Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    82s
  • max time network
    29s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    10/08/2024, 09:50

General

  • Target

    UniversalMC_setup.exe

  • Size

    10.9MB

  • MD5

    a0716d08a88968ec0bf18fa7451c1317

  • SHA1

    50b6201ba3c3584f85c2ef699dd5282ab17ae33e

  • SHA256

    a85e3e400e6c40788aa346f9433635a23235ad105e5f20cf96e3b48e5cc18d80

  • SHA512

    bade62458987442cc12c14d2e2db8512dd07c7a1206fb628a2220ac7b2e4ac8d2cffff6637c34125fff591b4a880227c03751ebe51776bd168d9c4d4d719815b

  • SSDEEP

    196608:Exyrc3Hb4Yxa5V2jIusQfZFKnfiGzgbn9A7Mbwt99406so5qoSE7H:Eqc3H1xc8PfzKqGzgbn9St994Fso5qOz

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 53 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 40 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: AddClipboardFormatListener 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 18 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\UniversalMC_setup.exe
    "C:\Users\Admin\AppData\Local\Temp\UniversalMC_setup.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1464
    • C:\Users\Admin\AppData\Local\Temp\is-IRDU7.tmp\UniversalMC_setup.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-IRDU7.tmp\UniversalMC_setup.tmp" /SL5="$500F4,11214833,57856,C:\Users\Admin\AppData\Local\Temp\UniversalMC_setup.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1300
      • C:\Program Files (x86)\Universal Minecraft Editor\UniversalMC.exe
        "C:\Program Files (x86)\Universal Minecraft Editor\UniversalMC.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1872
        • C:\Program Files (x86)\Universal Minecraft Editor\UniversalMCUpdater.exe
          "C:\Program Files (x86)\Universal Minecraft Editor\UniversalMCUpdater.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1416
          • C:\Program Files (x86)\Universal Minecraft Editor\UniversalMC.exe
            UniversalMC.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: AddClipboardFormatListener
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1916
            • C:\Program Files (x86)\Universal Minecraft Editor\UniversalMCUpdater.exe
              "C:\Program Files (x86)\Universal Minecraft Editor\UniversalMCUpdater.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in Program Files directory
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: AddClipboardFormatListener
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of SetWindowsHookEx
              PID:2056
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:2636
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x4ec
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1528

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Universal Minecraft Editor\MSVCP100.dll

      Filesize

      411KB

      MD5

      bc83108b18756547013ed443b8cdb31b

      SHA1

      79bcaad3714433e01c7f153b05b781f8d7cb318d

      SHA256

      b2ad109c15eaa92079582787b7772ba0a2f034f7d075907ff87028df0eaea671

      SHA512

      6e72b2d40e47567b3e506be474dafa7cacd0b53cd2c2d160c3b5384f2f461fc91bb5fdb614a351f628d4e516b3bbdabc2cc6d4cb4710970146d2938a687dd011

    • C:\Program Files (x86)\Universal Minecraft Editor\Qt5Core.dll

      Filesize

      4.5MB

      MD5

      b7a92010159c8303b3210b4fc772aec8

      SHA1

      6accb408a96903277c5c7506cfe1e07908e89a6b

      SHA256

      73875e855083a46e55e2727de65a1293b3d97481c3383c0b67e33163b65b8982

      SHA512

      88f3bec87d8c356124ea5988a2a3df3f6abec144b857d21f45864a094bd6795cd1aa2f7ef30e0128fdbdbdba6e38d63018b9975cb017d20d040bdc12156de24c

    • C:\Program Files (x86)\Universal Minecraft Editor\Qt5Gui.dll

      Filesize

      4.8MB

      MD5

      2abd634fd0f5fe56c0918b4feecead07

      SHA1

      a874d6127925561334092bcf46e6c580542630ee

      SHA256

      a1897faaa4213bd2f9fd1ea376d721a1f50780238ec4dff657434b8ed9a4aebd

      SHA512

      d91afd81fdcc2380f129e1c70147798c9a01e65066dd4bffe545fa09e94126abc5339d6bd46c05e32cf07815ab81f180e5d4a979c93dca03424e5f6e7282e790

    • C:\Program Files (x86)\Universal Minecraft Editor\Qt5Network.dll

      Filesize

      817KB

      MD5

      1a6368ee9ba6f5105a7091ddfc41ed3b

      SHA1

      68ee7b8322f2e53a018bb1c0042c7c3278abab2b

      SHA256

      a27c6aedc57b6788139d4e19ca4daf0e269d609e4245f887a0eb935a69d875cc

      SHA512

      9307b637b3248175dbfc8013d50e663b0fb8bddb28af92e621227c78afcb21f46597f65985b7b03006ee9aee206ff73c1d4db84aaddce685082342eaf30d5c87

