Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

HyperPlay-...1).exe

windows7-x64

4

HyperPlay-...1).exe

windows10-2004-x64

$PLUGINSDI...ls.dll

windows7-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDIR/UAC.dll

windows7-x64

3

$PLUGINSDIR/UAC.dll

windows10-2004-x64

3

$PLUGINSDI...ll.dll

windows7-x64

3

$PLUGINSDI...ll.dll

windows10-2004-x64

3

HyperPlay.exe

windows7-x64

1

HyperPlay.exe

windows10-2004-x64

7

LICENSES.c...m.html

windows7-x64

3

LICENSES.c...m.html

windows10-2004-x64

3

d3dcompiler_47.dll

windows10-2004-x64

1

ffmpeg.dll

windows7-x64

1

ffmpeg.dll

windows10-2004-x64

1

libEGL.dll

windows7-x64

1

libEGL.dll

windows10-2004-x64

1

libGLESv2.dll

windows7-x64

1

libGLESv2.dll

windows10-2004-x64

1

resources/...dl.exe

windows7-x64

7

resources/...dl.exe

windows10-2004-x64

7

resources/...ry.exe

windows7-x64

7

resources/...ry.exe

windows10-2004-x64

7

resources/...d-0.js

windows7-x64

3

resources/...d-0.js

windows10-2004-x64

3

resources/...d-1.js

windows7-x64

3

resources/...d-1.js

windows10-2004-x64

3

resources/...d-2.js

windows7-x64

3

resources/...d-2.js

windows10-2004-x64

3

resources/...d-3.js

windows7-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    HyperPlay-0.18.1-Setup-x64 (1).exe

  • Size

    209.6MB

  • Sample

    240901-xet7kszblc

  • MD5

    0aedd3e2bfbd09de2dbf74b8223bf1b8

  • SHA1

    890c080ca8b30a163ba5d8a10411902a3e071059

  • SHA256

    37da8f62f82912d2aaf872a4612aece68ed4989e2aaf3d41fd9554042806c3fa

  • SHA512

    57ba361042542e4f89665d1453748e67d270286a6b6ec4bae9dc78235ea52116e37036542e5c46cab787588b5e0bdb189862a7e2a9c3c45c89ee7e322d73f539

  • SSDEEP

    6291456:x4DYSTUt/DCCiZk8arDt46gMn/EbLFw1JsRVYyCvH2OPdLN9HuiB7:x4DYB/GTgr3ln404VbzOPdXl

Score
7/10
discoveryexecutionpersistencepyinstaller

Malware Config

Targets

    • Target

      HyperPlay-0.18.1-Setup-x64 (1).exe

    • Size

      209.6MB

    • MD5

      0aedd3e2bfbd09de2dbf74b8223bf1b8

    • SHA1

      890c080ca8b30a163ba5d8a10411902a3e071059

    • SHA256

      37da8f62f82912d2aaf872a4612aece68ed4989e2aaf3d41fd9554042806c3fa

    • SHA512

      57ba361042542e4f89665d1453748e67d270286a6b6ec4bae9dc78235ea52116e37036542e5c46cab787588b5e0bdb189862a7e2a9c3c45c89ee7e322d73f539

    • SSDEEP

      6291456:x4DYSTUt/DCCiZk8arDt46gMn/EbLFw1JsRVYyCvH2OPdLN9HuiB7:x4DYB/GTgr3ln404VbzOPdXl

    Score
    4/10
    discovery
    behavioral1behavioral2

    • Target

      $PLUGINSDIR/StdUtils.dll

    • Size

      100KB

    • MD5

      c6a6e03f77c313b267498515488c5740

    • SHA1

      3d49fc2784b9450962ed6b82b46e9c3c957d7c15

    • SHA256

      b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

    • SHA512

      9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

    • SSDEEP

      3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      0d7ad4f45dc6f5aa87f606d0331c6901

    • SHA1

      48df0911f0484cbe2a8cdd5362140b63c41ee457

    • SHA256

      3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

    • SHA512

      c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

    • SSDEEP

      192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6

    Score
    3/10
    discovery
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/UAC.dll

