Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

Ultimate Tweaks.exe

windows11-21h2-x64

9

$PLUGINSDI...ls.dll

windows11-21h2-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

$PLUGINSDIR/UAC.dll

windows11-21h2-x64

3

$PLUGINSDI...ll.dll

windows11-21h2-x64

3

LICENSES.c...m.html

windows11-21h2-x64

3

Ultimate Tweaks.exe

windows11-21h2-x64

7

d3dcompiler_47.dll

windows11-21h2-x64

1

ffmpeg.dll

windows11-21h2-x64

1

libEGL.dll

windows11-21h2-x64

1

libGLESv2.dll

windows11-21h2-x64

1

resources/elevate.exe

windows11-21h2-x64

3

vk_swiftshader.dll

windows11-21h2-x64

1

vulkan-1.dll

windows11-21h2-x64

1

$PLUGINSDI...gs.dll

windows11-21h2-x64

3

$PLUGINSDI...ec.dll

windows11-21h2-x64

3

$PLUGINSDI...7z.dll

windows11-21h2-x64

3

$R0/Uninst...ks.exe

windows11-21h2-x64

7

$PLUGINSDI...ls.dll

windows11-21h2-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

$PLUGINSDIR/UAC.dll

windows11-21h2-x64

3

$PLUGINSDI...ll.dll

windows11-21h2-x64

3

$PLUGINSDI...gs.dll

windows11-21h2-x64

3

$PLUGINSDI...ec.dll

windows11-21h2-x64

3

Resubmissions

12/08/2024, 23:52 UTC

240812-3w194ssepc 10

Analysis

  • max time kernel
    144s
  • max time network
    148s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    12/08/2024, 23:52 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    $R0/Uninstall Ultimate Tweaks.exe

  • Size

    294KB

  • MD5

    6b7a6fd94af4915e6512a2eb986c238f

  • SHA1

    e55f47a7b3f05a309ff11a0e33b2bda4906e4213

  • SHA256

    8f3ff8e1f845235c88b116cd7165f6fa0a430907271972e5b19e0e6e8ecb1312

  • SHA512

    40e62b7628e9220741bede889a2637ffdb3e70ec0beb9aa4384d9e3339554de3c6dd921a11803d6ab7c463663de1bff30f1c5c5f09ccf5fca8280f088dc42a1e

  • SSDEEP

    6144:g740I3kLzOa0DOGqRuPlADOfMB2Ua8T2t0EyL+yaS:6BLzkD7qRuSKkUCLRKJS

Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall Ultimate Tweaks.exe
    "C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall Ultimate Tweaks.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2264
    • C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
      "C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=C:\Users\Admin\AppData\Local\Temp\$R0\
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:3532

Network

  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
    Response
    8.8.8.8.in-addr.arpa
    IN PTR
    dnsgoogle
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    10.28.171.150.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    10.28.171.150.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    arc.msn.com
    Remote address:
    8.8.8.8:53
    Request
    arc.msn.com
    IN A
    Response
    arc.msn.com
    IN CNAME
    arc.trafficmanager.net
    arc.trafficmanager.net
    IN CNAME
    iris-de-prod-azsc-v2-neu.northeurope.cloudapp.azure.com
    iris-de-prod-azsc-v2-neu.northeurope.cloudapp.azure.com
    IN A
    20.223.35.26
  • flag-us
    DNS
    arc.msn.com
    Remote address:
    8.8.8.8:53
    Request
    arc.msn.com
    IN A
  • flag-us
    DNS
    25.140.123.92.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    25.140.123.92.in-addr.arpa
    IN PTR
    Response
    25.140.123.92.in-addr.arpa
    IN PTR
    a92-123-140-25deploystaticakamaitechnologiescom
  • flag-us
    DNS
    arc.msn.com
    Remote address:
    8.8.8.8:53
    Request
    arc.msn.com
    IN A
    Response
    arc.msn.com
    IN CNAME
    arc.trafficmanager.net
    arc.trafficmanager.net
    IN CNAME
    iris-de-prod-azsc-v2-neu.northeurope.cloudapp.azure.com
    iris-de-prod-azsc-v2-neu.northeurope.cloudapp.azure.com
    IN A
    20.223.35.26
  • flag-us
    DNS
    26.35.223.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    26.35.223.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    43.229.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    43.229.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    ctldl.windowsupdate.com
    Remote address:
    8.8.8.8:53
    Request
    ctldl.windowsupdate.com
    IN A
    Response
    ctldl.windowsupdate.com
    IN CNAME
    ctldl.windowsupdate.com.delivery.microsoft.com
    ctldl.windowsupdate.com.delivery.microsoft.com
    IN CNAME
    wu-b-net.trafficmanager.net
    wu-b-net.trafficmanager.net
    IN CNAME
    bg.microsoft.map.fastly.net
    bg.microsoft.map.fastly.net
    IN A
    199.232.210.172
    bg.microsoft.map.fastly.net
    IN A
    199.232.214.172
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    arc.msn.com
    Remote address:
    8.8.8.8:53
    Request
    arc.msn.com
    IN A
    Response
    arc.msn.com
    IN CNAME
    arc.trafficmanager.net
    arc.trafficmanager.net
    IN CNAME
    iris-de-prod-azsc-v2-neu.northeurope.cloudapp.azure.com
    iris-de-prod-azsc-v2-neu.northeurope.cloudapp.azure.com
    IN A
    20.223.35.26
  • flag-us
    DNS
    arc.msn.com
    Remote address:
    8.8.8.8:53
    Request
    arc.msn.com
    IN A
    Response
    arc.msn.com
    IN CNAME
    arc.trafficmanager.net
    arc.trafficmanager.net
    IN CNAME
    iris-de-prod-azsc-v2-frc-b.francecentral.cloudapp.azure.com
    iris-de-prod-azsc-v2-frc-b.francecentral.cloudapp.azure.com
    IN A
    20.74.47.205
  • flag-us
    DNS
    205.47.74.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    205.47.74.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    arc.msn.com
    Remote address:
    8.8.8.8:53
    Request
    arc.msn.com
    IN A
    Response
    arc.msn.com
    IN CNAME
    arc.trafficmanager.net
    arc.trafficmanager.net
    IN CNAME
    iris-de-prod-azsc-v2-neu.northeurope.cloudapp.azure.com
    iris-de-prod-azsc-v2-neu.northeurope.cloudapp.azure.com
    IN A
    20.223.35.26
  • flag-us
    DNS
    ris.api.iris.microsoft.com
    Remote address:
    8.8.8.8:53
    Request
    ris.api.iris.microsoft.com
    IN A
    Response
    ris.api.iris.microsoft.com
    IN CNAME
    ris-prod.trafficmanager.net
    ris-prod.trafficmanager.net
    IN CNAME
    asf-ris-prod-neu-azsc.northeurope.cloudapp.azure.com
    asf-ris-prod-neu-azsc.northeurope.cloudapp.azure.com
    IN A
    20.234.120.54
  • flag-us
    DNS
    54.120.234.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    54.120.234.20.in-addr.arpa
    IN PTR
    Response
  • 150.171.28.10:443
    tse1.mm.bing.net
    tls
    1.7kB
     7.2kB
     18
    15
  • 150.171.28.10:443
    tse1.mm.bing.net
    tls
    1.8kB
     7.2kB
     18
    15
  • 150.171.28.10:443
    tse1.mm.bing.net
    tls
    1.8kB
     7.2kB
     18
    15
  • 150.171.28.10:443
    tse1.mm.bing.net
    tls
    39.2kB
     983.9kB
     740
    728
  • 150.171.28.10:443
    tse1.mm.bing.net
    tls
    1.8kB
     7.2kB
     18
    15
  • 150.171.28.10:443
    tse1.mm.bing.net
    tls
    2.3kB
     895 B
     12
    10
  • 150.171.28.10:443
    tse1.mm.bing.net
    tls
    2.5kB
     7.2kB
     17
    14
  • 150.171.28.10:443
    tse1.mm.bing.net
    tls
    77.6kB
     2.2MB
     1612
    1609
  • 150.171.28.10:443
    tse1.mm.bing.net
    tls
    2.5kB
     7.2kB
     17
    15
  • 8.8.8.8:53
    8.8.8.8.in-addr.arpa
    dns
    325 B
     567 B
     5
    4