    • C:\Program Files (x86)\Universal Minecraft Editor\Qt5Widgets.dll

      Filesize

      4.3MB

      MD5

      3b9e7d04e4c2dd365ddaa92adcc97355

      SHA1

      3707a0fefaf9bbc6fd9fbd60e0b0d0135e37f1d9

      SHA256

      d168b50937e7a0befb6fea565d44c1bb10bba11da3ea1dcd0d0b3371f71f494d

      SHA512

      77cd1bcaf35f46a573a3aac952bde197c18b7feb47d752bd67c32c09ad81b62325d693be29ebbf3a4fd4a67ff80dab30a7bdf439051ee021d718b4a2ca00adff

    • C:\Program Files (x86)\Universal Minecraft Editor\UniversalMC.exe

      Filesize

      8.7MB

      MD5

      bbb7ff132cfbcfd04b0f0b630360d3cd

      SHA1

      13d65275fff43a7bedf3f4df53b23fa6365615c1

      SHA256

      e5ef94c313c7b1c983e4f0bb0202ef1932d829a4a11dbcff361ba8f18639de90

      SHA512

      55b3cf2f8c28b19de792137fb067839fac32b700612cf19d71879820dd940496593117ec0f1e2141e3e9b5cfcc18bb7b64f37a731373bfd9a404cfbc00f7eb2a

    • C:\Program Files (x86)\Universal Minecraft Editor\UniversalMCUpdater.exe

      Filesize

      33KB

      MD5

      ab428f46a244c084bd9be9f058479c7a

      SHA1

      7f6d4d35bbc2694ba33e57f0987ef45fd9e414fc

      SHA256

      86a3b484294c66eea2c327d2859d8302aa974650659f04259c41c12285617a4f

      SHA512

      89317ed39fda2031e164f427d368b359d9db6ef08263d603bd0980aa11ee98bccc65ccd04dc78112a104d00e582d97c99f170116a862b717e1b5cbd67d6ff411

    • C:\Program Files (x86)\Universal Minecraft Editor\botan.dll

      Filesize

      1.7MB

      MD5

      cb6b41deeaa1b4c837414ff8be043aeb

      SHA1

      8034d8b2932516bff0b54154436044c73fd2bbba

      SHA256

      5cfd581e83ff9c05569a0eae4321ffba04d63bbbdd042f0481945dbdb07797e9

      SHA512

      3de26a25100aa495786a968715d2a6b5e15dd3e15db7f4d4f19d33780d01128788da4b8d8220ccc0ea47389016012ab1d1625f9c2be7a31dd7e06bcd5cc56080

    • C:\Program Files (x86)\Universal Minecraft Editor\platforms\qwindows.dll

      Filesize

      946KB

      MD5

      16242574397486bb50ffa81dfd7e52eb

      SHA1

      3e64b639d4458b20881c0462b0f7b86989f82040

      SHA256

      ef6a4ada902f07236f7834f78ad8c286c7024d82c1c9d7752e5fefefc02140a7

      SHA512

      ba4e965edce2c079b694129ff4fd0fbd199a0c007e327c9f2e6bd5bd847e04030f9539ba534785977ba03ad5514514c347fc8d5d3ca2dd3ea84e9a64c538d139

    • C:\Program Files (x86)\Universal Minecraft Editor\quazip.dll

      Filesize

      137KB

      MD5

      387bd13b0278d83d0c3a3103f5cfcb82

      SHA1

      53f557f278f19e826df9de8846160cdedc7a54f7

      SHA256

      b1b661535d86baea87392a52ca618472b9bb152f3f7ae473bc71db37feb39309

      SHA512

      c6f4dc1d83cbf1168dba3d5a5a2622b237857d2d0213aefa914ff406875c5a7372d8164d83b0792ce904fe10c398c0a8ddc57ac49cb36a37cbb9f8c08173acf2

    • C:\Program Files (x86)\Universal Minecraft Editor\zlib1.dll

      Filesize

      105KB

      MD5

      b8a9e91134e7c89440a0f95470d5e47b

      SHA1

      3cbcee30fc0a7e9807931bc0dafceb627042bfc9

      SHA256

      42967a768f341d9ce5174eb38a4d63754c3c41739e7d88f4e39cd7354c1fac71

      SHA512

      e8583ea94b9d1321889359317e367abc88e90e96d0d9243258244a527ffa2b13ab97d0787693ca328960ceb934ea11eefd14abafd640a654473c26e420d2ec54

