Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
6Static
static
3ventoy-1.0...sk.exe
windows7-x64
6ventoy-1.0...sk.exe
windows10-2004-x64
6ventoy-1.0...on.exe
windows7-x64
6ventoy-1.0...on.exe
windows10-2004-x64
6ventoy-1.0...nk.exe
windows7-x64
3ventoy-1.0...nk.exe
windows10-2004-x64
3ventoy-1.0...RM.exe
windows7-x64
ventoy-1.0...RM.exe
windows10-2004-x64
ventoy-1.0...64.exe
windows7-x64
ventoy-1.0...64.exe
windows10-2004-x64
ventoy-1.0...64.exe
windows7-x64
6ventoy-1.0...64.exe
windows10-2004-x64
6ventoy-1.0...64.exe
windows7-x64
6ventoy-1.0...64.exe
windows10-2004-x64
6www/index.html
windows7-x64
3www/index.html
windows10-2004-x64
3www/plugso...l.html
windows7-x64
3www/plugso...l.html
windows10-2004-x64
3www/plugso...k.html
windows7-x64
3www/plugso...k.html
windows10-2004-x64
3www/plugso...e.html
windows7-x64
3www/plugso...e.html
windows10-2004-x64
3www/plugso...l.html
windows7-x64
3www/plugso...l.html
windows10-2004-x64
3www/plugso...n.html
windows7-x64
3www/plugso...n.html
windows10-2004-x64
3www/plugson_dud.html
windows7-x64
3www/plugson_dud.html
windows10-2004-x64
1www/plugso...t.html
windows7-x64
3www/plugso...t.html
windows10-2004-x64
3www/plugso...n.html
windows7-x64
3www/plugso...n.html
windows10-2004-x64
3Analysis
-
max time kernel
124s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
03/08/2024, 01:06
Static task
static1
Behavioral task
behavioral1
Sample
ventoy-1.0.99/Ventoy2Disk.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
ventoy-1.0.99/Ventoy2Disk.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
ventoy-1.0.99/VentoyPlugson.exe
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
ventoy-1.0.99/VentoyPlugson.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
ventoy-1.0.99/VentoyVlnk.exe
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
ventoy-1.0.99/VentoyVlnk.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
ventoy-1.0.99/altexe/Ventoy2Disk_ARM.exe
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
ventoy-1.0.99/altexe/Ventoy2Disk_ARM.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
ventoy-1.0.99/altexe/Ventoy2Disk_ARM64.exe
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
ventoy-1.0.99/altexe/Ventoy2Disk_ARM64.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
ventoy-1.0.99/altexe/Ventoy2Disk_X64.exe
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
ventoy-1.0.99/altexe/Ventoy2Disk_X64.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
ventoy-1.0.99/altexe/VentoyPlugson_X64.exe
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
ventoy-1.0.99/altexe/VentoyPlugson_X64.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
www/index.html
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
www/index.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
www/plugson_auto_install.html
Resource
win7-20240729-en
Behavioral task
behavioral18
Sample
www/plugson_auto_install.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
www/plugson_auto_memdisk.html
Resource
win7-20240705-en
Behavioral task
behavioral20
Sample
www/plugson_auto_memdisk.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
www/plugson_conf_replace.html
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
www/plugson_conf_replace.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
www/plugson_control.html
Resource
win7-20240704-en
Behavioral task
behavioral24
Sample
www/plugson_control.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
www/plugson_donation.html
Resource
win7-20240704-en
Behavioral task
behavioral26
Sample
www/plugson_donation.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
www/plugson_dud.html
Resource
win7-20240708-en
Behavioral task
behavioral28
Sample
www/plugson_dud.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
www/plugson_image_list.html
Resource
win7-20240704-en
Behavioral task
behavioral30
Sample
www/plugson_image_list.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
www/plugson_injection.html
Resource
win7-20240705-en
Behavioral task
behavioral32
Sample
www/plugson_injection.html
Resource
win10v2004-20240802-en
General
-
Target
ventoy-1.0.99/VentoyPlugson.exe
-
Size
364KB
-
MD5
38f18ebb5b81b4481b732f68d2b9fe90
-
SHA1
eae6a3ea6b5b8ac5ccafcc6dd0bbdbb07d6ee6c0
-
SHA256
a27bef270abb8e0649358d89a004573b45156c7a2bb520fb62cfe1f50300145b
-
SHA512
9c38a92d015f8524b28d5b99c83f6923f2505cd65817e11b8079201148f0299cb38646bdbb8fb5f64c97b178507cf8a851c3edb38fb442f0caebfdc0482c2749
-
SSDEEP
6144:l/C8Y4XmCtaOInjZpAbxdxDcWcnR4bfXfwiSeias+8xHgbYpj+w8NO0ctwxepgP7:l/J+CtaxnjZpAbxdxDcWcnR4bfXfwiSO
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: VentoyPlugson.exe File opened (read-only) \??\F: VentoyPlugson.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VentoyPlugson.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ventoy-1.0.99\VentoyPlugson.exe"C:\Users\Admin\AppData\Local\Temp\ventoy-1.0.99\VentoyPlugson.exe"1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
PID:1472
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4348,i,1828333185976713750,7918646547767660928,262144 --variations-seed-version --mojo-platform-channel-handle=3060 /prefetch:81⤵PID:3668
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5dfa8a3cbab13f5a135e2ba452242b271
SHA15eb98a034e41c04ea9074cdfd533ccb9ca161e4a
SHA256b1fe7a6967632ce9fc5c9029cdc5dcad94407484fc905f28ee840e0c9a6f08db
SHA512b724a758a9e1e76c10d9616c71a70104f73c7132e231bd173bba0b77c79c75b3026fb3069020190770fe73f8dcda1e9db082d62c2801ef6b1385e6955f765103