Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
01/09/2024, 18:38
Static task
static1
Behavioral task
behavioral1
Sample
HDT-Installer (1).exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
HDT-Installer (1).exe
Resource
win10v2004-20240802-en
General
-
Target
HDT-Installer (1).exe
-
Size
99.3MB
-
MD5
28f5bd4574847e54944f1e2b6e181bbd
-
SHA1
e04d004bb0d128b35612d85830999231f12828f9
-
SHA256
f26eeca5c4fb53d26817a14f182be2c3bde5a08ad887a5bf96531b793b5e0eba
-
SHA512
c4f0fdda9be4fb7f8fea4d567050e4ebff58dec222fb961e032e272514c8e8067ef8c020dce489812293399b13c97390546c1e4e1408a4b00faf644dccb5a5c7
-
SSDEEP
3145728:IiecVpHnM4Z6JUqN/Kq1hxW/RT98rb777:5VBnPoUGyq1hxUKrb73
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Update.exe -
Executes dropped EXE 3 IoCs
pid Process 1236 Update.exe 4072 HearthstoneDeckTracker.exe 4204 HearthstoneDeckTracker.exe -
Loads dropped DLL 64 IoCs
pid Process 4072 HearthstoneDeckTracker.exe 4072 HearthstoneDeckTracker.exe 4072 HearthstoneDeckTracker.exe 4072 HearthstoneDeckTracker.exe 4072 HearthstoneDeckTracker.exe 4072 HearthstoneDeckTracker.exe 4072 HearthstoneDeckTracker.exe 4072 HearthstoneDeckTracker.exe 4072 HearthstoneDeckTracker.exe 4072 HearthstoneDeckTracker.exe 4072 HearthstoneDeckTracker.exe 4072 HearthstoneDeckTracker.exe 4072 HearthstoneDeckTracker.exe 4072 HearthstoneDeckTracker.exe 4072 HearthstoneDeckTracker.exe 4072 HearthstoneDeckTracker.exe 4072 HearthstoneDeckTracker.exe 4072 HearthstoneDeckTracker.exe 4072 HearthstoneDeckTracker.exe 4072 HearthstoneDeckTracker.exe 4072 HearthstoneDeckTracker.exe 4072 HearthstoneDeckTracker.exe 4072 HearthstoneDeckTracker.exe 4072 HearthstoneDeckTracker.exe 4072 HearthstoneDeckTracker.exe 4072 HearthstoneDeckTracker.exe 4072 HearthstoneDeckTracker.exe 4072 HearthstoneDeckTracker.exe 4072 HearthstoneDeckTracker.exe 4072 HearthstoneDeckTracker.exe 4072 HearthstoneDeckTracker.exe 4072 HearthstoneDeckTracker.exe 4072 HearthstoneDeckTracker.exe 4072 HearthstoneDeckTracker.exe 4072 HearthstoneDeckTracker.exe 4072 HearthstoneDeckTracker.exe 4072 HearthstoneDeckTracker.exe 4072 HearthstoneDeckTracker.exe 4072 HearthstoneDeckTracker.exe 4072 HearthstoneDeckTracker.exe 4072 HearthstoneDeckTracker.exe 4072 HearthstoneDeckTracker.exe 4072 HearthstoneDeckTracker.exe 4072 HearthstoneDeckTracker.exe 4072 HearthstoneDeckTracker.exe 4072 HearthstoneDeckTracker.exe 4072 HearthstoneDeckTracker.exe 4072 HearthstoneDeckTracker.exe 4072 HearthstoneDeckTracker.exe 4072 HearthstoneDeckTracker.exe 4072 HearthstoneDeckTracker.exe 4072 HearthstoneDeckTracker.exe 4072 HearthstoneDeckTracker.exe 4072 HearthstoneDeckTracker.exe 4072 HearthstoneDeckTracker.exe 4072 HearthstoneDeckTracker.exe 4072 HearthstoneDeckTracker.exe 4072 HearthstoneDeckTracker.exe 4072 HearthstoneDeckTracker.exe 4072 HearthstoneDeckTracker.exe 4204 HearthstoneDeckTracker.exe 4204 HearthstoneDeckTracker.exe 4204 HearthstoneDeckTracker.exe 4204 HearthstoneDeckTracker.