    • C:\Users\Admin\Documents\UniversalMC\assetFiles.zip

      Filesize

      2.7MB

      MD5

      c6fbabc15000a3f10ee72786dd6bd1c1

      SHA1

      fd0eb7fdfd5e04ebc202de1671c4ac184693f5ea

      SHA256

      45aaf52df70ce6b7e22d0b6194941d827bcf28825b225d60ca6294bdf7bfd202

      SHA512

      4bd31b76c41cb4f7122864d760e4959e09f745a6d46e30a763e56f86c99ecaad11ad59a1a540a00d245ca535004c28834b083364305b1fb415da03676c88dd39

    • C:\Users\Admin\Documents\UniversalMC\assetFiles\CONSOLE\biomes\biomesV.json

      Filesize

      59B

      MD5

      a991777764db0bb0f1ac59d4829f7e71

      SHA1

      954aa82eb4639454c2e55dfb366b272b7f11f161

      SHA256

      96a9da93a9604a8b10d2ddbea10c2f13461c78c333eb82fa909b3f17ceb774d5

      SHA512

      9345aff50ec7d715272659b9cef93af57ec048d8e96dd6edb2476063239b8296d737db728f5ba406df3465dc7cb89c9338fe910860fee4e2fda2806f9cc3abaa

    • C:\Users\Admin\Documents\UniversalMC\assetFiles\PC\biomes\1.12\biomes.json

      Filesize

      5KB

      MD5

      f1078e3284cb58a199d698b48bda943c

      SHA1

      2db3c598b659968d26819244009891cd5d5b30ee

      SHA256

      36101227bc9a33150a6976617aa77822fbc2d1ae51a63faf45c9b0d2cd586e00

      SHA512

      b3189cfc9598e8284f7cc55048ec0201575400989b621021c4ed15741b597f72be320c87849c376e3d1e1c0cee67d169e80601200a432827f37ff9a4dece59ba

    • C:\Users\Admin\Documents\UniversalMC\assetFiles\PC\biomes\biomesV.json

      Filesize

      59B

      MD5

      613b55fdb3222d49065b6d0a8c28679e

      SHA1

      d963832a937113db3b9b884b4d23b3899db64df4

      SHA256

      5447ec5ee40058d2db0fc3034eb73ac92cb9bef41b6b46c6b813996e49e5e58d

      SHA512

      88c3be9c48859859e7a3d76668f172687d3fb6029294e8096f7fa73fd9ad42c934542bd4510c0a797899b1d26d88e52f974a3aaaa2a613d0a49597ef733b93b1

    • C:\Users\Admin\Documents\UniversalMC\assetFiles\PC\items\1.12\items.json

      Filesize

      122KB

      MD5

      f1fe32642be4c53697b127b9a650d941

      SHA1

      3c26bc9579cbdcbda4873fcec7c3d242b7eddd7a

      SHA256

      0c7cb0fe5784732d21c7bcb6369062eb68acbf98872c2f729f86ae9a91c5d0a1

      SHA512

      aaea24827d60c36e68d2ced124d356ff7bf561ad2551ff3fa5bd71da9c5b90aaf5ad78bf108036d07706263abbc85499e9a3f53cfdbbfbb5cefeb35a72750eed

    • C:\Users\Admin\Documents\UniversalMC\assetFiles\PC\textures\1.12\textures.png

      Filesize

      177KB

      MD5

      20374856731c0dd66570e52fea028877

      SHA1

      611fcaf61b030bbd597213f6456a27a216f53d25

      SHA256

      d21629aeed8cb528faafbab3b91a4e0173cfb5037cbe91223b1679ef950809ed

      SHA512

      c22cfc2e2ac5ced468d3161b107d00edb4e731c926682f3d2aa0a5ff4a1697b23fd5e1ad7b1af498a57d29f15f7dd07ed73bbe9a9ae774a8e8c4dd62c0bfadd7

    • C:\Users\Admin\Documents\UniversalMC\assetFiles\PE\behavior_packs\1.4.0\vanilla\loot_tables\entities\ocelot.json

      Filesize

      2B

      MD5

      99914b932bd37a50b983c5e7c90ae93b

      SHA1

      bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

      SHA256

      44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

      SHA512

      27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

    • C:\Users\Admin\Documents\UniversalMC\lastModified.json

      Filesize

      100B

      MD5

      48c695e93927b6b5245113f50c8200c6

      SHA1

      334f74f9adb728659ac7e5a8f444b754b1cae7e5

      SHA256

      6a69d325c3c89b8d1cb82344db45b29d444765154706e28551ef334fc24071e1

      SHA512

      56e47d77b35bb323b0cba5e5b494b059a74cb37acca32e691e16e9d9521375dd908b74c90e61292734277e0cc8062475316d9e8f37bba5fa3b2ed26bd8454d82

