDIR/Math.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral31
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240708-en
Behavioral task
behavioral32
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20240709-en
General
-
Target
DealPlyIE.dll
-
Size
81KB
-
MD5
53905cd4461961f341c0b41d4d0ec02b
-
SHA1
aa9d6284707f25a4ad35336ed6c131ac56f175aa
-
SHA256
c28c50700c5560d834b058e0ca816e1ccd003e77fb58777f55cd4b9d015f9013
-
SHA512
84da2711dbeed65043150ed5afc23a6482ebb13e080a2e311f687ede136751c5f6e5fbeb947c0380e8b29ac64cb5741226a8ec23d69cd340ed8070fd48177248
-
SSDEEP
1536:FXEdWDidDMsRs/sbOyDsxbU3Q+HUWY9f5YJ+/W5P:F0iX/AyS3HHi9f5YJ+yP
Malware Config
Signatures
-
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A6174F27-1FFF-E1D6-A93F-BA48AD5DD448} regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A6174F27-1FFF-E1D6-A93F-BA48AD5DD448}\NoExplorer = "1" regsvr32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A6174F27-1FFF-E1D6-A93F-BA48AD5DD448}\InProcServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A6174F27-1FFF-E1D6-A93F-BA48AD5DD448}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DealPlyIE.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A6174F27-1FFF-E1D6-A93F-BA48AD5DD448}\InProcServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A6174F27-1FFF-E1D6-A93F-BA48AD5DD448} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A6174F27-1FFF-E1D6-A93F-BA48AD5DD448}\ = "DealPly" regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 620 wrote to memory of 3592 620 regsvr32.exe 84 PID 620 wrote to memory of 3592 620 regsvr32.exe 84 PID 620 wrote to memory of 3592 620 regsvr32.exe 84
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\DealPlyIE.dll1⤵
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\DealPlyIE.dll2⤵
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3592
-