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\Hearthstone\client.config HearthstoneDeckTracker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HearthstoneDeckTracker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HDT-Installer (1).exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Update.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HearthstoneDeckTracker.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 1236 Update.exe 1236 Update.exe 4204 HearthstoneDeckTracker.exe 4204 HearthstoneDeckTracker.exe 4204 HearthstoneDeckTracker.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4072 HearthstoneDeckTracker.exe Token: SeDebugPrivilege 4204 HearthstoneDeckTracker.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1236 Update.exe 4204 HearthstoneDeckTracker.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 4204 HearthstoneDeckTracker.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4624 wrote to memory of 1236 4624 HDT-Installer (1).exe 86 PID 4624 wrote to memory of 1236 4624 HDT-Installer (1).exe 86 PID 4624 wrote to memory of 1236 4624 HDT-Installer (1).exe 86 PID 1236 wrote to memory of 4072 1236 Update.exe 91 PID 1236 wrote to memory of 4072 1236 Update.exe 91 PID 1236 wrote to memory of 4072 1236 Update.exe 91 PID 1236 wrote to memory of 4204 1236 Update.exe 93 PID 1236 wrote to memory of 4204 1236 Update.exe 93 PID 1236 wrote to memory of 4204 1236 Update.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\HDT-Installer (1).exe"C:\Users\Admin\AppData\Local\Temp\HDT-Installer (1).exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe"C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Users\Admin\AppData\Local\HearthstoneDeckTracker\app-1.31.5\HearthstoneDeckTracker.exe"C:\Users\Admin\AppData\Local\HearthstoneDeckTracker\app-1.31.5\HearthstoneDeckTracker.exe" --squirrel-install 1.31.53⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4072
-
-
C:\Users\Admin\AppData\Local\HearthstoneDeckTracker\app-1.31.5\HearthstoneDeckTracker.exe"C:\Users\Admin\AppData\Local\HearthstoneDeckTracker\app-1.31.5\HearthstoneDeckTracker.exe" --squirrel-firstrun3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4204
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
318KB
MD5e1f144b317a8895af833ba0295e421e4
SHA13cb4f1b0ba6264d5a4c30f550e3c2331fe8225c1
SHA2565b693e27a5d4c77df854cbe7ba9419c286016c772c926a7ee318d7e5c49f6333
SHA512f023435ee287b68d613b45d39d3516e48ad034f353d37e869dd423c578bee8b3238f6f11959b67af018c50fe07a6f33d0c1d3e17020d0a7c5cbc61f4d158f01c