    • Size

      14KB

    • MD5

      adb29e6b186daa765dc750128649b63d

    • SHA1

      160cbdc4cb0ac2c142d361df138c537aa7e708c9

    • SHA256

      2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

    • SHA512

      b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

    • SSDEEP

      192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs

    Score
    3/10
    discovery
    behavioral7behavioral8

    • Target

      $PLUGINSDIR/WinShell.dll

    • Size

      3KB

    • MD5

      1cc7c37b7e0c8cd8bf04b6cc283e1e56

    • SHA1

      0b9519763be6625bd5abce175dcc59c96d100d4c

    • SHA256

      9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

    • SHA512

      7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

    Score
    3/10
    discovery
    behavioral10behavioral9

    • Target

      HyperPlay.exe

    • Size

      168.8MB

    • MD5

      7f68dac78f6bfbb2893da60aad2ef98c

    • SHA1

      31088dc58048fe4e70072bb911d66fa121f17d77

    • SHA256

      0c8f4d1ba92a3be47722f6a034172d94a7a2bde4b0d358f727ac7a1c54d0c99a

    • SHA512

      2fbd5bcad976953f41b334462b6b48dd134ce8661d85d5235441c655fc23fb784d35b647eba8c36366acede3c7270ab3fe8d3c1b0694712cd5359d7719f44317

    • SSDEEP

      1572864:OkRc66Zgfa+fqa1q3kA9QPB64Cgc/NCaRyenmfgs4tNHTalbUu0OVRfmPQ1YAxLU:bEjmlcdwxLb

    Score
    7/10
    executionpersistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Command and Scripting Interpreter: PowerShell

      Start PowerShell.

      execution

    • Drops file in System32 directory

    behavioral11behavioral12

    • Target

      LICENSES.chromium.html

    • Size

      8.7MB

    • MD5

      1ca87d8ee3ce9e9682547c4d9c9cb581

    • SHA1

      d25b5b82c0b225719cc4ee318f776169b7f9af7a

    • SHA256

      000ae5775ffa701d57afe7ac3831b76799e8250a2d0c328d1785cba935aab38d

    • SHA512

      ec07b958b4122f0776a6bded741df43f87ba0503b6a3b9cc9cbe6188756dcde740122314e0578175123aaa61381809b382e7e676815c20c3e671a098f0f39810

    • SSDEEP

      24576:ZQQa6Ne6P5d2WSmwRFXe1vmfpV6k626D6b62vSuSpZ:ZMfTVQ

    Score
    3/10
    discovery
    behavioral13behavioral14

    • Target

      d3dcompiler_47.dll

    • Size

      4.7MB

    • MD5

      2191e768cc2e19009dad20dc999135a3

    • SHA1

      f49a46ba0e954e657aaed1c9019a53d194272b6a

    • SHA256

      7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d

    • SHA512

      5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970

    • SSDEEP

      49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l

    Score
    1/10
    behavioral15

    • Target

      ffmpeg.dll

    • Size

      2.7MB

    • MD5

      8e8876d5b06efb9f215bcb5ecbbb824d

    • SHA1

      62fdf0d96afcabb325d73e095516a3691b0a9331

    • SHA256

      47550d844e29763ca9ea5cc640c08e34df5faa34f9db769553f19cb594e9313f

    • SHA512

      73bac4053af647ef3565e8e4cfea7e697b3e0e6f473ad5ac57bfc5f5ae97e0981ba77be572de6d3490e6bdf4e801610cda9608e2071747a35ad8e3d3f5c38f6f

    • SSDEEP

      49152:UPDtyvMYqXiOaeQ3NZ+GEMDbG7m8x7n6mfu/oBLpweNsgMzqvUQn7xN:uSOONYbQG7m8bdazlQn7r

