Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
38e1e58098d...0N.exe
windows7-x64
78e1e58098d...0N.exe
windows10-2004-x64
7$0/resulturl.dll
windows7-x64
1$0/resulturl.dll
windows10-2004-x64
1$0/resulturl.exe
windows7-x64
3$0/resulturl.exe
windows10-2004-x64
3$0/uninstall.exe
windows7-x64
7$0/uninstall.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
Analysis
-
max time kernel
101s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
07/08/2024, 08:09
Static task
static1
Behavioral task
behavioral1
Sample
8e1e58098d2bc73461b6d584ddae4bb0N.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
8e1e58098d2bc73461b6d584ddae4bb0N.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$0/resulturl.dll
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
$0/resulturl.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$0/resulturl.exe
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
$0/resulturl.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
$0/uninstall.exe
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
$0/uninstall.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240729-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
General
-
Target
$0/uninstall.exe
-
Size
78KB
-
MD5
34166b45c2acef07ab15b95a16beaca2
-
SHA1
3e691cc27c0e5949c8cab8c9cd3582ba5fb43ed5
-
SHA256
11775363c88b507158086a80b3acb4dc33d17aca2a114c9da7b6de80fb904ad0
-
SHA512
889cdbf9420b0c733292ae75fb8431a3ff3638c91f99ba066d9d74ff97d46f35451b6da5bd6359d1cb04d4e9c979a2d9b64caa9aa33d0c80b6510cf2f030b1a5
-
SSDEEP
1536:PEkjY1zy214Qay0DGkJ7qAELVigJYJScpxVJlCd2/Dv:8kjAJ4dDGkJ+AI0HlJl/7
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2736 Au_.exe -
Loads dropped DLL 3 IoCs
pid Process 2352 uninstall.exe 2736 Au_.exe 2736 Au_.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uninstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Au_.exe -
NSIS installer 1 IoCs
resource yara_rule behavioral7/files/0x0004000000017801-2.dat nsis_installer_1 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2736 Au_.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2352 wrote to memory of 2736 2352 uninstall.exe 29 PID 2352 wrote to memory of 2736 2352 uninstall.exe 29 PID 2352 wrote to memory of 2736 2352 uninstall.exe 29 PID 2352 wrote to memory of 2736 2352 uninstall.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\$0\uninstall.exe"C:\Users\Admin\AppData\Local\Temp\$0\uninstall.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\$0\2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:2736
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
691B
MD57589d52c6f6dcd39ea48c736d3221f09
SHA1373f3057d04851ee21f5101c2d777f549312f995
SHA2561609f9de066eccfd63b4fbd54b6909d80a5a3c3cf52fbfa20012151a85dff519
SHA512a551839a672c43ca29e73b9eebf860d89d0076faa1c059d661e502fcb86b2b29c4362e18b699702aa89166c05770289570a7720f7c06233dd7b1faa4ad052e84
-
Filesize
13KB
MD5d765c492c21689e3d9d61634371fd861
SHA1ac200933671ae52c9d5544d0e2e8e9144d286c83
SHA256551e6042dd494ea01549555ffc194ab9729da09058ec714eb368dd06642c9bbc
SHA5129919a9e848c8f1e26c75d0d29207571e4b86a4140bd554743d2c1f8bd7f386fe4919345b163d89a5d907fb165e435ba0ac5f6b1101713636141f156a420e2e0f
-
Filesize
10KB
MD5fe24766ba314f620d57d0cf7339103c0
SHA18641545f03f03ff07485d6ec4d7b41cbb898c269
SHA256802ef71440f662f456bed6283a5ff78066af016897fe6bfd29cac6edc2967bbd
SHA51260d36959895cebf29c4e7713e6d414980139c7aa4ed1c8c96fefb672c1263af0ce909fb409534355895649c0e8056635112efb0da2ba05694446aec2ca77e2e3
-
Filesize
78KB
MD534166b45c2acef07ab15b95a16beaca2
SHA13e691cc27c0e5949c8cab8c9cd3582ba5fb43ed5
SHA25611775363c88b507158086a80b3acb4dc33d17aca2a114c9da7b6de80fb904ad0
SHA512889cdbf9420b0c733292ae75fb8431a3ff3638c91f99ba066d9d74ff97d46f35451b6da5bd6359d1cb04d4e9c979a2d9b64caa9aa33d0c80b6510cf2f030b1a5