Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3Dhl package - pdf.exe
windows7-x64
10Dhl package - pdf.exe
windows10-2004-x64
10$APPDATA/2...60.dll
windows7-x64
1$APPDATA/2...60.dll
windows10-2004-x64
1$APPDATA/2...pd.dll
windows7-x64
1$APPDATA/2...pd.dll
windows10-2004-x64
1$APPDATA/e...60.dll
windows7-x64
1$APPDATA/e...60.dll
windows10-2004-x64
1$APPDATA/e...PS.dll
windows7-x64
1$APPDATA/e...PS.dll
windows10-2004-x64
1$APPDATA/e...60.dll
windows7-x64
1$APPDATA/e...60.dll
windows10-2004-x64
1$APPDATA/e...ap.dll
windows7-x64
3$APPDATA/e...ap.dll
windows10-2004-x64
3$APPDATA/e...nv.exe
windows7-x64
$APPDATA/e...nv.exe
windows10-2004-x64
$APPDATA/e...en.exe
windows7-x64
$APPDATA/e...en.exe
windows10-2004-x64
$APPDATA/e...de.dll
windows7-x64
3$APPDATA/e...de.dll
windows10-2004-x64
3$APPDATA/e...ui.dll
windows7-x64
1$APPDATA/e...ui.dll
windows10-2004-x64
1$APPDATA/e...ui.dll
windows7-x64
1$APPDATA/e...ui.dll
windows10-2004-x64
1$APPDATA/t...DC.dll
windows7-x64
3$APPDATA/t...DC.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$TEMP/Cons...ry.dll
windows7-x64
3$TEMP/Cons...ry.dll
windows10-2004-x64
10Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
17/09/2024, 02:43
Static task
static1
Behavioral task
behavioral1
Sample
Dhl package - pdf.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
Dhl package - pdf.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$APPDATA/25/66.opends60.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$APPDATA/25/66.opends60.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$APPDATA/25/vcompd.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$APPDATA/25/vcompd.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
$APPDATA/emergency/diffs/1.opends60.dll
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
$APPDATA/emergency/diffs/1.opends60.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
$APPDATA/emergency/diffs/3.COMServerPS.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
$APPDATA/emergency/diffs/3.COMServerPS.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
$APPDATA/emergency/diffs/5.opends60.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
$APPDATA/emergency/diffs/5.opends60.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
$APPDATA/emergency/diffs/ActiveSyncBootstrap.dll
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
$APPDATA/emergency/diffs/ActiveSyncBootstrap.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
$APPDATA/emergency/diffs/devenv.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
$APPDATA/emergency/diffs/devenv.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
$APPDATA/emergency/diffs/guidgen.exe
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
$APPDATA/emergency/diffs/guidgen.exe
Resource
win10v2004-20240910-en
Behavioral task
behavioral19
Sample
$APPDATA/emergency/diffs/metade.dll
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
$APPDATA/emergency/diffs/metade.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
$APPDATA/emergency/diffs/msdnmui.dll
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
$APPDATA/emergency/diffs/msdnmui.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
$APPDATA/emergency/diffs/vcdeployui.dll
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
$APPDATA/emergency/diffs/vcdeployui.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
$APPDATA/toplist/mode/wbemDC.dll
