Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
4Static
static
1Complement....2.zip
windows7-x64
1Complement....2.zip
windows10-2004-x64
1HOW TO INSTALL.txt
windows7-x64
1HOW TO INSTALL.txt
windows10-2004-x64
1License.txt
windows7-x64
1License.txt
windows10-2004-x64
1shaderFile..._L.zip
windows7-x64
1shaderFile..._L.zip
windows10-2004-x64
4shaderFile...lacebo
windows7-x64
3shaderFile...lacebo
windows10-2004-x64
3shaderFile_A.placebo
windows7-x64
3shaderFile_A.placebo
windows10-2004-x64
3shaderFile_B.placebo
windows7-x64
3shaderFile_B.placebo
windows10-2004-x64
3shaderFile_C.placebo
windows7-x64
3shaderFile_C.placebo
windows10-2004-x64
3shaderFile_D.placebo
windows7-x64
3shaderFile_D.placebo
windows10-2004-x64
3shaderFile...ns.txt
windows7-x64
1shaderFile...ns.txt
windows10-2004-x64
1shaders/bl...erties
windows7-x64
3shaders/bl...erties
windows10-2004-x64
3shaders/di...erties
windows7-x64
3shaders/di...erties
windows10-2004-x64
3shaders/en...erties
windows7-x64
3shaders/en...erties
windows10-2004-x64
3shaders/it...erties
windows7-x64
3shaders/it...erties
windows10-2004-x64
3shaders/la...S.lang
windows7-x64
3shaders/la...S.lang
windows10-2004-x64
3shaders/li...a.glsl
windows7-x64
3shaders/li...a.glsl
windows10-2004-x64
3Resubmissions
02/08/2024, 15:24
240802-ss5g9azarq 102/08/2024, 15:20
240802-sq7vlazakn 402/08/2024, 15:19
240802-sp5nvatglh 1Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
02/08/2024, 15:20
Static task
static1
Behavioral task
behavioral1
Sample
ComplementaryUnbound_r5.2.2.zip
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
ComplementaryUnbound_r5.2.2.zip
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
HOW TO INSTALL.txt
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
HOW TO INSTALL.txt
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
License.txt
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
License.txt
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
shaderFile_1/shaderFile_L.zip
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
shaderFile_1/shaderFile_L.zip
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
shaderFile_2/shaderFile_R.placebo
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
shaderFile_2/shaderFile_R.placebo
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
shaderFile_A.placebo
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
shaderFile_A.placebo
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
shaderFile_B.placebo
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
shaderFile_B.placebo
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
shaderFile_C.placebo
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
shaderFile_C.placebo
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
shaderFile_D.placebo
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
shaderFile_D.placebo
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
shaderFile_Versions.txt
Resource
win7-20240729-en
Behavioral task
behavioral20
Sample
shaderFile_Versions.txt
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
shaders/block.properties
Resource
win7-20240704-en
Behavioral task
behavioral22
Sample
shaders/block.properties
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
shaders/dimension.properties
Resource
win7-20240708-en
Behavioral task
behavioral24
Sample
shaders/dimension.properties
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
shaders/entity.properties
Resource
win7-20240708-en
Behavioral task
behavioral26
Sample
shaders/entity.properties
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
shaders/item.properties
Resource
win7-20240705-en
Behavioral task
behavioral28
Sample
shaders/item.properties
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
shaders/lang/en_US.lang
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
shaders/lang/en_US.lang
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
shaders/lib/antialiasing/fxaa.glsl
Resource
win7-20240704-en
Behavioral task
behavioral32
Sample
shaders/lib/antialiasing/fxaa.glsl
Resource
win10v2004-20240802-en
General
-
Target
shaderFile_2/shaderFile_R.placebo
-
Size
122B
-
MD5
4cb5baf13b4edeb98fbcb86939b5f6de
-
SHA1
b5c53ec667e4e4c5ceae3d78b2da97ed3a547884
-
SHA256
d6a249c4b0aeaed80079877cb6ddc87bba112d6528d84a59504075d59be5a03e
-
SHA512
27de62cfb15c390d02ef87371c0c5b34b6207923380f558589d0c76d6886adf7cb7c4119617a8c2e710b6b26fbd6b2a048adcddf34cea469db4be576b95a884e
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\.placebo rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\placebo_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\placebo_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\placebo_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\placebo_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\placebo_auto_file\shell\Read rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\placebo_auto_file\ rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\.placebo\ = "placebo_auto_file" rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2764 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2764 AcroRd32.exe 2764 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3000 wrote to memory of 2700 3000 cmd.exe 31 PID 3000 wrote to memory of 2700 3000 cmd.exe 31 PID 3000 wrote to memory of 2700 3000 cmd.exe 31 PID 2700 wrote to memory of 2764 2700 rundll32.exe 33 PID 2700 wrote to memory of 2764 2700 rundll32.exe 33 PID 2700 wrote to memory of 2764 2700 rundll32.exe 33 PID 2700 wrote to memory of 2764 2700 rundll32.exe 33
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\shaderFile_2\shaderFile_R.placebo1⤵
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\shaderFile_2\shaderFile_R.placebo2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\shaderFile_2\shaderFile_R.placebo"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2764
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD51966867cd654f9282b52eae8fb5049d8
SHA1f9ab591081c48e97246e891c4ad54f710afa4f5c
SHA25637c0ccbe88448a56285fb62e6ffb693ba70464bf22e70f2a6e0398d7e98866e0
SHA5123da66c4f822e378f65041769d089fab283f7651f1194afdd7cd30b3b45cf156cc147200f66fc5732d5ee98e2e5b88cc7afbf01055c9f56e2adc478879b14f43e