    Score
    1/10
    behavioral16behavioral17

    • Target

      libEGL.dll

    • Size

      467KB

    • MD5

      b9b56171c025964b3990fe2ee92517e8

    • SHA1

      ac4b5b34f3ad87f761f3c8d84df80715e80e1729

    • SHA256

      12d4511bb49aa9fd483d85df8a27f67f259a797f850fd97743a0bc3052343cf0

    • SHA512

      067f4e4e8ebd4ca7e14cd2d6c5b16a9b2eeab95897eba990bfed22c8db4323b24f29e64101385b05fcda3ede3d9b71726fd752420ba0c48494881f2a6bffea24

    • SSDEEP

      6144:8uF2Dw0NiKxN6YTfDVTCanVJhPadWQo+5ehJp/Ej4:T0iKbbTfDVJ2dWQo+5enp/EU

    Score
    1/10
    behavioral18behavioral19

    • Target

      libGLESv2.dll

    • Size

      7.4MB

    • MD5

      52fc213445b21a09ec09885d44a08411

    • SHA1

      bdb52916eecde32fd856ff9ec751ac41baa1f879

    • SHA256

      2c75c1206b4e7ec81622ecbeba45f591566b53b5f31ad97a3c1882958c2ae758

    • SHA512

      c27133aa3455444c008a3aab24e636116010f9d2adb0f6e9b6ced99ab58ea3d1559792a3c0af2667eeaed7e5f7a66c2bc0480c00d140383ce56c4345d18efc18

    • SSDEEP

      98304:9oM1bKXyhXV3XI9f1OW7BheoI1Ty6sDCpsXm3T:9b1TlXIH77iTHWCT

    Score
    1/10
    behavioral20behavioral21

    • Target

      resources/app.asar.unpacked/build/bin/win32/gogdl.exe

    • Size

      7.4MB

    • MD5

      4b18ed58b1a8c953f8a08a68a58b9a10

    • SHA1

      af85cfbcb655e491a31f2a8aa88b47224fa5d3f4

    • SHA256

      dcbfe8a0d102181c928fab9dadba0fd0b4f1a42d9ebaffe5520cbc84ed5d9c10

    • SHA512

      58b7b0e39c1446340b0c68db55f81da53c110883504b036ee30955ece637673e65d121c9dc201c8893217836ca7454171ccfd1f12ebd6fb34e83bcba3e163f64

    • SSDEEP

      196608:Hfp5vYL2Vmd6+DUrLZy7YM30Lzajwrp9/CNFWCV:fvYL2Vmd6mM0Gzajwr3y

    Score
    7/10

    • Loads dropped DLL

    behavioral22behavioral23

    • Target

      resources/app.asar.unpacked/build/bin/win32/legendary.exe

    • Size

      8.0MB

    • MD5

      b1a5b3b4e07abfc2ee05060f22c1f5ce

    • SHA1

      20742af782f46c7ac1fd8ae082e2f6df118245bd

    • SHA256

      a9e49373c3e683bb6250fa3edb5c40f7d855799d4bdadc8bfeceebffda13e5f7

    • SHA512

      0de6522cc0b069c58334e52f768a6089c058bd0b53859262b0067292cba001e62b4b1d6832e71047fa5d71e5437463d4f33f41001619546106a4f0fbbf92b545

    • SSDEEP

      196608:2UQaoaQQ8Sf/MnfICteEroXx7IP0oTcMsABqlofymn1lGT06y3R:DQaoaQQd/gfInEroXOMogFABqS/14T0r

    Score
    7/10

    • Loads dropped DLL

    behavioral24behavioral25

    • Target

      resources/app.asar.unpacked/build/extensions/MetaMask_v10.22.2/background-0.js

    • Size

      606KB

    • MD5

      79b03ce731fa59bf20d64121ba4d6eec

    • SHA1

      9d0c5d9021155c5ef1cc5c5d60158c73361722ea

    • SHA256

      e7ce0c9222a18b73908c198f3025dd350a010cbb1f251d49eba2d0e946ab2cd2

    • SHA512

      87713ffc5a0faa0fb563600730c6e213107a83ab07e1fe0fdb5b36b3f60974266a1be745b6edc4e6b6a132788d30f32f22e8aeaff58c2f63ca7b8b601ad4d278

