Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
3Bootsrapper (2).rar
windows7-x64
3Bootsrapper (2).rar
windows10-2004-x64
3Release/Mi...es.dll
windows7-x64
1Release/Mi...es.dll
windows10-2004-x64
1Release/Mi...es.xml
windows7-x64
3Release/Mi...es.xml
windows10-2004-x64
1Release/Sh...ss.dll
windows7-x64
1Release/Sh...ss.dll
windows10-2004-x64
1Release/Sy...rs.dll
windows7-x64
1Release/Sy...rs.dll
windows10-2004-x64
1Release/Sy...rs.xml
windows7-x64
3Release/Sy...rs.xml
windows10-2004-x64
3Release/Sy...ry.dll
windows7-x64
1Release/Sy...ry.dll
windows10-2004-x64
1Release/Sy...ry.xml
windows7-x64
3Release/Sy...ry.xml
windows10-2004-x64
1Release/Sy...rs.dll
windows7-x64
1Release/Sy...rs.dll
windows10-2004-x64
1Release/Sy...rs.xml
windows7-x64
3Release/Sy...rs.xml
windows10-2004-x64
1Release/Sy...fe.dll
windows7-x64
1Release/Sy...fe.dll
windows10-2004-x64
1Release/Sy...fe.xml
windows7-x64
3Release/Sy...fe.xml
windows10-2004-x64
1Release/Sy...es.dll
windows7-x64
1Release/Sy...es.dll
windows10-2004-x64
1Release/Sy...es.xml
windows7-x64
3Release/Sy...es.xml
windows10-2004-x64
1Release/Sy...ns.dll
windows7-x64
1Release/Sy...ns.dll
windows10-2004-x64
1Release/Sy...ns.xml
windows7-x64
3Release/Sy...ns.xml
windows10-2004-x64
1Resubmissions
02/08/2024, 18:55
240802-xkzn9a1bkg 3Analysis
-
max time kernel
127s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
02/08/2024, 18:55
Static task
static1
Behavioral task
behavioral1
Sample
Bootsrapper (2).rar
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
Bootsrapper (2).rar
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Release/Microsoft.Bcl.AsyncInterfaces.dll
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
Release/Microsoft.Bcl.AsyncInterfaces.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
Release/Microsoft.Bcl.AsyncInterfaces.xml
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
Release/Microsoft.Bcl.AsyncInterfaces.xml
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
Release/SharpCompress.dll
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
Release/SharpCompress.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
Release/System.Buffers.dll
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
Release/System.Buffers.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
Release/System.Buffers.xml
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
Release/System.Buffers.xml
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
Release/System.Memory.dll
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
Release/System.Memory.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
Release/System.Memory.xml
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
Release/System.Memory.xml
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
Release/System.Numerics.Vectors.dll
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
Release/System.Numerics.Vectors.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
Release/System.Numerics.Vectors.xml
Resource
win7-20240705-en
Behavioral task
behavioral20
Sample
Release/System.Numerics.Vectors.xml
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
Release/System.Runtime.CompilerServices.Unsafe.dll
Resource
win7-20240704-en
Behavioral task
behavioral22
Sample
Release/System.Runtime.CompilerServices.Unsafe.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
Release/System.Runtime.CompilerServices.Unsafe.xml
Resource
win7-20240708-en
Behavioral task
behavioral24
Sample
Release/System.Runtime.CompilerServices.Unsafe.xml
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
Release/System.Text.Encoding.CodePages.dll
Resource
win7-20240704-en
Behavioral task
behavioral26
Sample
Release/System.Text.Encoding.CodePages.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
Release/System.Text.Encoding.CodePages.xml
Resource
win7-20240708-en
Behavioral task
behavioral28
Sample
Release/System.Text.Encoding.CodePages.xml
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
Release/System.Threading.Tasks.Extensions.dll
Resource
win7-20240729-en
Behavioral task
behavioral30
Sample
Release/System.Threading.Tasks.Extensions.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
Release/System.Threading.Tasks.Extensions.xml
Resource
win7-20240705-en
Behavioral task
behavioral32
Sample
Release/System.Threading.Tasks.Extensions.xml
Resource
win10v2004-20240802-en
General
-
Target
Bootsrapper (2).rar
-
Size
715KB
-
MD5
4697a477cc3a00ec9976f18e03b84a26
-
SHA1
43ee4ac8e9b96a1b7469b5c479836c8245b7354d
-
SHA256
170740ce72172c7d607b46f58d391bff57ac1cb7090625fa53e73b2798437466
-
SHA512
8e33a2d710812656e3b5bf012155b9f063299dbcbc17e9c8f25b9d8ff8eb9d9a807bb602e14cc076133988fecc54eab1151abbd216e7ca67bc60e3b057910083
-
SSDEEP
12288:PzK/DP6aCDusJuKBle0ckNGox2cyIjhGrYXOMRtRsi7l/00oTk/Luin/c3ylqe:PzjPXJJG0cXcyIjHO6750/SLjncI
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1388 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1388 vlc.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1388 vlc.exe 1388 vlc.exe 1388 vlc.exe 1388 vlc.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 1388 vlc.exe 1388 vlc.exe 1388 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1388 vlc.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2372 wrote to memory of 2832 2372 cmd.exe 31 PID 2372 wrote to memory of 2832 2372 cmd.exe 31 PID 2372 wrote to memory of 2832 2372 cmd.exe 31 PID 2832 wrote to memory of 2684 2832 rundll32.exe 32 PID 2832 wrote to memory of 2684 2832 rundll32.exe 32 PID 2832 wrote to memory of 2684 2832 rundll32.exe 32 PID 2684 wrote to memory of 1388 2684 rundll32.exe 34 PID 2684 wrote to memory of 1388 2684 rundll32.exe 34 PID 2684 wrote to memory of 1388 2684 rundll32.exe 34
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Bootsrapper (2).rar"1⤵
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Bootsrapper (2).rar2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Bootsrapper (2).rar3⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Bootsrapper (2).rar"4⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1388
-
-
-