Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
3Muruncher_1.4.0.1.zip
windows10-2004-x64
1Muruncher_...ce.gif
windows10-2004-x64
3Muruncher_...mb.gif
windows10-2004-x64
3Muruncher_...hanges
windows10-2004-x64
1Muruncher_...ar.gif
windows10-2004-x64
3Muruncher_...og.gif
windows10-2004-x64
3Muruncher_...er.gif
windows10-2004-x64
3Muruncher_...icense
windows10-2004-x64
1Muruncher_...cences
windows10-2004-x64
1Muruncher_...orting
windows10-2004-x64
1Muruncher_...me.gif
windows10-2004-x64
3Muruncher_...nt.gif
windows10-2004-x64
3Muruncher_...se.gif
windows10-2004-x64
3Muruncher_...-8.dll
windows10-2004-x64
1Muruncher_...-6.dll
windows10-2004-x64
1Muruncher_...-9.dll
windows10-2004-x64
1Muruncher_...-1.dll
windows10-2004-x64
1Muruncher_...-0.dll
windows10-2004-x64
1Muruncher_...-0.dll
windows10-2004-x64
1Muruncher_...-0.dll
windows10-2004-x64
1Muruncher_...-0.dll
windows10-2004-x64
1Muruncher_...16.dll
windows10-2004-x64
1Muruncher_...-5.dll
windows10-2004-x64
1Muruncher_...-0.dll
windows10-2004-x64
1Muruncher_...-3.dll
windows10-2004-x64
1Muruncher_...-7.dll
windows10-2004-x64
1Muruncher_...ar.pot
windows10-2004-x64
1Muruncher_...nv.dll
windows10-2004-x64
3Muruncher_...eg.dll
windows10-2004-x64
3Muruncher_...ate.py
windows10-2004-x64
3Muruncher_...13.dll
windows10-2004-x64
3Muruncher_...b1.dll
windows10-2004-x64
3Analysis
-
max time kernel
95s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
01/09/2024, 22:08
Static task
static1
Behavioral task
behavioral1
Sample
Muruncher_1.4.0.1.zip
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
Muruncher_1.4.0.1/Other/App/Edgar/doc/alienDevice.gif
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Muruncher_1.4.0.1/Other/App/Edgar/doc/bomb.gif
Resource
win10v2004-20240802-en
Behavioral task
behavioral4
Sample
Muruncher_1.4.0.1/Other/App/Edgar/doc/changes
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
Muruncher_1.4.0.1/Other/App/Edgar/doc/edgar.gif
Resource
win10v2004-20240802-en
Behavioral task
behavioral6
Sample
Muruncher_1.4.0.1/Other/App/Edgar/doc/frog.gif
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
Muruncher_1.4.0.1/Other/App/Edgar/doc/gazer.gif
Resource
win10v2004-20240802-en
Behavioral task
behavioral8
Sample
Muruncher_1.4.0.1/Other/App/Edgar/doc/license
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
Muruncher_1.4.0.1/Other/App/Edgar/doc/music_and_sound_licences
Resource
win10v2004-20240802-en
Behavioral task
behavioral10
Sample
Muruncher_1.4.0.1/Other/App/Edgar/doc/porting
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
Muruncher_1.4.0.1/Other/App/Edgar/doc/purple_jumping_slime.gif
Resource
win10v2004-20240802-en
Behavioral task
behavioral12
Sample
Muruncher_1.4.0.1/Other/App/Edgar/doc/spitting_plant.gif
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
Muruncher_1.4.0.1/Other/App/Edgar/doc/tortoise.gif
Resource
win10v2004-20240802-en
Behavioral task
behavioral14
Sample
Muruncher_1.4.0.1/Other/App/Edgar/libFLAC-8.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
Muruncher_1.4.0.1/Other/App/Edgar/libfreetype-6.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral16
Sample
Muruncher_1.4.0.1/Other/App/Edgar/libjpeg-9.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
Muruncher_1.4.0.1/Other/App/Edgar/libmodplug-1.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral18
Sample
Muruncher_1.4.0.1/Other/App/Edgar/libmpg123-0.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
Muruncher_1.4.0.1/Other/App/Edgar/libogg-0.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral20
Sample
Muruncher_1.4.0.1/Other/App/Edgar/libopus-0.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
Muruncher_1.4.0.1/Other/App/Edgar/libopusfile-0.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral22
Sample
Muruncher_1.4.0.1/Other/App/Edgar/libpng16-16.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
Muruncher_1.4.0.1/Other/App/Edgar/libtiff-5.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral24
Sample
Muruncher_1.4.0.1/Other/App/Edgar/libvorbis-0.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
Muruncher_1.4.0.1/Other/App/Edgar/libvorbisfile-3.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral26
Sample
Muruncher_1.4.0.1/Other/App/Edgar/libwebp-7.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
Muruncher_1.4.0.1/Other/App/Edgar/locale/edgar.pot
Resource
win10v2004-20240802-en
Behavioral task
behavioral28
Sample
Muruncher_1.4.0.1/Other/Source/iconv.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
Muruncher_1.4.0.1/Other/Source/jpeg.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral30
Sample
Muruncher_1.4.0.1/Other/Source/language/update.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
Muruncher_1.4.0.1/Other/Source/libpng13.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral32
Sample
Muruncher_1.4.0.1/Other/Source/zlib1.dll
Resource
win10v2004-20240802-en
General
-
Target
Muruncher_1.4.0.1/Other/App/Edgar/locale/edgar.pot
-
Size
140KB
-
MD5
754b88bb075526812f704fdadde34662
-
SHA1
3b95f47fd500b4d7cba550f923975f52f7f694dc
-
SHA256
e5da9420cfd1adbb99d09bc34e09b99ade23f5e560ad557c6a7ddb5d934cc7df
-
SHA512
aecf83e65037b8fb2c9ddfa0e00995d8afa21d330a860b2dfb6dee9ab1d946817500e419f3f87f974ba3fc042716f6fe55e6a7ac59b03c8af3db05c76e31c56d
-
SSDEEP
1536:sKRUTRk+M5T53uul7X8ElelOlKlllclhlIlWlElmlfj+HV1ez2Vkk4zngSudZVzm:1RUxVOCRkuNwzZ2WFV
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz POWERPNT.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString POWERPNT.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 POWERPNT.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS POWERPNT.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily POWERPNT.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU POWERPNT.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1084 POWERPNT.EXE -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1084 POWERPNT.EXE 1084 POWERPNT.EXE 1084 POWERPNT.EXE 1084 POWERPNT.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\Muruncher_1.4.0.1\Other\App\Edgar\locale\edgar.pot" /ou ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1084