Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

CefSharp.B...re.dll

windows10-2004-x64

1

CefSharp.B...ss.exe

windows10-2004-x64

1

CefSharp.C...me.dll

windows10-2004-x64

1

CefSharp.Core.dll

windows10-2004-x64

1

CefSharp.Wpf.dll

windows10-2004-x64

1

CefSharp.dll

windows10-2004-x64

1

Celery.exe

windows10-2004-x64

7

Microsoft....es.dll

windows10-2004-x64

1

Microsoft....ns.dll

windows10-2004-x64

1

Microsoft....ns.dll

windows10-2004-x64

1

Microsoft....on.dll

windows10-2004-x64

1

Newtonsoft.Json.dll

windows10-2004-x64

1

System.Run...fe.dll

windows10-2004-x64

1

System.Thr...ns.dll

windows10-2004-x64

1

System.Win...ty.dll

windows10-2004-x64

1

chrome_elf.dll

windows10-2004-x64

1

d3dcompiler_47.dll

windows10-2004-x64

1

dxcompiler.dll

windows10-2004-x64

1

dxil.dll

windows10-2004-x64

1

libEGL.dll

windows10-2004-x64

1

libGLESv2.dll

windows10-2004-x64

1

libcef.dll

windows10-2004-x64

1

locales/en-US.ps1

windows10-2004-x64

3

vk_swiftshader.dll

windows10-2004-x64

1

vulkan-1.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Release.1.zip

  • Size

    151.0MB

  • Sample

    240811-z61jsashnh

  • MD5

    d2110db73f1f7ef46f52ac242ffa3a53

  • SHA1

    ce32ca3799d9bf7fb1d9c89a7d6a37aa2aebc74c

  • SHA256

    50075722aa0970650d88d6c29e8c3f45e684c99be8d4865e8c4daf5ef937bd72

  • SHA512

    88fe08c1d660562e978d43d35ddb56b9d8fcd981fd50681908c4645dfae6019d4813328e1a5e4a7687810a48e843bb9091ef3074aef494ce5f904864a06f6919

  • SSDEEP

    3145728:pf8OFA+D60opS+Z62yoiphIOMh+GvVXyX/CLeDM/4Xo9LcY2TYM9:mOFA+D6bSy6MAlstXDyoQ3nYM9

Score
7/10
discoveryexecution

Malware Config

Targets

    • Target

      CefSharp.BrowserSubprocess.Core.dll

    • Size

      1.1MB

    • MD5

      5b745ee879e65f7a47c56265881f16e7

    • SHA1

      e6a90771b8f1bf53beeb7c9e4268756ff07a088d

    • SHA256

      c8944a83938c39fbea72700485db8a61ab82e1c51d8e16d5dd48de4e36a6f264

    • SHA512

      3b4bef98a1f751c3a747de0eb050828bf8474efa68aa7a26d0369f1c3b42829eaab221cb612c005a54ed5b84f19180700e51aab39adb84fe7246d9e91e6899c8

    • SSDEEP

      24576:0u7vjXauHhY9GlRDLFZbJ/ogbZcECacHIDCRCSpb+ms0veXCJ2ZiVxhEDssQjPcd:0u7l41pKms0veXCJ2ZiVxhEDssQjPc8F

    Score
    1/10
    behavioral1

    • Target

      CefSharp.BrowserSubprocess.exe

    • Size

      6KB

    • MD5

      bcd22b9511d5383e23d875e2cf3c339e

    • SHA1

      0ef86afaef536cc4b046ea2866414bb193d60702

    • SHA256

      95dd31f11ac1317559b6eee0479739930d503a4938283f5d831ac8add92ad792

    • SHA512

      c4e6821858720895c0bfae797097e3307bb7ea8f03dde4fefc16cce03b2a50fecfe8ed5c3225136fcd9d74ee0ed8673f795b410cd14890d22df58c1f03b693c6

    • SSDEEP

      96:v6ZxBI7kNmQBDvJGSkX6eFZJetmAhNt61OYcXe5U:UBIimQB9eX6eFZgsAYcXeS

    Score
    1/10
    behavioral2

    • Target

      CefSharp.Core.Runtime.dll

    • Size

      1.7MB

    • MD5

      21719cf581f5cc98b21c748498f1cbfe

    • SHA1

      aaada7a02fadcbd25b836c924e936ce7d7ee0c2a

    • SHA256

      6fd2685e02ef7c92ba5080faadb44f22fee528713f5101e2841c1230cba691e6

    • SHA512

      6394ddabc7ad03895ecddb9943371935e0a2320e933b380a563eaf03d1a039c7180aee763834170c85485416b1af38b55c1dafff7311b25513369b01dce22598