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
$APPDATA/toplist/mode/wbemDC.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240704-en
Behavioral task
behavioral28
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
$TEMP/Conservatory.dll
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
$TEMP/Conservatory.dll
Resource
win10v2004-20240802-en
General
-
Target
$TEMP/Conservatory.dll
-
Size
43KB
-
MD5
255c2887e6b5f9756a9a473952e0807a
-
SHA1
b13718feb8e932e6a59d76a9984fa043d6f7826b
-
SHA256
0a5e2d346b9e7296275bf79fbda56cfc21a8af540b836dba04df1b6270bfe2c3
-
SHA512
e45ee410d61639ea098c9d8f831126d62cb67144834e6da6bab5c929cc8fe7a92493ef8a0c83c73b19942540318598987214c6b3377d6959425a91d269527823
-
SSDEEP
768:GTLZ/ZYB0KBLqpnn9rhwmmnTEDi4hvyPTsU9MBacUlT:GTt/ZQ0EM99MJbdMUcUlT
Malware Config
Extracted
formbook
4.1
c232
tangdourenfz.com
helpforkids.today
bioethanol-us.com
0351zc.com
3rdimultimedia.com
thecannibisconnection.net
mktoob.net
orchidinvestmentlimited.com
moccustoms.com
shopendora.com
rosariosandino.com
bien-vivre-tunisie.com
godofgreens.com
nhathuocphuongle.com
thefastsource.com
viagra2tadalafil.com
abarroteslacanasta.com
versabiosciences.com
nergiztarimhayvancilik.com
airpodsbayi.com
fitnessdan.com
passionunipessoal.com
spl.energy
review-id9326.com
studystudy.xyz
syringacio.com
beensentoe.com
pasforon.com
omegagyn.com
yourmassagewellness.com
develop-er.com
biosqualene.com
smartlocalizer.com
impotsgovparticulier.digital
primponabarbie.world
energy-x.site
tatlerstyle.com
shucaiw.pro
kita-minimum.com
nirvanatopshelf.com
thefrontrangedeals.com
cbaenterpriseaccount.com
antalyadissagligi.com
drivewalkbike.com
learn2pop.com
suzhoukelida.com
alloutthere.com
cle-ar.com
ditaaulia.online
solarpowermate.com
amazon-account-service-webs.com
7jonquilcourt.com
beautyart-marrakech.com
asaany.com
barinetportal.com
benbernardfilms.com
mousepays.com
insidethelooppodcast.com
seatedworkouts.com
ketch-mania.com
qingfuhall.com
euphoricempress.com
veomtreadmillexpert.com
bigboltbooks.com
dokap.xyz
Signatures
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Formbook payload 2 IoCs
resource yara_rule behavioral32/memory/4756-6-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral32/memory/4756-9-0x0000000000400000-0x000000000042E000-memory.dmp formbook -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ZHD0KZIXN6 = "C:\\Program Files (x86)\\Sg6qlqp\\ov185jg.exe" raserver.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4756 set thread context of 3440 4756 cmd.exe 56 PID 5004 set thread context of 3440 5004 raserver.exe 56 -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Sg6qlqp\ov185jg.exe raserver.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language raserver.exe -
description ioc Process Key created \Registry\User\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 raserver.exe -
Suspicious behavior: EnumeratesProcesses 51 IoCs
pid Process 4004 rundll32.exe 4756 cmd.exe 4756 cmd.exe 4756 cmd.exe 4756 cmd.exe 5004 raserver.exe 5004 raserver.exe 5004 raserver.exe 5004 raserver.exe 5004 raserver.exe 5004 raserver.exe 5004 raserver.exe 5004 raserver.exe 5004 raserver.exe 5004 raserver.exe 5004 raserver.exe 5004 raserver.exe 5004 raserver.exe 5004 raserver.exe 5004 raserver.exe 5004 raserver.exe 5004 raserver.exe 5004 raserver.exe 5004 raserver.exe 5004 raserver.exe 5004 raserver.exe 5004 raserver.exe 5004 raserver.exe 5004 raserver.exe 5004 raserver.exe 5004 raserver.exe 5004 raserver.exe 5004 raserver.exe 5004 raserver.exe 5004 raserver.exe 5004 raserver.exe 5004 raserver.exe 5004 raserver.exe 5004 raserver.exe 5004 raserver.exe 5004 raserver.exe 5004 raserver.exe 5004 raserver.exe 5004 raserver.exe 5004 raserver.exe 5004 raserver.exe 5004 raserver.exe 5004 raserver.exe 5004 raserver.exe 5004 raserver.exe 5004 raserver.exe -
