Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
3The Henry ...IR.dll
windows7-x64
3The Henry ...IR.dll
windows10-2004-x64
3The Henry ...15.dll
windows7-x64
3The Henry ...15.dll
windows10-2004-x64
3The Henry ...ry.exe
windows7-x64
3The Henry ...ry.exe
windows10-2004-x64
3The Henry ...32.dll
windows7-x64
3The Henry ...32.dll
windows10-2004-x64
3The Henry ...64.dll
windows7-x64
1The Henry ...64.dll
windows10-2004-x64
1The Henry ...it.dll
windows7-x64
3The Henry ...it.dll
windows10-2004-x64
3The Henry ...cp.dll
windows7-x64
3The Henry ...cp.dll
windows10-2004-x64
3The Henry ...in.exe
windows7-x64
3The Henry ...in.exe
windows10-2004-x64
3The Henry ...NF.dll
windows7-x64
3The Henry ...NF.dll
windows10-2004-x64
3The Henry ...pi.dll
windows7-x64
3The Henry ...pi.dll
windows10-2004-x64
3Analysis
-
max time kernel
583s -
max time network
621s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
25/08/2024, 10:07
Static task
static1
Behavioral task
behavioral1
Sample
The Henry Stickmin Collection/Adobe AIR/Versions/1.0/Adobe AIR.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
The Henry Stickmin Collection/Adobe AIR/Versions/1.0/Adobe AIR.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
The Henry Stickmin Collection/Adobe AIR/Versions/1.0/Resources/AdobeCP15.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
The Henry Stickmin Collection/Adobe AIR/Versions/1.0/Resources/AdobeCP15.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
The Henry Stickmin Collection/Adobe AIR/Versions/1.0/Resources/CaptiveAppEntry.exe
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
The Henry Stickmin Collection/Adobe AIR/Versions/1.0/Resources/CaptiveAppEntry.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
The Henry Stickmin Collection/Adobe AIR/Versions/1.0/Resources/NPSWF32.dll
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
The Henry Stickmin Collection/Adobe AIR/Versions/1.0/Resources/NPSWF32.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
The Henry Stickmin Collection/Adobe AIR/Versions/1.0/Resources/NPSWF64.dll
Resource
win7-20240729-en
Behavioral task
behavioral10
Sample
The Henry Stickmin Collection/Adobe AIR/Versions/1.0/Resources/NPSWF64.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
The Henry Stickmin Collection/Adobe AIR/Versions/1.0/Resources/WebKit.dll
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
The Henry Stickmin Collection/Adobe AIR/Versions/1.0/Resources/WebKit.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
The Henry Stickmin Collection/Adobe AIR/Versions/1.0/Resources/adobecp.dll
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
The Henry Stickmin Collection/Adobe AIR/Versions/1.0/Resources/adobecp.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
The Henry Stickmin Collection/HenryStickmin.exe
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
The Henry Stickmin Collection/HenryStickmin.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
The Henry Stickmin Collection/META-INF/AIR/extensions/com.amanitadesign.steam.FRESteamWorks/META-INF.dll
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
The Henry Stickmin Collection/META-INF/AIR/extensions/com.amanitadesign.steam.FRESteamWorks/META-INF.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
The Henry Stickmin Collection/steam_api.dll
Resource
win7-20240705-en
Behavioral task
behavioral20
Sample
The Henry Stickmin Collection/steam_api.dll
Resource
win10v2004-20240802-en
General
-
Target
The Henry Stickmin Collection/Adobe AIR/Versions/1.0/Resources/CaptiveAppEntry.exe
-
Size
81KB
-
MD5
4ed66c7994f6ed261fe3bd0d95535796
-
SHA1
a34c10f75d1a1d405bb0a78c7c87bab2f623c89e
-
SHA256
03e67b6cd84650a56d6ed8f9a8c04de14c5660ecd715dc5cd4c7e8cf04acf886
-
SHA512
1bfc79e1ef9f13332276dd48cd6372eeb7faa5e77779200571f26de6743b6434e2197b7079783726a32fadf82bf6c59747b09101b010a0a29e38c5ce86fa2d9e
-
SSDEEP
1536:9ynfkRc7VR7s8Vk7rf9MjNqgKI15Fo+QfssWncdf70MSVF28:9cR7HVcrFONqdOvS3f7fSVF7
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CaptiveAppEntry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\The Henry Stickmin Collection\Adobe AIR\Versions\1.0\Resources\CaptiveAppEntry.exe"C:\Users\Admin\AppData\Local\Temp\The Henry Stickmin Collection\Adobe AIR\Versions\1.0\Resources\CaptiveAppEntry.exe"1⤵
- System Location Discovery: System Language Discovery
PID:2344