    • SSDEEP

      49152:CcWYPM4G6kaHqcHCgrZi5C9xh0UsWLgiHesm2qCUD/yNWYxtYtUkjCKf462gQkAD:TP

    Score
    1/10
    behavioral3

    • Target

      CefSharp.Core.dll

    • Size

      897KB

    • MD5

      16f8a4945f5bdd5c1c6c73541e1ebec3

    • SHA1

      4342762c43f54c4caafaae40f933599a9bb93cb5

    • SHA256

      636f8f865f23f2d47b73f3c16622e10b46437bbf7c89b0a2f70bae6129ab046a

    • SHA512

      04115c425c3015ee4355cde2a6e5e28ec24745ea77761a40c0986b54dc14bc67cb142986988d79df87e75ea54d21ded9384842e01cf0714b84f7378e6a13400d

    • SSDEEP

      6144:cJXlLt6r1zItQCtpf/Xg8HnJQvq6qea0zWEmjBZre7W0vnlYviqJ9/z8+irWGvgc:c5lLtg8/XIPrsNZ0Kiq8uhtt

    Score
    1/10
    behavioral4

    • Target

      CefSharp.Wpf.dll

    • Size

      114KB

    • MD5

      36946182df277e84a313c3811adac855

    • SHA1

      bcd21305861e22878271e37604b7b033ec347eb3

    • SHA256

      8507a4662220eca49d7d511183be801cd394f13dc0e9898c55361020fe9a4720

    • SHA512

      80b1e947b1940dccfe5be8a1ba1e8c1d9eacb122d73724a21233164f5b318fa57c249256f621f0f9c1e6a9e4c902eec58827bb899e20f2990f4ade1d685f1abd

    • SSDEEP

      3072:tvd969S0dZqKLfGlAW9mLGKOiGfiVmVgGs0COe5w5tnR:tvb69SSZqKLfGlAW9iGliAVgGp3t

    Score
    1/10
    behavioral5

    • Target

      CefSharp.dll

    • Size

      272KB

    • MD5

      715c534060757613f0286e1012e0c34a

    • SHA1

      8bf44c4d87b24589c6f08846173015407170b75d

    • SHA256

      f7ad2bbbeb43f166bbbf986bdb2b08c462603c240c605f1c6a7749c643dff3fe

    • SHA512

      fcaec0c107a8703a8263ce5ccc64c2f5bfc01628756b2319fde21b0842652fbeee04c9f8f6d93f7200412d9bd9fad01494bc902501fb92e7d6b319f8d9db78d7

    • SSDEEP

      3072:y79yn4VZ3fE1clgTTNmMnRGhH7gxNT5AL6GmAj9VB08OKNlUtrz+pyUU2Hu61:m3OKraRAEx7AL1mAjDB08jNlY+pmj6

    Score
    1/10
    behavioral6

    • Target

      Celery.exe

    • Size

      17.3MB

    • MD5

      433bb23192adb1d78a2fd99ca652eab4

    • SHA1

      40087ada7a5020046c30d8ffb9fd70949450151e

    • SHA256

      06a7351cbbb9e794e8ee5793114cb74cda3b55f23eb634ea3b994adf851ddd3a

    • SHA512

      d74a2156ea003640774a1139aa4c1b5b76f0f97ebbeec1dd3cebbf902eb667d369f7ea8e1d3c6aff140da6f75e5c64cee23cd1e2cb988873db95723ea9cca93e

    • SSDEEP

      393216:xUa57DdNAuyvw4wK/gsrlVwgqI59D8exrbwANXg5yH4LVvIz:p1d2toVKrR5qI59woPXlOLmz

    Score
    7/10
    discovery

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Network Service Discovery

      Attempt to gather information on host's network.

      discovery

    • Drops file in System32 directory

    behavioral7

    • Target

      Microsoft.Bcl.AsyncInterfaces.dll

    • Size

      26KB

    • MD5

      ff34978b62d5e0be84a895d9c30f99ae

    • SHA1

      74dc07a8cccee0ca3bf5cf64320230ca1a37ad85

    • SHA256

      80678203bd0203a6594f4e330b22543c0de5059382bb1c9334b7868b8f31b1bc

    • SHA512

      7f207f2e3f9f371b465bca5402db0e5cec3cb842a1f943d3e3dcedc8e5d134f58c7c4df99303c24501c103494b4f16160f86db80893779ce41b287a23574ee28

