Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

3

VirtualTab...up.exe

windows7-x64

7

VirtualTab...up.exe

windows10-2004-x64

8

Resubmissions

30/09/2024, 12:01

240930-n68dvaycja 8

30/09/2024, 11:54

240930-n2219stenl 8

30/09/2024, 11:44

240930-nwdfqatcjj 7

Analysis

  • max time kernel
    120s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    30/09/2024, 12:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    VirtualTabletServer_v3.1.3_setup.exe

  • Size

    29.4MB

  • MD5

    a8e73dd218f4e724f1ba4215d0d8e1f7

  • SHA1

    999190ea75801c292d04a16cdc91f119989fa98e

  • SHA256

    0310ad0d2c0dc62100055c5e96add680cc0426b259af77cf4e0dd80664cf48c2

  • SHA512

    fa38fd150ca9341500a316cb7adea24f74c6df30309d1766338374ce08ec6d1bbf80d6c8b1bafbe97e33e3c0395cca2ef97a141af979f56746d6d2bb30ce2a23

  • SSDEEP

    393216:8BkqKoRZ4QZ2RCV+5XPw6VBb26k1Tn/BnrBXRt1euiY6SnadV+mgG1MKcibQSIpU:qZ4Jc0X7x3yBr9RtriYdnKMiY8ubFC

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\VirtualTabletServer_v3.1.3_setup.exe
    "C:\Users\Admin\AppData\Local\Temp\VirtualTabletServer_v3.1.3_setup.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1792
    • C:\Windows\TEMP\{637E0002-AE98-44DA-B686-3A82642FCC4B}\.cr\VirtualTabletServer_v3.1.3_setup.exe
      "C:\Windows\TEMP\{637E0002-AE98-44DA-B686-3A82642FCC4B}\.cr\VirtualTabletServer_v3.1.3_setup.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\VirtualTabletServer_v3.1.3_setup.exe" -burn.filehandle.attached=200 -burn.filehandle.self=196
      2⤵
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      PID:1188

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Windows\Temp\{637E0002-AE98-44DA-B686-3A82642FCC4B}\.cr\VirtualTabletServer_v3.1.3_setup.exe
    Filesize

    1.3MB

    MD5

    69a542c2422f4f539ac40ce9397c9935

    SHA1

    5d58ec90b036e9945bdff1bf4fbb52a92ede0e00

    SHA256

    253bf36a09e7f5c4bc7d5dfade9e3f544b9a6e352b917bc3929c49024bdf9dd2

    SHA512

    2e4023ad4faa30677d231432864d9205ee5fd9634803bedb08dca51bf86e95255d172c5f296072ff908349032f593abe3a659813ffa5543dc5b212b747921131

    Download Submit