Suspicious behavior: MapViewOfSection 8 IoCs
pid Process 4004 rundll32.exe 4756 cmd.exe 4756 cmd.exe 4756 cmd.exe 5004 raserver.exe 5004 raserver.exe 5004 raserver.exe 5004 raserver.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 4756 cmd.exe Token: SeDebugPrivilege 5004 raserver.exe Token: SeShutdownPrivilege 3440 Explorer.EXE Token: SeCreatePagefilePrivilege 3440 Explorer.EXE Token: SeShutdownPrivilege 3440 Explorer.EXE Token: SeCreatePagefilePrivilege 3440 Explorer.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3536 wrote to memory of 4004 3536 rundll32.exe 82 PID 3536 wrote to memory of 4004 3536 rundll32.exe 82 PID 3536 wrote to memory of 4004 3536 rundll32.exe 82 PID 4004 wrote to memory of 4756 4004 rundll32.exe 83 PID 4004 wrote to memory of 4756 4004 rundll32.exe 83 PID 4004 wrote to memory of 4756 4004 rundll32.exe 83 PID 4004 wrote to memory of 4756 4004 rundll32.exe 83 PID 4004 wrote to memory of 4756 4004 rundll32.exe 83 PID 4004 wrote to memory of 4756 4004 rundll32.exe 83 PID 4004 wrote to memory of 4756 4004 rundll32.exe 83 PID 4004 wrote to memory of 4756 4004 rundll32.exe 83 PID 4004 wrote to memory of 4756 4004 rundll32.exe 83 PID 4004 wrote to memory of 4756 4004 rundll32.exe 83 PID 4004 wrote to memory of 4756 4004 rundll32.exe 83 PID 4004 wrote to memory of 4756 4004 rundll32.exe 83 PID 4004 wrote to memory of 4756 4004 rundll32.exe 83 PID 4004 wrote to memory of 4756 4004 rundll32.exe 83 PID 4004 wrote to memory of 4756 4004 rundll32.exe 83 PID 4004 wrote to memory of 4756 4004 rundll32.exe 83 PID 4004 wrote to memory of 4756 4004 rundll32.exe 83 PID 4004 wrote to memory of 4756 4004 rundll32.exe 83 PID 4004 wrote to memory of 4756 4004 rundll32.exe 83 PID 4004 wrote to memory of 4756 4004 rundll32.exe 83 PID 4004 wrote to memory of 4756 4004 rundll32.exe 83 PID 4004 wrote to memory of 4756 4004 rundll32.exe 83 PID 4004 wrote to memory of 4756 4004 rundll32.exe 83 PID 4004 wrote to memory of 4756 4004 rundll32.exe 83 PID 4004 wrote to memory of 4756 4004 rundll32.exe 83 PID 4004 wrote to memory of 4756 4004 rundll32.exe 83 PID 4004 wrote to memory of 4756 4004 rundll32.exe 83 PID 4004 wrote to memory of 4756 4004 rundll32.exe 83 PID 4004 wrote to memory of 4756 4004 rundll32.exe 83 PID 4004 wrote to memory of 4756 4004 rundll32.exe 83 PID 4004 wrote to memory of 4756 4004 rundll32.exe 83 PID 4004 wrote to memory of 4756 4004 rundll32.exe 83 PID 4004 wrote to memory of 4756 4004 rundll32.exe 83 PID 4004 wrote to memory of 4756 4004 rundll32.exe 83 PID 4004 wrote to memory of 4756 4004 rundll32.exe 83 PID 4004 wrote to memory of 4756 4004 rundll32.exe 83 PID 4004 wrote to memory of 4756 4004 rundll32.exe 83 PID 4004 wrote to memory of 4756 4004 rundll32.exe 83 PID 4004 wrote to memory of 4756 4004 rundll32.exe 83 PID 4004 wrote to memory of 4756 4004 rundll32.exe 83 PID 4004 wrote to memory of 4756 4004 rundll32.exe 83 PID 4004 wrote to memory of 4756 