    • SSDEEP

      384:cOJWqnwCBbNAP0VES2j0cX6dAl+NWpVzrdcoquWeP/WxR5kHRN7dDFcYR9zPrf8O:culwCBhdVv2wK5fdcUtFFn9zT8pY

    Score
    1/10
    behavioral8

    • Target

      Microsoft.Expression.Interactions.dll

    • Size

      89KB

    • MD5

      6a3b9e46c41e42e7b8e1479468d892af

    • SHA1

      e31c05ae685e51d07808b1dd24ceced9d299ed81

    • SHA256

      f3b14defbd05493b8573016b08b86e5b5d53b486b0457fd75f67bf8bff04be38

    • SHA512

      d6416204875ce732edac51e36f267c9cca52f60ba79cd981b388988e435bd1cce87f972a9e90be4fd9a7fd25cb316293f938f45fb645f25a4f62b980a37236b7

    • SSDEEP

      1536:Srf5GttgxHXEuRmG5rtkGY4CEmWAxXSSYhhS98ca2Wvsd65FJDlGWwkEy:a5GttWHXEUx5r65LxXshk8JDIWP

    Score
    1/10
    behavioral9

    • Target

      Microsoft.Extensions.DependencyInjection.Abstractions.dll

    • Size

      62KB

    • MD5

      00053ff3b5744853b9ebf90af4fdd816

    • SHA1

      13c0a343f38b1bb21a3d90146ed92736a8166fe6

    • SHA256

      c5a119ec89471194b505140fba13001fa05f81c4b4725b80bb63ccb4e1408c1e

    • SHA512

      c99fcda5165f8dc7984fb97ce45d00f8b00ca9813b8c591ad86691bd65104bbb86c36b49bb6c638f3b1e9b2642ec9ac830003e894df338acfca2d11296ff9da4

    • SSDEEP

      768:4r85ZhSBuU1OURH7MV5594phn9Uad5J6Sx+I9W6wjMwRLSEnlHctC63/iOn9zT8c:cH7Mz8DiIW6Pw9SEnl8txviO9zTH

    Score
    1/10
    behavioral10

    • Target

      Microsoft.Extensions.DependencyInjection.dll

    • Size

      94KB

    • MD5

      3452007cab829c2ba196f72b261f7dec

    • SHA1

      c5e7cfd490839f2b34252bd26020d7f8961b221b

    • SHA256

      18b39777ee45220217459641991ab700bc9253acaf0940cf6e017e9392b43698

    • SHA512

      a8b83a8582dfee144925a821d09c40f5730f6337b29446c3bce8b225659bdc57a48778081fa866c092d59b4108c1d992e33f9543ae2b4c7554b8ff27b5332cdf

    • SSDEEP

      1536:g/F7GzTFh4u/Nf172OPHxZXD2wdOwaOwGuldE4lCyBBiM+z9f:oF7i4u/FYg3XrMnOwGuld5dBMZf

    Score
    1/10
    behavioral11

    • Target

      Newtonsoft.Json.dll

    • Size

      695KB

    • MD5

      195ffb7167db3219b217c4fd439eedd6

    • SHA1

      1e76e6099570ede620b76ed47cf8d03a936d49f8

    • SHA256

      e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d

    • SHA512

      56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac

    • SSDEEP

      12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/

    Score
    1/10
    behavioral12

    • Target

      System.Runtime.CompilerServices.Unsafe.dll

    • Size

      16KB

    • MD5

      da04a75ddc22118ed24e0b53e474805a

    • SHA1

      2d68c648a6a6371b6046e6c3af09128230e0ad32

    • SHA256

      66409f670315afe8610f17a4d3a1ee52d72b6a46c544cec97544e8385f90ad74

    • SHA512

      26af01ca25e921465f477a0e1499edc9e0ac26c23908e5e9b97d3afd60f3308bfbf2c8ca89ea21878454cd88a1cddd2f2f0172a6e1e87ef33c56cd7a8d16e9c8

    • SSDEEP

      192:LGLxTyHvc4ROgcxAdWXYWJeaPtWsI9A9GaHnhWgN7aJeWw0fnCsqnajt:LgGLROZAdWXYW8aPcyHRN7WEqn1lx

    Score
    1/10
    behavioral13

    • Target

      System.Threading.Tasks.Extensions.dll

    • Size

      25KB

    • MD5

      e1e9d7d46e5cd9525c5927dc98d9ecc7

    • SHA1

      2242627282f9e07e37b274ea36fac2d3cd9c9110

    • SHA256

      4f81ffd0dc7204db75afc35ea4291769b07c440592f28894260eea76626a23c6

    • SHA512

      da7ab8c0100e7d074f0e680b28d241940733860dfbdc5b8c78428b76e807f27e44d1c5ec95ee80c0b5098e8c5d5da4d48bce86800164f9734a05035220c3ff11

