Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3Ability.msi
windows7-x64
6Ability.msi
windows10-2004-x64
6ABMCmn.dll
windows7-x64
3ABMCmn.dll
windows10-2004-x64
3ABViewForms.dll
windows7-x64
3ABViewForms.dll
windows10-2004-x64
3FormCtls.dll
windows7-x64
3FormCtls.dll
windows10-2004-x64
3FormEdit.exe
windows7-x64
1FormEdit.exe
windows10-2004-x64
3Install.exe
windows7-x64
7Install.exe
windows10-2004-x64
7a4w195.dll
windows7-x64
3a4w195.dll
windows10-2004-x64
3acfpdf.dll
windows7-x64
3acfpdf.dll
windows10-2004-x64
3acfpdfu.dll
windows7-x64
3acfpdfu.dll
windows10-2004-x64
3acfpdfui.dll
windows7-x64
3acfpdfui.dll
windows10-2004-x64
3acpdfcrdb.dll
windows7-x64
3acpdfcrdb.dll
windows10-2004-x64
3acpdfcrext.dll
windows7-x64
3acpdfcrext.dll
windows10-2004-x64
3cdintf.dll
windows7-x64
3cdintf.dll
windows10-2004-x64
3ABAnimFX.dll
windows7-x64
3ABAnimFX.dll
windows10-2004-x64
3ABHook.dll
windows7-x64
3ABHook.dll
windows10-2004-x64
3ABImageX.dll
windows7-x64
3ABImageX.dll
windows10-2004-x64
3Analysis
-
max time kernel
93s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system -
submitted
01/08/2024, 21:33
Static task
static1
Behavioral task
behavioral1
Sample
Ability.msi
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral2
Sample
Ability.msi
Resource
win10v2004-20240730-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
ABMCmn.dll
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral4
Sample
ABMCmn.dll
Resource
win10v2004-20240730-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
ABViewForms.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral6
Sample
ABViewForms.dll
Resource
win10v2004-20240730-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
FormCtls.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral8
Sample
FormCtls.dll
Resource
win10v2004-20240730-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
FormEdit.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral10
Sample
FormEdit.exe
Resource
win10v2004-20240730-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Install.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral12
Sample
Install.exe
Resource
win10v2004-20240730-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
a4w195.dll
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral14
Sample
a4w195.dll
Resource
win10v2004-20240730-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
acfpdf.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral16
Sample
acfpdf.dll
Resource
win10v2004-20240730-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
acfpdfu.dll
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral18
Sample
acfpdfu.dll
Resource
win10v2004-20240730-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
acfpdfui.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral20
Sample
acfpdfui.dll
Resource
win10v2004-20240730-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
acpdfcrdb.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral22
Sample
acpdfcrdb.dll
Resource
win10v2004-20240730-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
acpdfcrext.dll
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral24
Sample
acpdfcrext.dll
Resource
win10v2004-20240730-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
cdintf.dll
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral26
Sample
cdintf.dll
Resource
win10v2004-20240730-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
ABAnimFX.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral28
Sample
ABAnimFX.dll
Resource
win10v2004-20240730-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
ABHook.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral30
Sample
ABHook.dll
Resource
win10v2004-20240730-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
ABImageX.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral32
Sample
ABImageX.dll
Resource
win10v2004-20240730-en
windows10-2004-x64
General
-
Target
Install.exe
-
Size
116KB
-
MD5
f487bfd5c24ff804331e83be0bf4f6f7
-
SHA1
8d68a0ee4ec13d61a983444b2e608e41097079f2
-
SHA256
f7570fa917828242bc49cc74f49f24974e5877dfbc8c17652771e333ae839349
-
SHA512
18fd94acdcbdcfc97183e8f4c5c0e3af27da78f19edbceed9305f5b87304923d009a414d8d7aba4ad0db7e23142b5c46f11a578b8002ace8dc94e38d4e27f3ec
-
SSDEEP
3072:Wx4GxucJcqKhU+9cCi50C+imV5ooLQR6o0:HpO+9D6+iBIo0
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 4380 Install.exe -
Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\system32\spool\DRIVERS\x64\acpdf210.dll Install.exe File opened for modification C:\Windows\system32\spool\DRIVERS\x64\acpdf210.dll Install.exe File created C:\Windows\system32\spool\DRIVERS\x64\acpdfui210.dll Install.exe File created C:\Windows\system32\spool\DRIVERS\x64\acfpdf.txt Install.exe File created C:\Windows\SysWOW64\cdintf210.dll Install.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Install.exe -
Modifies Control Panel 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000\Control Panel\Desktop\ForegroundLockTimeout = "0" Install.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{067B6CE2-DE85-435E-8E99-F52727F57E26}\TypeLib\ = "{4856F146-7516-11D3-BBE5-D53DCBD65107}" Install.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{067B6CE2-DE85-435E-8E99-F52727F57E26}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" Install.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{067B6CE2-DE85-435E-8E99-F52727F57E26}\TypeLib\Version = "2.1" Install.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D307A698-F048-4AFC-9170-572440CD523F}\TypeLib\Version = "2.1" Install.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CDIntfEx.CDIntfEx\CLSID\ = "{68B34268-7559-11D3-BBE5-D53DCBD65107}" Install.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CDIntfEx.CDIntfEx\Insertable\ Install.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{68B34269-7559-11D3-BBE5-D53DCBD65107}\ = "ICDIntfEx" Install.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{067B6CE2-DE85-435E-8E99-F52727F57E26}\ = "_DCDIntfEvents" Install.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{067B6CE2-DE85-435E-8E99-F52727F57E26}\TypeLib Install.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D307A698-F048-4AFC-9170-572440CD523F}\TypeLib Install.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D307A698-F048-4AFC-9170-572440CD523F}\TypeLib\Version = "2.1" Install.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{68B34268-7559-11D3-BBE5-D53DCBD65107} Install.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{68B34268-7559-11D3-BBE5-D53DCBD65107}\ProgID Install.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{68B34268-7559-11D3-BBE5-D53DCBD65107}\ProgID\ = "CDIntfEx.CDIntfEx" Install.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{68B34269-7559-11D3-BBE5-D53DCBD65107}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" Install.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{067B6CE2-DE85-435E-8E99-F52727F57E26}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" Install.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{68B34268-7559-11D3-BBE5-D53DCBD65107}\InprocServer32\ = "C:\\Windows\\SysWow64\\CDINTF~1.DLL" Install.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CDIntfEx.Document\CLSID Install.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4856F146-7516-11D3-BBE5-D53DCBD65107}\2.1\0\win32\ = "C:\\Windows\\SysWow64\\cdintf210.dll" Install.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{067B6CE2-DE85-435E-8E99-F52727F57E26}\ProxyStubClsid32 Install.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{68B34269-7559-11D3-BBE5-D53DCBD65107}\TypeLib\ = "{4856F146-7516-11D3-BBE5-D53DCBD65107}" Install.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{68B34269-7559-11D3-BBE5-D53DCBD65107} Install.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{067B6CE2-DE85-435E-8E99-F52727F57E26} Install.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D307A698-F048-4AFC-9170-572440CD523F}\ = "IDIDocument" Install.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D307A698-F048-4AFC-9170-572440CD523F}\ProxyStubClsid32 Install.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D307A698-F048-4AFC-9170-572440CD523F}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" Install.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{68B34269-7559-11D3-BBE5-D53DCBD65107} Install.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{68B34269-7559-11D3-BBE5-D53DCBD65107}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" Install.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CDIntfEx.CDIntfEx\CLSID Install.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D307A698-F048-4AFC-9170-572440CD523F} Install.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{68B34268-7559-11D3-BBE5-D53DCBD65107}\ = "Common Driver Interface Control" Install.