-
Filesize
128KB
MD58e453b960f6f4642dfd9d59420c56fae
SHA1a8e2a090481dff367df1e79106af45ce40beba8a
SHA256e6525ce11ef6323034f29a07334520d8220ad943bf2313ea64ce3a0c1d19299b
SHA512e30e59d0538b2bbcebff5fb575cd95f4114cfe52a7236e5e3a71d8fe11dbf325113370b6190ced6b197f6bca58312f34f3d2acda2d29b6235743de7ec8e70157
-
Filesize
251KB
MD5fe66ca1b6bdf3f2e7baa4576e0097bac
SHA1a1f0ed3e1e8ad18ef72a0af66a6f3a2a576466fb
SHA256f85769a1d3481e5b913d48a58ad737fe68d164a86bef956dd567b9f9f2de5526
SHA512ec010fbeaa5cf09b42d5e5e9a602a51e22925fa7f86eabefdd9ecc8d12c357d9ef100ee27f937d9749de1a5df97c321b70d6a96cd2b4db52b034af9f3e62de6a
-
Filesize
64KB
MD551731162ab7d8f7a55e50b3be3b74340
SHA124a8e3a5caf74edd5ea8a7ad638a3eb06cd24af3
SHA256c91f696d096c06ae72ac429f47a9508fddcc1f4ce84486903b9d7a7f9a58540f
SHA512684122c2b067928f67bcc9433eaa960054766e1886dca3f478a3bed4dc9e3a8ce2931088cb239e26ab40c3e3ba9d10d779198a60e270d684ecd310c062273bea
-
Filesize
10.8MB
MD54ecd6bac2fca7ab49c6c3e06d75d9828
SHA1a0c6917e80815a6c7d9616d477c386d2663c2e69
SHA25660bdfcfd4df10f6eb06521be58afec2c5010e27512a4b95afac264f515e428d3
SHA512ba862d55ecc146294933a63c7694b317ce429afa4a5aa890a1eab41c512c86985a5c1ab5859266b6e3cb99a63928a32499b7e5dbdd26348217701740814d5f22
-
Filesize
808B
MD5488c707fd664052c4014f965f277adcd
SHA19290a6f1c34cde02abb16ac32db005708adc7b70
SHA256703b977a3f38dab4acad4e7d90c90f37e38a3df1d84e2aaaf39580f7fcf67aa2
SHA512b381e439666253521a1f2209dd6e473d98a3a07aa68d21c596a087a6bd6dfd9fffc773d1f6025349298e7c291cea97555959bd4d7a5159fa78173b179271bf45
-
Filesize
171KB
MD57f0f463ce244eaba7eed328cfb00f46d
SHA124ff2f00747c1465939a0c15cf3ea1e8706049f6
SHA2565d4988faf3c793055c09df30cdac6e495523185e1ff28ad971d0815b49aecf50
SHA5128076f263931e8fce9108d4dd16322670db275e0293f4b584d283adbb1443a881993f95a56d1e9eb7e704b2456866f2e55594e1783bff26ca7176c97dd519f661
-
Filesize
278KB
MD586a70ec53fb53ccc0202c874e17e37b3
SHA19f98bf62d43f4da885d797cfd4e6e85083087d55
SHA256dba2ec92dab4ebbeb7b9b0560d9fa8e7918768274ca69a978fe0f000c4cb200b
SHA512ab8aa7a5386e6ac8db6e369d807d826a225a1251e5ce20681d75f47be795934ceab45dff4fd826bb1da7f14621b9443dea20646704d7619d736f4cd4d5162219
-
Filesize
222KB
MD5806549245f29b4c9e17d39f2a3389920
SHA1d5c7c27b94255e782a7d2d79809c59b0da5b5199
SHA2566b070fea30f1643e2198046c78bca934484509c0c613229528bcd6e969d4488d
SHA512750593d0d89ee2c17d726e2403900c5f851cdebc4208fd1ddc7a1931010ab6757ff8c2304c35b8d9d326ad0ae5cdb1b54e28d876abfabfe555bf7206f468d7b7
-
Filesize
1.1MB
MD5b71d79c5cb4b633f69e687c15bda89ad
SHA1bff15df406d84a8172cc8d21f3ecc8a4aff90835
SHA2565d1b9be14ce752624a11bef4f3f0fb4f1535084dd9c026b645fb6bdc1c2f5944
SHA512b0c7db4833239c91be4c9ab2a05a3a0f62633df353c1ac9dbbc4bc92b0a371a4aa2ded8a367429b7e8418d0f27a7d87c3ddc10fb5d126fd831096c5db1095455
-