    • SSDEEP

      384:1R973o62/KqcAnb05J3w0I5eUGef8s72XBWdvVW2JW8aJcyHRN7WEimpplex:1RZ4nNxnYTb6Blha

    Score
    1/10
    behavioral14

    • Target

      System.Windows.Interactivity.dll

    • Size

      39KB

    • MD5

      3ab57a33a6e3a1476695d5a6e856c06a

    • SHA1

      dabb4ecffd0c422a8eebff5d4ec8116a6e90d7e7

    • SHA256

      4aace8c8a330ae8429cd8cc1b6804076d3a9ffd633470f91fd36bdd25bb57876

    • SHA512

      58dbfcf9199d72d370e2d98b8ef2713d74207a597c9494b0ecf5e4c7bf7cf60c5e85f4a92b2a1896dff63d9d5107f0d81d7dddbc7203e9e559ab7219eca0df92

    • SSDEEP

      768:6MazwAgR8/XJ665bKZdxuB8DCuL5enM7JxKjuMlZCZN+R0E7E:63wBccZdxuB8mQen6JxKjrlMZgR0Eo

    Score
    1/10
    behavioral15

    • Target

      chrome_elf.dll

    • Size

      1.3MB

    • MD5

      5b3802f150c42ad6d24674ae78f9d3e8

    • SHA1

      428139f0a862128e55e5231798f7c8e2df34a92a

    • SHA256

      9f455612e32e5da431c7636773e34bd08dae79403cc8cf5b782b0ea4f1955799

    • SHA512

      07afbd49e17d67957c65929ca7bdfe03b33b299c66c48aa738262da480ed945712d891be83d35bd42833d5465ef60e09c7a5956df0a369ec92d3bc2d25a09007

    • SSDEEP

      24576:LcTZORTcbxjPziCdLI3ovs8t8+oaOzjY:LcTZYTOxjPzJdEoNa+2fY

    Score
    1/10
    behavioral16

    • Target

      d3dcompiler_47.dll

    • Size

      4.7MB

    • MD5

      2191e768cc2e19009dad20dc999135a3

    • SHA1

      f49a46ba0e954e657aaed1c9019a53d194272b6a

    • SHA256

      7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d

    • SHA512

      5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970

    • SSDEEP

      49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l

    Score
    1/10
    behavioral17

    • Target

      dxcompiler.dll

    • Size

      20.8MB

    • MD5

      141f621285ed586f9423844a83e8a03f

    • SHA1

      9c58feee992c3d42383bde55f0ff7688bc3bd579

    • SHA256

      5592056f52768ba41aad10785d21c1b18baf850a7e6a9e35526f43a55e6ada6d

    • SHA512

      951a55bbe86a7ebecfc946bf1c9a8c629f0e09510089a79a352cd6d89b7c42e0e23fd4f26232b0e73bd6d4ec158b86728cda2ab25745abcabfafadd964b55896

    • SSDEEP

      393216:5NfWHkWI4F8p4q8ZyfV+mq7q5oIB1p4bWpso:cTW4bWpso

    Score
    1/10
    behavioral18

    • Target

      dxil.dll

    • Size

      1.4MB

    • MD5

      cb72bef6ce55aa7c9e3a09bd105dca33

    • SHA1

      d48336e1c8215ccf71a758f2ff7e5913342ea229

    • SHA256

      47ffdbd85438891b7963408ea26151ba26ae1b303bbdab3a55f0f11056085893

    • SHA512

      c89eebcf43196f8660eee19ca41cc60c2a00d93f4b3bf118fe7a0deccb3f831cac0db04b2f0c5590fa8d388eb1877a3706ba0d58c7a4e38507c6e64cfd6a50a0

    • SSDEEP

      24576:LCfhbh3v3mtZDiAQeWj26k41ob2nrZ1rqpegQDJqoZtp22GkmgA9u808jQPEdkr1:LCfhbh3v3mtEAQrW41obCraeRhy9ou6r

    Score
    1/10
    behavioral19

    • Target

      libEGL.dll

    • Size

      459KB

    • MD5

      ce2c45983f63a6cf0cddce68778124e9

    • SHA1

      6553dc5b4bc68dcb1e9628a718be9c5b481a6677

    • SHA256

      9ca8840bbb5f587848e66d08d36cb5eb30c1c448ef49ce504961ff4ac810c605

    • SHA512

      df81a3356168e78d9810f5e87ca86eb4f56e5f0cb6afdb13408b50778a2d8b18c70b02c6348cd7ba59609ab2956d28eed324706eb65d04bce1159a2d8f1e0e8f

