Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

6

Static

static

1

Algodoo_2_...32.exe

windows7-x64

Algodoo_2_...32.exe

windows10-2004-x64

4

Analysis

  • max time kernel
    29s
  • max time network
    30s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    02/08/2024, 20:13

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    Algodoo_2_1_0-Win32.exe

  • Size

    41.1MB

  • MD5

    595449c54c11431271222a4588182d19

  • SHA1

    3983bf609cd4f1c73d436c27438079912c91038e

  • SHA256

    64340fe8742b4873f0ae10feef29d81a564d300cd846eb05664fcb852de32337

  • SHA512

    8b332b2032236f0ef91fbc18508d508940101ae74e797052944a22ade03c6e31ebbaf826c3ee8ba3f8fb5e55ba8a2f326347a6ef3f7571047005c231d92638da

  • SSDEEP

    786432:T3mgCFUv67HKy5cKIwV4LGDT4GbY3+yLizaQFOOs3m58G/bVf:bmgCFt7VcKLVZbcFLiWQe7If

Score
6/10
discovery

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 61 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Algodoo_2_1_0-Win32.exe
    "C:\Users\Admin\AppData\Local\Temp\Algodoo_2_1_0-Win32.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2568
    • C:\Users\Admin\AppData\Local\Temp\is-4OBGD.tmp\Algodoo_2_1_0-Win32.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-4OBGD.tmp\Algodoo_2_1_0-Win32.tmp" /SL5="$4010A,42578785,215552,C:\Users\Admin\AppData\Local\Temp\Algodoo_2_1_0-Win32.exe"
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2276
      • C:\Program Files (x86)\Algodoo\vcredist_x86.exe
        "C:\Program Files (x86)\Algodoo\vcredist_x86.exe" /q:a
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3032
        • \??\f:\f48b03bb11e0f32e0844f13754\install.exe
          f:\f48b03bb11e0f32e0844f13754\.\install.exe /q:a
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2520
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3040
  • C:\Windows\system32\LogonUI.exe
    "LogonUI.exe" /flags:0x0
    1⤵
      PID:2848
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x1
      1⤵
        PID:604

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Algodoo\Algodoo.exe
        Filesize

        12.1MB

        MD5

        d035c12f90393e796f9bfba10186ff31

        SHA1

        988928c40aa54ce2ec176f9e68977ff45280dbd4

        SHA256

        55c2850150cca3aa8c4e4a1b3f760176a4d453979f4327f4caa69f61fb6aaf7d

        SHA512

        743346ae9fc249cbbe9cb47c73a62af92d323f5eb4fb9d1df54d8e5a91ee7a8076ebee6566e96561ae2c39848cc5f3b026b3f474d8ea5f5a417d2e98a64e5652

        Download Submit

      • C:\Program Files (x86)\Algodoo\data\shaders\default\is-QK1UK.tmp
        Filesize

        164B

        MD5

        60bd2ac4e1ffb7b91b28ee27805cb142

        SHA1

        baab85f3bf8b8449795a0ded7c35bb3fbc73d711

        SHA256

        512cd164cf1cf6cdeb13f17c7dea20c8753403d21768d957a45d94abf58412b9

        SHA512

        8ff47649b85f3cedcc36ab0dfdf904e1c699d4eedd7633cc1be25931db7d115d5799845804ce9538b8c10af260471040569030d4a0f28036277bbd5091c2395f

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI0B12.txt
        Filesize

        1KB

        MD5

        c24f46559b5a59aa715adb2010a780b8

        SHA1

        18745f23cd238d2a174ddaf6b9b3c30782c00cca

        SHA256

        a103ac5de739ac1801024e3b8b4e495a5935ba5a0bee701a44faccb45a089b68

        SHA512

        033e30dd32bd023242b261a04095f8f2fbe3c265c0e80188afeed10a748d765d286ae6794ec1d490548f2b32735ed60ec88e0f2996dbb4f29ef1adb95e986ec2

        Download Submit

      • F:\f48b03bb11e0f32e0844f13754\install.exe
        Filesize

        549KB

        MD5

        33c9213ff5849ef7346799cae4d8ac80

        SHA1

        5421169811570171e9d2d0a1cdca9665273e7b59

        SHA256

        3377e31d233ff41aea253e6221815820997763acdf40b005f8791400366cb8ff

        SHA512

        da0fc3f57156e06c0c37c1fb5176e1b147ce4aa21f519112123722496b04ad4bc3d366e2b51fd78de1ba0304d35bfd5e5fc95cabc2b3eb174f77636a8fa162a1

        Download Submit

      • \??\f:\f48b03bb11e0f32e0844f13754\globdata.ini
        Filesize

        1KB

        MD5

        0a6b586fabd072bd7382b5e24194eac7

        SHA1

        60e3c7215c1a40fbfb3016d52c2de44592f8ca95

        SHA256

        7912e3fcf2698cf4f8625e563cd8215c6668739cae18bd6f27af2d25bec5c951

        SHA512

        b96b0448e9f0e94a7867b6bb103979e9ef2c0e074bcb85988d450d63de6edcf21dc83bb154aafb7de524af3c3734f0bb1ba649db0408612479322e1aa85be9f4

        Download Submit

      • \??\f:\f48b03bb11e0f32e0844f13754\install.ini
        Filesize

        844B

        MD5

        5feaa6a36fea7dfdb88c18d69ba6d6a9

        SHA1

        7afd91a7b046d68b6ee9fd367bcd7a4fec546216

        SHA256

        67a50ffbb8a1d500eaa4d9f0227d6a8595a2750154e6b31662fc4f51286e47fc

        SHA512

        6c8c0456f232a02a49d51b3f1a830a18b9078e621cd0dc3f4f76f79b83035e8affac67bce3af9a37fa9096a34a8499c59cf982b63a4b2400b9190d2db293e682