    • SSDEEP

      6144:pKlpOEIlYakM2wvaCmKCbOx8h2YYhFCtL2mcHdqCiySEYLyKFZwh8MUgfBTVYl1m:Ylp9E2so2YYZuBY

    Score
    3/10
    execution
    behavioral26behavioral27

    • Target

      resources/app.asar.unpacked/build/extensions/MetaMask_v10.22.2/background-1.js

    • Size

      580KB

    • MD5

      8a8dc0241694faea072c4a69620de4a9

    • SHA1

      774840b50cc71a7b6833638777a82a351386f392

    • SHA256

      2b6c3f770ad1721c7d287f1b94d0f93f38b4c940086d0d965bf97a7e8c120110

    • SHA512

      feb7966644584c003b48d115e1a33f4f25d0287d5dcccbe3d298be86fe31bfb7bf2dd685f0b9a69697a233d29700e70600798ea1008fe53ea1663bc9f4e48ca8

    • SSDEEP

      12288:ZS6g/tuWyFGVgTRcY/9KeOKnCZ5W4GfTX+pQK/z1:o6sPeOKnCZwZU

    Score
    3/10
    execution
    behavioral28behavioral29

    • Target

      resources/app.asar.unpacked/build/extensions/MetaMask_v10.22.2/background-2.js

    • Size

      606KB

    • MD5

      2c5889ae83bacc9e4c6aa280d2c2de49

    • SHA1

      1df0c574aef76a14fcb25e1fe0fbf53e7c43ccfd

    • SHA256

      101255dd5d56875c7877a1f0e5c625538f8d378718e826fcf08f804f9ce663f0

    • SHA512

      04fa16e822679047823dacbe22b8842858474e75a4d8b3b33603eaf3274fa282aff1730b45a5059f9bb4079f2b57830514fafe7ea93692aa824936d54674da11

    • SSDEEP

      6144:FXIwZpxsrvgBsRo2PyrdkoILUzxHJUdbSi7blQw9HWMhzliHEiyeT353nH:RI4kMxQoAs6ThWM9liHEiyeh

    Score
    3/10
    execution
    behavioral30behavioral31

    • Target

      resources/app.asar.unpacked/build/extensions/MetaMask_v10.22.2/background-3.js

    • Size

      616KB

    • MD5

      e20b069d6db74ecfa39d754e24e99817

    • SHA1

      42bfb8c344fc055b32216c8599643640ba05e6ae

    • SHA256

      d6a7a15f9f3503c538cd04a8319537f07454b7b6c7dfb4b46c518ac29b67af19

    • SHA512

      07567c5c4c72a0da47298a55f78308db9bab414fc7f659298eaf57ca98dc6c3b71a79f5b410b3cc2418c70703ae40f1693952965d5380a67b33999c987a3ba52

    • SSDEEP

      6144:cvgRxuWw1v3fiHNrhmcuVLay8PSVxRpo/Nst/BiTi2D3J5LUs:bw3fiHN1ilaRgRpo/Nst/0TTDjUs

    Score
    3/10
    execution
    behavioral32

MITRE ATT&CK Enterprise v15

Tasks

static1

pyinstaller
Score
3/10

behavioral1

discovery
Score
4/10

behavioral2

discovery
Score
4/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
3/10

behavioral11

Score
1/10

behavioral12

executionpersistence
Score
7/10

behavioral13

discovery
Score
3/10

behavioral14

discovery
Score
3/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
7/10

behavioral23

Score
7/10

behavioral24

Score
7/10

behavioral25

Score
7/10

behavioral26

execution
Score
3/10

behavioral27

execution
Score
3/10

behavioral28

execution
Score
3/10

behavioral29

execution
Score
3/10

behavioral30

execution
Score
3/10

behavioral31

execution
Score
3/10

behavioral32

execution
Score
3/10