    • \Program Files (x86)\Universal Minecraft Editor\imageformats\qjpeg.dll

      Filesize

      202KB

      MD5

      8d0c3527793c3bf61c45ae8984dab714

      SHA1

      cd8dc668da4a01e209110e7c4c2db0bcac7617e3

      SHA256

      ab82a31a9de45f439e45558549d8c082a74290b1fe3e145721cbfa74493cf043

      SHA512

      39b2ffee983925260f2bb2babdea32c7e6bf57c5b476f96d2fe62d0069533000cfec8f15bcf62cddd8dda23ffa1e908e4eb6420313e4a36a90079812372d341e

    • \Program Files (x86)\Universal Minecraft Editor\libeay32.dll

      Filesize

      1.2MB

      MD5

      81e477b07ab1732c4fdd70bbe2541e05

      SHA1

      3c217f9acbb1e73f502bce822022310a87c68bc5

      SHA256

      33583dab07bcb86bc7f52ac274db87db67e803d2a01918d7b0289d73e33f193f

      SHA512

      0c92d53e2ec9473743164b3966f0fb1c5a448e08e507fe9ed87f6b86b0156fb653dc9990d35cceeb007a35b92a8bbab838822b368112e96277af43af5c5d6613

    • \Program Files (x86)\Universal Minecraft Editor\msvcr100.dll

      Filesize

      755KB

      MD5

      0e37fbfa79d349d672456923ec5fbbe3

      SHA1

      4e880fc7625ccf8d9ca799d5b94ce2b1e7597335

      SHA256

      8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18

      SHA512

      2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

    • \Program Files (x86)\Universal Minecraft Editor\msvcr120.dll

      Filesize

      948KB

      MD5

      034ccadc1c073e4216e9466b720f9849

      SHA1

      f19e9d8317161edc7d3e963cc0fc46bd5e4a55a1

      SHA256

      86e39b5995af0e042fcdaa85fe2aefd7c9ddc7ad65e6327bd5e7058bc3ab615f

      SHA512

      5f11ef92d936669ee834a5cef5c7d0e7703bf05d03dc4f09b9dcfe048d7d5adfaab6a9c7f42e8080a5e9aad44a35f39f3940d5cca20623d9cafe373c635570f7

    • \Program Files (x86)\Universal Minecraft Editor\ssleay32.dll

      Filesize

      269KB

      MD5

      50442445ee8025c67e8dbeba74bf083e

      SHA1

      afb6aa003e26b7670ab7551ffe0328589189ac38

      SHA256

      b4ce2cd9aea53fe93250e68662b9fc369f4a40a59f2706dd58594916607a703c

      SHA512

      0bc4daeb1d6a2de68b934718a567ae0f9afd08124579034966090c44a11c428c5f03f8233982ca98363ec2baa95174bd19600f0b99d21d4ac274ff3e30b38363

    • \Users\Admin\AppData\Local\Temp\is-IRDU7.tmp\UniversalMC_setup.tmp

      Filesize

      697KB

      MD5

      832dab307e54aa08f4b6cdd9b9720361

      SHA1

      ebd007fb7482040ecf34339e4bf917209c1018df

      SHA256

      cc783a04ccbca4edd06564f8ec88fe5a15f1e3bb26cec7de5e090313520d98f3

      SHA512

      358d43522fd460eb1511708e4df22ea454a95e5bc3c4841931027b5fa3fb1dda05d496d8ad0a8b9279b99e6be74220fe243db8f08ef49845e9fb35c350ef4b49

    • memory/1300-9-0x0000000000400000-0x00000000004BE000-memory.dmp

      Filesize

      760KB

    • memory/1300-79-0x0000000000400000-0x00000000004BE000-memory.dmp

      Filesize

      760KB

    • memory/1300-75-0x0000000000400000-0x00000000004BE000-memory.dmp

      Filesize

      760KB

    • memory/1464-1-0x0000000000400000-0x0000000000415000-memory.dmp

      Filesize

      84KB

    • memory/1464-80-0x0000000000400000-0x0000000000415000-memory.dmp

      Filesize

      84KB

    • memory/1464-74-0x0000000000400000-0x0000000000415000-memory.dmp

      Filesize

      84KB

    • memory/1464-3-0x0000000000401000-0x000000000040C000-memory.dmp

      Filesize

      44KB

    • memory/1872-645-0x0000000062E80000-0x0000000062EA2000-memory.dmp

      Filesize

      136KB

    • memory/1916-930-0x0000000062E80000-0x0000000062EA2000-memory.dmp

      Filesize

      136KB