Filesize
683KB
MD56815034209687816d8cf401877ec8133
SHA11248142eb45eed3beb0d9a2d3b8bed5fe2569b10
SHA2567f912b28a07c226e0be3acfb2f57f050538aba0100fa1f0bf2c39f1a1f1da814
SHA5123398094ce429ab5dcdecf2ad04803230669bb4accaef7083992e9b87afac55841ba8def2a5168358bd17e60799e55d076b0e5ca44c86b9e6c91150d3dc37c721
-
Filesize
54KB
MD5c2a954108cf77846c125f7eb5d203d52
SHA1858df5849e30e836472b0fc73f437cbac2fa1163
SHA256d7ac1a5b38d99584412a94f51340d3c19aad8b171468cbc1e149b19937c5a646
SHA5122834c255097d2f5fe71a3e59ef37890392a898515f507d847a7d5912243db1e8918bc5302a504e5a3addf9f5a766eddae2ab5338086be6cdb90c549ea1a937b1
-
Filesize
243KB
MD54733660a78977fb9816b4cc593f23037
SHA18448faeae1d2bf66d4a007c0d955595924a758fa
SHA25638f1f4015d92a0d454ccd890ae93e50800e72bc933ea3a874365e1ec19788f00
SHA5125de59d02bb30e886e12628cacacf775f3844fde7f18159542371395340c939c68180fa0bbf7f9d5f76e612d5f17a3f61db4f0b316c0696c4399c520b5c7c57eb
-
Filesize
90KB
MD5e2b4b9d825487d65e6340d1b2cc81e27
SHA1818209e7f021015acdb7fd6b2a07414708abafb4
SHA256dd374aab7a7af65edb0c6dd73976892069259a2d9bd88b78c57d14b9a82af12d
SHA51285becf8f4273da2ddf3ee222449db7d00feffdb353e3e98ace4baa42e087f47a5a2640dd75a2f408bb7fd979b0b5c48f872dd076fdfaef8cf6ef7dd3ad903b68
-
Filesize
40KB
MD584178eeebf923d03e3e59013130b9ce8
SHA1e396c655dac7d9b462d80b68caf5c10506343e87
SHA2567b2948f947f601b11387e857a32711c06d880aca4be52938864d558da2082542
SHA5121be10101f76d33b1230b557adb6b81982b69f799be07f45b0a9430dd7310de7ebf69937a6768374047e74f5370687c8d3ee372cd6ff0cacf1f4d5b35c4a599dc
-
C:\Users\Admin\AppData\Local\HearthstoneDeckTracker\app-1.31.5\de-DE\HearthstoneDeckTracker.resources.dll
Filesize172KB
MD5dd84bb3e9cc561107be126e72e148a98
SHA11294049492122a42d4dcb965f8b03980fa1a361a
SHA256da43408e94ba994ef468b8bc116bb0fbbfc53a7deafffe1967728fe516d247a2
SHA51211a1ec3d91234123e5d902340d2ee3097d6bb56cfd191aaf940f3f5002ddbe994e54ab5d17e4ed22e2664d920daeb4dfb2ad40148016af83711dce2f7ba46761
-
C:\Users\Admin\AppData\Local\HearthstoneDeckTracker\app-1.31.5\es-ES\HearthstoneDeckTracker.resources.dll
Filesize172KB
MD5d2860d54adc1e7de64077ea380edfa5a
SHA1efc4b4942dc3352dec940d079ee052b96f8fda38
SHA256de9f96e758fd71913507d8918088969253cdbd973470f18b9ae35a663ee4c512
SHA51247c4399f474fb19a8dfa7464f8b248aa3aa0e28ca034b5ae122ca1b4bd011e13b88ab044f39a8ce438370568e2040707bce4aa4f5ed4eb8b47add2480d9f5975
-
C:\Users\Admin\AppData\Local\HearthstoneDeckTracker\app-1.31.5\es-MX\HearthstoneDeckTracker.resources.dll
Filesize172KB
MD5976c90872273c3529e05df286bf8a4e3
SHA1f01a9059b169441ca0b6a370be094a497b0817cb
SHA256e6ffca7c65d1ef25f3613738e3e9a6137166e6c74437fb3ff01fac5a3fc79482
SHA5123f7a1c4e5a84af982c0e4ec078e6f805cd0e8cadf4967a9e1b7751b07d3325e1981074f91adb025d461b2191262d08f71f64972a8e68c164c2d676ffc2d7e8d2