    DNS Request

    8.8.8.8.in-addr.arpa

    DNS Request

    95.221.229.192.in-addr.arpa

    DNS Request

    10.28.171.150.in-addr.arpa

    DNS Request

    arc.msn.com

    DNS Request

    arc.msn.com

    DNS Response

    20.223.35.26

  • 8.8.8.8:53
    25.140.123.92.in-addr.arpa
    dns
    801 B
     2.0kB
     12
    12

    DNS Request

    25.140.123.92.in-addr.arpa

    DNS Request

    arc.msn.com

    DNS Response

    20.223.35.26

    DNS Request

    26.35.223.20.in-addr.arpa

    DNS Request

    43.229.111.52.in-addr.arpa

    DNS Request

    ctldl.windowsupdate.com

    DNS Response

    199.232.210.172
    199.232.214.172

    DNS Request

    172.210.232.199.in-addr.arpa

    DNS Request

    arc.msn.com

    DNS Response

    20.223.35.26

    DNS Request

    arc.msn.com

    DNS Response

    20.74.47.205

    DNS Request

    205.47.74.20.in-addr.arpa

    DNS Request

    arc.msn.com

    DNS Response

    20.223.35.26

    DNS Request

    ris.api.iris.microsoft.com

    DNS Response

    20.234.120.54

    DNS Request

    54.120.234.20.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\StdUtils.dll
    Filesize

    100KB

    MD5

    c6a6e03f77c313b267498515488c5740

    SHA1

    3d49fc2784b9450962ed6b82b46e9c3c957d7c15

    SHA256

    b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

    SHA512

    9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\System.dll
    Filesize

    12KB

    MD5

    0d7ad4f45dc6f5aa87f606d0331c6901

    SHA1

    48df0911f0484cbe2a8cdd5362140b63c41ee457

    SHA256

    3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

    SHA512

    c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\UAC.dll
    Filesize

    14KB

    MD5

    adb29e6b186daa765dc750128649b63d

    SHA1

    160cbdc4cb0ac2c142d361df138c537aa7e708c9

    SHA256

    2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

    SHA512

    b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\nsDialogs.dll
    Filesize

    9KB

    MD5

    466179e1c8ee8a1ff5e4427dbb6c4a01

    SHA1

    eb607467009074278e4bd50c7eab400e95ae48f7

    SHA256

    1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172

    SHA512

    7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
    Filesize

    294KB

    MD5

    6b7a6fd94af4915e6512a2eb986c238f

    SHA1

    e55f47a7b3f05a309ff11a0e33b2bda4906e4213

    SHA256

    8f3ff8e1f845235c88b116cd7165f6fa0a430907271972e5b19e0e6e8ecb1312

    SHA512

    40e62b7628e9220741bede889a2637ffdb3e70ec0beb9aa4384d9e3339554de3c6dd921a11803d6ab7c463663de1bff30f1c5c5f09ccf5fca8280f088dc42a1e

    Download Submit

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.