        Download Submit

      • \??\f:\f48b03bb11e0f32e0844f13754\install.res.1033.dll
        Filesize

        89KB

        MD5

        8e97ea8a1ed69806232e8743f9a28706

        SHA1

        e911d3802e64f9be0e1ac68865bbcc92624d6a1f

        SHA256

        2893b1b9751f833d4a3ded7c1fba1a96cada2927a2349c5d751365eed647c100

        SHA512

        aa57fe0b822145aa1d8eb72f9735ef5d92036f24c4c80392799d701447d18ea510331f5653b39c43dc923cd0f1a61bf87be0f8a4927f6e3754d19ac76fd443c3

        Download Submit

      • \??\f:\f48b03bb11e0f32e0844f13754\vc_red.cab
        Filesize

        3.7MB

        MD5

        ecca3c1acb74cb73c600eabdd3f9c9d9

        SHA1

        f015759f623c377494a5996670204f1fcd0895e3

        SHA256

        43b7648183347374236296f2176c7c7da920da9c1a08adda761e12614efb299e

        SHA512

        2785b8e8cfc310ec114cee696c5b85900fc71186dcbf0c99a9c13f4f0fdcc9e9dd583c9d1fd82492a680efcd7071c3593b02b628bd947bc19b1302b931aca807

        Download Submit

      • \??\f:\f48b03bb11e0f32e0844f13754\vc_red.msi
        Filesize

        227KB

        MD5

        6e17361f8e53b47656bcf0ed90ade095

        SHA1

        bce290a700e31579356f7122fb38ce3be452628a

        SHA256

        8811e5fe167223d906701bc8deb789de0a731e888e285834bcae164b03d43c96

        SHA512

        a566fc8bbb4d354db32f13de2fde73a1210c61b1c30a1be22b16c7e98b8d51c673259c57a924b04035cb9f0bf4a087a3e8b32221e7ff87032cddc840ffe3ed2f

        Download Submit

      • \Program Files (x86)\Algodoo\unins000.exe
        Filesize

        1.2MB

        MD5

        9a4a5c192b031886a133faac055bd08d

        SHA1

        519c9097cd3522d1f36cb26a1c61efab1877e6b3

        SHA256

        b8a3048af778b87a563043900f17b4b7c88b74f5ad120a0c6274fb8a8858edbc

        SHA512

        15427ad5bdd55a8691bced9fe55ab80b294f6a26e914e77a41d0b1b770fc51d0e2e04c2edb05b2f9fa85f51388e24b2d336ca94c716b40cb6acace3bf75b7292

        Download Submit

      • \Program Files (x86)\Algodoo\vcredist_x86.exe
        Filesize

        4.0MB

        MD5

        5689d43c3b201dd3810fa3bba4a6476a

        SHA1

        6939100e397cef26ec22e95e53fcd9fc979b7bc9

        SHA256

        41f45a46ee56626ff2699d525bb56a3bb4718c5ca5f4fb5b3b38add64584026b

        SHA512

        4875134c664503242ec60717232f2917edca20286fc4b675223edbbe5dc0239ebfaf8f67edd76fedcaa2be5419490dc6f47930ca260e6c9988ccf242416c204b

        Download Submit

      • \Users\Admin\AppData\Local\Temp\is-4OBGD.tmp\Algodoo_2_1_0-Win32.tmp
        Filesize

        1.2MB

        MD5

        9a760ee80f3bf19c58111e59fe6b60bd

        SHA1

        5a1da2320d85290cb180330f384f5fa2aa95fac0

        SHA256

        3efbcb833978b76ca1c3072a0efd1ea66e1b2684a8cf3880a0a03254d6cfc65d

        SHA512

        361e622d6d999b0c17e789f3034270841ceefc5868f98573ba508247d62acd20bca65b9699de8c01d270604999b5e6bf5abe786deb71a6117e46c7240d7dc7c5

        Download Submit

      • \Users\Admin\AppData\Local\Temp\is-763AE.tmp\_isetup\_shfoldr.dll
        Filesize

        22KB

        MD5

        92dc6ef532fbb4a5c3201469a5b5eb63

        SHA1

        3e89ff837147c16b4e41c30d6c796374e0b8e62c

        SHA256

        9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

        SHA512

        9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

        Download Submit

      • memory/2276-16-0x0000000000400000-0x000000000054D000-memory.dmp

        Filesize

        1.3MB

        Download

      • memory/2276-8-0x0000000000400000-0x000000000054D000-memory.dmp

        Filesize

        1.3MB

        Download

      • memory/2276-1534-0x0000000000400000-0x000000000054D000-memory.dmp

        Filesize

        1.3MB

        Download

      • memory/2276-1670-0x0000000000400000-0x000000000054D000-memory.dmp

        Filesize

        1.3MB

        Download

      • memory/2520-1645-0x0000000074770000-0x0000000074787000-memory.dmp

        Filesize

        92KB

        Download

      • memory/2568-2-0x0000000000401000-0x0000000000417000-memory.dmp

        Filesize

        88KB

        Download

      • memory/2568-15-0x0000000000400000-0x0000000000441000-memory.dmp

        Filesize

        260KB

        Download

      • memory/2568-0-0x0000000000400000-0x0000000000441000-memory.dmp

        Filesize

        260KB

        Download

      • memory/2568-1671-0x0000000000400000-0x0000000000441000-memory.dmp

        Filesize

        260KB

        Download