-
C:\Users\Admin\AppData\Local\HearthstoneDeckTracker\app-1.31.5\fr-FR\HearthstoneDeckTracker.resources.dll
Filesize177KB
MD5341820839d8a0475e166821048074f8c
SHA109ce3297090026fccd7a991a9304c59358e39fcd
SHA256d9aa7c62bf226bf6fa48b3cc17f69ccb15b5fd0c2bbb9cccfcecae859d24a484
SHA512ba3fc3481c81f2f2cc57269e62d68103da84d35eadeec9bcaa9ef3fed3105c2afa0a4815140fe4766091ff42b7264b71139dce63a8c379684e306dfb9b892c92
-
C:\Users\Admin\AppData\Local\HearthstoneDeckTracker\app-1.31.5\it-IT\HearthstoneDeckTracker.resources.dll
Filesize173KB
MD5610dff3268a0c700d58a3b30c1c49187
SHA1e3f90a5e100350efaa896be089704c8c7e89147e
SHA25661383e0858b8b3a04a5def0612cb52cf307cad5a4ffd8f0bd3e1bc28ba58016a
SHA512df3a4361bb6ad06b070cc7e46f18021263a1664641d5607cd010de392925bcdc0539d0bd7cfb39a9200b293f7645b89ce4933fc0cda8b5cbb9fad611e64c6e4e
-
C:\Users\Admin\AppData\Local\HearthstoneDeckTracker\app-1.31.5\ja-JP\HearthstoneDeckTracker.resources.dll
Filesize179KB
MD5fa7ec9d18386067bec997da1611732bb
SHA1d5004cc15fed00badd115bec2e4fcafc21369565
SHA256b49d22f676cfde9d15a06cc9310d7c999cfe28517500e1e4b4e5317787779c55
SHA512aca38e64a2eaccf35b112ca695adae0ba518213285b0d83ce10c59dd1132290817ecb53e233690c83a28435bc1407cb1c4aab5be982dbbeaca4c12039c1a464f
-
Filesize
94B
MD52cc2c4bd55d1820042406bfa1d1c7105
SHA15a00372c876c27d4b9a14fc0c903f9d0208734df
SHA25612064235c8d85f468fb3321f6aeef84c843972ac5e85cdb599dd184bde68791a
SHA5125d99400b61555d8994cc8ebf02308643efc78bdb8f884a6c8a22a47c8ea49e563596be006914b4d88040c882f6c656188780665e589ead1f4b081c9187e8ffc0
-
Filesize
1.8MB
MD59e2f80d48052976c0bb8a15e9567bad8
SHA103cea10cbe15ffe7be9c7111c491b0be7d8e7f0e
SHA25629acc298ffe9cd705f48c187551ee02960bc4a1853b8c07d83ac443b09eb8a8c
SHA512e8ca616528497ff3c8eb8fa4d7a04477b9b5c1c3872574f835fe411dc922bdbbbedfcd9756da2687deb16c7d20e2f790db0e9f3b584d53fd5a66e347cb3d3283
-
Filesize
264B
MD59e9b30c803b020d10ba89d87f611ac10
SHA1570473f9d6199dc728263f5f448b34ef9dafe03f
SHA256a610ec69c77df45e9a856facd30e7d9b0af0a02be5f29f134415fff3887e1a0d
SHA512d5ae0c412a9eb42b544d680fa54729a04d40c355aa2de1a7abe97074e79311a8e856a62a5089df0756b37a81ee1785fe2d3f736e2ea59386b90e8f4128ffb0f4
-
Filesize
264B
MD5afef6f2af3d256e9e13f8c671dbb80aa
SHA1b823e927af6c222cacf1603a2f0b28bed0cd356c
SHA256869a667e8cac286db614e39ea0e9f4015d834518d6cdc1effbc8c2afc972b8d0
SHA5121c4ed84144bdd94359799205edb5e6adecdc3f360807f3a62e4eef20ef3acca63a848e6fddd2dcf360bd3fd69688d1e855de68b550e87da5f53a9c686129c9bd
-
Filesize
20KB
MD520982096dd16909138a1125cc4091fa0
SHA1d20f68ee4a518463ad1bfe94dbde7d6565242fe0
SHA2562f4317242d6baf5d11ff50efb69f1f7467277378587f082613bd721d1108c5b7
SHA512a73fdaa9d4e055ddd15a6fded53f0fc7f92ebf3e531ca6cd24b5d62ceadc86c642616bbf883988b0db1b9bfef8e26c7a1648f9d8f12e1a77a892b66cc8ebf160