    • SSDEEP

      3072:OJr6bcnn5+k93dw1IkCUEWZpWr1H7gd51Dzwr7fkN7yt6S0/t6BDE96FX9Dk2K0I:IcpoGEfmMJHKDzm7fku10/tTYd6jb1D

    Score
    1/10
    behavioral20

    • Target

      libGLESv2.dll

    • Size

      7.3MB

    • MD5

      c9b090ed25f61aa311a6d03fd8839433

    • SHA1

      f1567aa2fb1fcad3cde1e181a62f5e2bccadaf68

    • SHA256

      c7a7a59cf3c26d6c8b2505996065d49f339764f5718e6f53a9ecec8686c489db

    • SHA512

      21cd4618b6ad011afa78abe8fbc42ecafbb992322912c4a77e5f193a04aeb97a5655dedfc513e1a7667db55b92a322e3d9a6dfe7e845af25f37a6666a1798470

    • SSDEEP

      98304:UqV269WX/0dlldzRv/DaVhHTEeXm3w584:UqVtpdlTkVVrCw584

    Score
    1/10
    behavioral21

    • Target

      libcef.dll

    • Size

      204.4MB

    • MD5

      3f1e12a06149b68ec7ea58486413aac5

    • SHA1

      b5ee4bfb76e53cb50cf0ca9da43659cc67454b12

    • SHA256

      e2f3d912e2fa54b2d29330202bfb98394a3086aaff800417e382f772a6b07922

    • SHA512

      23d45229285bbbdf538fa03e050bd2b6815e446c602c86603b13b0dbb6811d5fe40711f46fd34bca9efbb17af3ab38d466161903b65798400d3ffc24b8945062

    • SSDEEP

      1572864:h90gHOgkN8SpQTT/PG4iRa592G7eZy1aQ3+PcToCptZjUicMTyDBlT5vOIZaJ/Cd:XgNEJ5Ajoq

    Score
    1/10
    behavioral22

    • Target

      locales/en-US.pak

    • Size

      455KB

    • MD5

      a8d060aa17ed42b6b2c4a9fcbab8a7e1

    • SHA1

      16e4e544eca024f8b5a70b4f3ca339a7a0a51ebf

    • SHA256

      55e4ae861aa1cacb09db070a4be0e9dd9a24d2d45e4168824364307120a906b2

    • SHA512

      8f3820e3c5aca560344a253d068936bdb797d07eb22711020d287a949c97d7a98879ff9ff5a4fb2f3fe804bf502300b6f4c92918d973bef351d587483bc43723

    • SSDEEP

      6144:K4xBLGwjACVzeooSr837tMP9eJqDLfaY0baAP52vSZng5H/9xZwp:Kq0CVz1HctMqqD+d56S2Zwp

    Score
    3/10
    execution
    behavioral23

    • Target

      vk_swiftshader.dll

    • Size

      4.9MB

    • MD5

      3262e23f3fef8b021b93c801f5649c92

    • SHA1

      de49b94cfc981a0af5a4e134854f69620e7ba566

    • SHA256

      1c9098e8a6f21462864a91e74555f299ebc41d3bc79d6ee1b9c577c929957285

    • SHA512

      54b0b26b95f6fc799b3e24863a65ef3896786811be3cc9fffa2a06e95e98daf32b16f0ede6b8a87acc319ea17650cdd089c56798236476b894054195738e1797

    • SSDEEP

      49152:gF448X7wFiEjApLVO1m6ok46FFQNeoX/lbR7lZI5cWp3PDr70yDIubUQ6ot70FXf:l/X7i+xLLIJmZdT

    Score
    1/10
    behavioral24

    • Target

      vulkan-1.dll

    • Size

      924KB

    • MD5

      38d2b059a99f2c4b6f863c18c6f1d25a

    • SHA1

      8b027a7704b795df1f74b994b0dc55ca4e53c479

    • SHA256

      a72bd8d3d24ff0e2c56a2b64c05b324f0b7f56ab486f507a256a9c3fef7bc902

    • SHA512

      4689aae5bf7f81a7d216a570e36322ab61ffb33428316f301be20f1f65111b6eb696b75325b008dff6f963a135148ccc1c600ed1bf71fcc813765918daa14102

    • SSDEEP

      24576:YXd+yURo9zpJSRoOl6Z5W1DYsHq6g3P0zAk7C3:wdwGdrStl6Z5W1DYsHq6g3P0zAk7C

    Score
    1/10
    behavioral25

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.