Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
16s -
max time network
14s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04/09/2024, 19:45
Static task
static1
Behavioral task
behavioral1
Sample
Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe
Resource
win10v2004-20240802-en
General
-
Target
Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe
-
Size
11.1MB
-
MD5
e15049206aee7b9d8742743290680f55
-
SHA1
d33895ec697909ddcfe779750024b7b22001322e
-
SHA256
5e4ad99f47e21b581accafb89835a19e905b78924fcabf347cd643772f1a17ba
-
SHA512
0f013733280b14382676b12d9779ac76e7791b8d20b1482e7beea8917b077f720974023eee7eb535a80d36467a8bef4bd38bbc12966b17db7884cce14c69be2d
-
SSDEEP
196608:c5mlDQxYNXVM3SnSTsrUoQIxbD/WdD92A25KGNNpHCh1fRoh/OkHRVEXI+62:ZlkxYNlM3SnSTK/WdD92A251Nt4Roh/C
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 5108 Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe 2408 Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe -
Loads dropped DLL 3 IoCs
pid Process 2408 Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe 2408 Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe 2408 Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe -
Drops file in System32 directory 42 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\msvcrt.dll Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe File opened for modification C:\Windows\SysWOW64\sechost.dll Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe File opened for modification C:\Windows\SysWOW64\shell32.dll Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe File opened for modification C:\Windows\SysWOW64\SHLWAPI.dll Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe File opened for modification C:\Windows\SysWOW64\imm32.dll Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe File opened for modification C:\Windows\SysWOW64\msimg32.dll Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe File opened for modification C:\Windows\SysWOW64\clbcatq.dll Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe File opened for modification C:\Windows\SysWOW64\msvcp_win.dll Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe File opened for modification C:\Windows\SysWOW64\shcore.dll Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe File opened for modification C:\Windows\SysWOW64\imagehlp.dll Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe File opened for modification C:\Windows\SysWOW64\GLU32.dll Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe File opened for modification C:\Windows\SysWOW64\combase.dll Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe File opened for modification C:\Windows\SysWOW64\version.dll Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe File opened for modification C:\Windows\SysWOW64\wsock32.dll Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe File opened for modification C:\Windows\SysWOW64\windows.storage.dll Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe File opened for modification C:\Windows\SysWOW64\user32.dll Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe File opened for modification C:\Windows\SysWOW64\ucrtbase.dll Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe File opened for modification C:\Windows\SysWOW64\win32u.dll Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe File opened for modification C:\Windows\SysWOW64\ole32.dll Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe File opened for modification C:\Windows\SysWOW64\explorerframe.dll Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe File opened for modification C:\Windows\SysWOW64\shfolder.dll Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe File opened for modification C:\Windows\SysWOW64\profapi.dll Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe File opened for modification C:\Windows\SysWOW64\MSCTF.dll Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe File opened for modification C:\Windows\SysWOW64\ntdll.dll Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe File opened for modification C:\Windows\SysWOW64\opengl32.dll Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe File opened for modification C:\Windows\SysWOW64\bcryptPrimitives.dll Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe File opened for modification C:\Windows\SysWOW64\psapi.dll Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe File opened for modification C:\Windows\SysWOW64\RPCRT4.dll Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe File opened for modification C:\Windows\SysWOW64\comdlg32.dll Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe File opened for modification C:\Windows\SysWOW64\ws2_32.dll Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe File opened for modification C:\Windows\SysWOW64\hhctrl.ocx Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe File opened for modification C:\Windows\SysWOW64\uxtheme.dll Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe File opened for modification C:\Windows\SysWOW64\Wldp.dll Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe File opened for modification C:\Windows\SysWOW64\PROPSYS.dll Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe File opened for modification C:\Windows\SysWOW64\advapi32.dll Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe File opened for modification C:\Windows\SysWOW64\KERNELBASE.dll Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe File opened for modification C:\Windows\SysWOW64\gdi32full.dll Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe File opened for modification C:\Windows\SysWOW64\kernel.appcore.dll Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe File opened for modification C:\Windows\SysWOW64\KERNEL32.DLL Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe File opened for modification C:\Windows\SysWOW64\GDI32.dll Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe File opened for modification C:\Windows\SysWOW64\wininet.dll Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe File opened for modification C:\Windows\SysWOW64\oleaut32.dll Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_a8625c1886757984\comctl32.dll Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 2408 Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe 2408 Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe 2408 Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe 2408 Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe 2408 Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe 2408 Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe 2408 Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe 2408 Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe 2408 Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe 2408 Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe 2408 Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe 2408 Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe 2408 Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe 2408 Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe 2408 Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe 2408 Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe -
Suspicious use of AdjustPrivilegeToken 17 IoCs
description pid Process Token: SeDebugPrivilege 2408 Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe Token: SeTcbPrivilege 2408 Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe Token: SeTcbPrivilege 2408 Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe Token: SeLoadDriverPrivilege 2408 Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe Token: SeCreateGlobalPrivilege 2408 Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe Token: 33 2408 Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe Token: SeSecurityPrivilege 2408 Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe Token: SeTakeOwnershipPrivilege 2408 Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe Token: SeManageVolumePrivilege 2408 Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe Token: SeBackupPrivilege 2408 Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe Token: SeCreatePagefilePrivilege 2408 Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe Token: SeShutdownPrivilege 2408 Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe Token: SeRestorePrivilege 2408 Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe Token: 33 2408 Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe Token: SeIncBasePriorityPrivilege 2408 Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe Token: 33 4624 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 4624 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2408 Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1208 wrote to memory of 5108 1208 Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe 86 PID 1208 wrote to memory of 5108 1208 Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe 86 PID 1208 wrote to memory of 5108 1208 Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe 86 PID 5108 wrote to memory of 2408 5108 Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe 88 PID 5108 wrote to memory of 2408 5108 Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe 88 PID 5108 wrote to memory of 2408 5108 Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe"C:\Users\Admin\AppData\Local\Temp\Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\cetrainers\CETD755.tmp\Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe"C:\Users\Admin\AppData\Local\Temp\cetrainers\CETD755.tmp\Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe" -ORIGIN:"C:\Users\Admin\AppData\Local\Temp\"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\cetrainers\CETD755.tmp\extracted\Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe"C:\Users\Admin\AppData\Local\Temp\cetrainers\CETD755.tmp\extracted\Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe" "C:\Users\Admin\AppData\Local\Temp\cetrainers\CETD755.tmp\extracted\CET_TRAINER.CETRAINER" "-ORIGIN:C:\Users\Admin\AppData\Local\Temp\"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2408
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x40c 0x4041⤵
- Suspicious use of AdjustPrivilegeToken
PID:4624
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10.8MB
MD50f44b0b58a256744336e9fa164db348f
SHA13cdfbde28e8556537e74d50e05f19ae441e6bbda
SHA256049e33944ae998791d8507ca2ca941ea3378697efec0d93ec50b3babb24054eb
SHA512dfa6cda714eff62d6043b91f86757ca6722e9c5eb1768e895bf7ea3e04b95775a5a63711142005f38fbb081af4a6e19e34531789e6914ed9c244bea914d0b616
-
C:\Users\Admin\AppData\Local\Temp\cetrainers\CETD755.tmp\Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe
Filesize189KB
MD5a65c29111a4cf5a7fdd5a9d79f77bcab
SHA1c0c59b1f792c975558c33a3b7cf0d94adc636660
SHA256dab3003436b6861ae220cc5fdcb97970fc05afdf114c2f91e46eed627ce3d6af
SHA512b37ef3351e8f46f7183550254acce99b54e0199fc37a02cca78b471dc2d8b697769afdaf7e6cfe89422cfed65a8dcc6d158ef52aba5b0ac9350ea05607fefd7f
-
Filesize
721KB
MD553d372ffd8b77d1f2d3c367208f29f07
SHA1ce05c99f43353e8eb2f7016fdf55e947e2da8b37
SHA256f4fde1d08dd6212ab2fcd71be96ce07cd60e18059aef4c2c94fd6cec2b746edf
SHA5122d0f5da710f266a72e01bda9e4def9629ea63ba0f5ba4149f93b9bd0db1149ba9b66337f531180f51608a922ca521f1ddad5a72f9971c07d8ffb4f890be3399f
-
C:\Users\Admin\AppData\Local\Temp\cetrainers\CETD755.tmp\extracted\Prince of Persia Warrior Within V GOG Plus 4 Trainer.exe
Filesize8.2MB
MD5caa9d29f5b5751a94a179328aaf7cc6f
SHA1698714c6cf34f5bc0b4372b6c88100c2ec9b5ff5
SHA25676892d1a377bf7a010d77e3c7b26e42369ba12ad066c3db71f05e361343e9aed
SHA5120a0360b737ea02d11bef8e8d65048b28730164c6db5567651e81586e4822faee72a0d3eee7146570fa2687627e524c54c1ade37d019a465112f428c0d6130e56
-
Filesize
6KB
MD5af18263191d6f3fe55af8bd455a947bd
SHA18cc06df49983bc95e71c678de9742eb5b0debbf2
SHA256a71d5867a2c1a25dfe7649549449024128dd5540a492da76856e150fdbe07feb
SHA512c55989158819d4bd7d17985508ffd7731c366ca1c79506c03a78d7e580f32aaa4d8cf4cf5e68bdf706df70780d25c0ab0a935be9d0c8d5bbeed9563dfb12f254
-
Filesize
289KB
MD5dacd337030c240f324a3d655ecd876e2
SHA1d108dcbd13ca07265085278c61d8a9f751a4905e
SHA256041427d5ae979b938fc2771bf3ae6e2b0cf6a669fc881b44be1586e46225532b
SHA51283f0343479ea0f92fa48264b70efbdafa5d54f3bce5e0b8be523cdf528eb7891754208e48e7f14df554c2832cf9758377542f9df0eba8c441ccb8cacbfbab08f
-
Filesize
480KB
MD59b8d650ffc6fff2cfe67a7e5c020ccfb
SHA1eaadc93c8e1af00cf01bf5fd8fb8d2792649d8b8
SHA25659b9f3fa57c1b7fdd3312f864c20eaee76ba9fcb7bb8d2542060d3533ced12c2
SHA512606818e23f7d214240e8724b55af72147b4ebb3ad1d1f036d33c4690e7f279ea1768a1db595ac06f3c4b348348fc61f546fda673359cdd4b762bce2de2b85e61
-
Filesize
1.2MB
MD59139604740814e53298a5e8428ba29d7
SHA1c7bf8947e9276a311c4807ea4a57b504f95703c9
SHA256150782fca5e188762a41603e2d5c7aad6b6419926bcadf350ebf84328e50948f
SHA5120b99259e9c0ee566d55cc53c4a7eabf025ed95973edc80ded594023a33f8273cd5d3f3053993f771f9db8a9d234e988cba73845c19ddc6e629e15a243c54cd5d