4004 rundll32.exe 83 PID 4004 wrote to memory of 4756 4004 rundll32.exe 83 PID 4004 wrote to memory of 4756 4004 rundll32.exe 83 PID 4004 wrote to memory of 4756 4004 rundll32.exe 83 PID 4004 wrote to memory of 4756 4004 rundll32.exe 83 PID 4004 wrote to memory of 4756 4004 rundll32.exe 83 PID 4004 wrote to memory of 4756 4004 rundll32.exe 83 PID 4004 wrote to memory of 4756 4004 rundll32.exe 83 PID 4004 wrote to memory of 4756 4004 rundll32.exe 83 PID 4004 wrote to memory of 4756 4004 rundll32.exe 83 PID 4004 wrote to memory of 4756 4004 rundll32.exe 83 PID 4004 wrote to memory of 4756 4004 rundll32.exe 83 PID 4004 wrote to memory of 4756 4004 rundll32.exe 83 PID 4004 wrote to memory of 4756 4004 rundll32.exe 83 PID 4004 wrote to memory of 4756 4004 rundll32.exe 83 PID 4004 wrote to memory of 4756 4004 rundll32.exe 83 PID 4004 wrote to memory of 4756 4004 rundll32.exe 83 PID 4004 wrote to memory of 4756 4004 rundll32.exe 83 PID 4004 wrote to memory of 4756 4004 rundll32.exe 83 PID 4004 wrote to memory of 4756 4004 rundll32.exe 83
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3440 -
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\Conservatory.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\Conservatory.dll,#13⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4756
-
-
-
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:5004 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\cmd.exe"3⤵
- System Location Discovery: System Language Discovery
PID:4500
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
- System Location Discovery: System Language Discovery
PID:3112
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:4256
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
MD5a182561a527f929489bf4b8f74f65cd7
SHA18cd6866594759711ea1836e86a5b7ca64ee8911f
SHA25642aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914
SHA5129bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558
-
Filesize
81KB
MD5fd7e86b1fe3be4a5c606663c524da671
SHA1f7e1db1bdf8b4618dbcc640b7730544428c55953
SHA2560ed9e0593e8ca58097eee031de7843b4e6196eb22a3c81500b97b7084f375d5a
SHA5126fc2130579084bdf0cde079c5a09d72540dbb3a868019616edbdba8ddbf1e2bc3eb875dffbf61952d85fb82a6a86df59c9bb112495e7e2a41c260c08eae394aa
-
Filesize
40B
MD52f245469795b865bdd1b956c23d7893d
SHA16ad80b974d3808f5a20ea1e766c7d2f88b9e5895
SHA2561662d01a2d47b875a34fc7a8cd92e78cb2ba7f34023c7fd2639cbb10b8d94361
SHA512909f189846a5d2db208a5eb2e7cb3042c0f164caf437e2b1b6de608c0a70e4f3510b81b85753dbeec1e211e6a83e6ea8c96aff896e9b6e8ed42014473a54dc4f
-
Filesize
38B
MD54aadf49fed30e4c9b3fe4a3dd6445ebe
SHA11e332822167c6f351b99615eada2c30a538ff037
SHA25675034beb7bded9aeab5748f4592b9e1419256caec474065d43e531ec5cc21c56
SHA512eb5b3908d5e7b43ba02165e092f05578f45f15a148b4c3769036aa542c23a0f7cd2bc2770cf4119a7e437de3f681d9e398511f69f66824c516d9b451bb95f945
-
Filesize
40B
MD5d63a82e5d81e02e399090af26db0b9cb
SHA191d0014c8f54743bba141fd60c9d963f869d76c9
SHA256eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae
SHA51238afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad
-
Filesize
872B
MD5bbc41c78bae6c71e63cb544a6a284d94
SHA133f2c1d9fa0e9c99b80bc2500621e95af38b1f9a
SHA256ee83c6bcea9353c74bfc0a7e739f3c4a765ace894470e09cdcdebba700b8d4cb
SHA5120aea424b57adae3e14ad6491cab585f554b4dffe601b5a17bad6ee6177d2f0f995e419cde576e2d1782b9bddc0661aada11a2c9f1454ae625d9e3223635ec9f4