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{68B34268-7559-11D3-BBE5-D53DCBD65107}\MiscStatus\1 Install.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{68B34268-7559-11D3-BBE5-D53DCBD65107}\Control Install.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{68B34268-7559-11D3-BBE5-D53DCBD65107}\Insertable\ Install.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4475F8B8-1316-4853-82E6-C6149A7BA4C3}\ = "CDIntfEx.Document" Install.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{68B34269-7559-11D3-BBE5-D53DCBD65107}\ProxyStubClsid32 Install.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{067B6CE2-DE85-435E-8E99-F52727F57E26}\TypeLib\Version = "2.1" Install.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CDIntfEx.Document Install.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{68B34269-7559-11D3-BBE5-D53DCBD65107}\TypeLib\Version = "2.1" Install.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{68B34268-7559-11D3-BBE5-D53DCBD65107}\TypeLib\ = "{4856F146-7516-11D3-BBE5-D53DCBD65107}" Install.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{68B34268-7559-11D3-BBE5-D53DCBD65107}\ToolboxBitmap32 Install.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{68B34268-7559-11D3-BBE5-D53DCBD65107}\Insertable Install.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{68B34268-7559-11D3-BBE5-D53DCBD65107}\InprocServer32\ThreadingModel = "Apartment" Install.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4475F8B8-1316-4853-82E6-C6149A7BA4C3}\ProgID\ = "CDIntfEx.Document" Install.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D307A698-F048-4AFC-9170-572440CD523F}\TypeLib\ = "{4856F146-7516-11D3-BBE5-D53DCBD65107}" Install.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{68B34268-7559-11D3-BBE5-D53DCBD65107}\InprocServer32 Install.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{067B6CE2-DE85-435E-8E99-F52727F57E26}\ProxyStubClsid32 Install.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{68B34268-7559-11D3-BBE5-D53DCBD65107}\MiscStatus\1\ = "132243" Install.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{68B34268-7559-11D3-BBE5-D53DCBD65107}\TypeLib Install.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4475F8B8-1316-4853-82E6-C6149A7BA4C3}\InProcServer32\ = "C:\\Windows\\SysWow64\\CDINTF~1.DLL" Install.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4856F146-7516-11D3-BBE5-D53DCBD65107}\2.1 Install.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4856F146-7516-11D3-BBE5-D53DCBD65107}\2.1\0\win32 Install.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D307A698-F048-4AFC-9170-572440CD523F}\TypeLib Install.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CDIntfEx.CDIntfEx Install.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{68B34268-7559-11D3-BBE5-D53DCBD65107}\ToolboxBitmap32\ = "C:\\Windows\\SysWow64\\CDINTF~1.DLL, 1" Install.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4856F146-7516-11D3-BBE5-D53DCBD65107}\2.1\HELPDIR\ = "C:\\Windows\\system32" Install.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{067B6CE2-DE85-435E-8E99-F52727F57E26}\TypeLib\ = "{4856F146-7516-11D3-BBE5-D53DCBD65107}" Install.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CDIntfEx.CDIntfEx\ = "Common Driver Interface Control" Install.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4475F8B8-1316-4853-82E6-C6149A7BA4C3}\InProcServer32 Install.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4856F146-7516-11D3-BBE5-D53DCBD65107}\2.1\0 Install.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4856F146-7516-11D3-BBE5-D53DCBD65107}\2.1\HELPDIR Install.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{68B34269-7559-11D3-BBE5-D53DCBD65107}\TypeLib\ = "{4856F146-7516-11D3-BBE5-D53DCBD65107}" Install.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{067B6CE2-DE85-435E-8E99-F52727F57E26} Install.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{68B34268-7559-11D3-BBE5-D53DCBD65107}\Control\ Install.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4380 Install.exe 4380 Install.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD5d537827b24dffe10bc17c9dffe465338
SHA120f98e0934aff2fb851052b9c32745b1f9b6d288
SHA256fd0353032a8b86dd113750b0c7be5f599d5e97a38b937b205ac279c5014c65ae
SHA51232560626c47049a5b94ee474100de707d4213a6957e1b822dca3d822f62ed715dc74264f363671a99e82380b5d6c901c7b3b935a7df350a36a0a9059993d8d83