Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
8Static
static
8setup.exe
windows7-x64
7setup.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...nu.dll
windows7-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3avpr.chm
windows7-x64
1avpr.chm
windows10-2004-x64
1avpr.exe
windows7-x64
3avpr.exe
windows10-2004-x64
3license.doc
windows7-x64
4license.doc
windows10-2004-x64
1Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04/10/2024, 19:29
Behavioral task
behavioral1
Sample
setup.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
setup.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
avpr.chm
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
avpr.chm
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
avpr.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
avpr.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
license.doc
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
license.doc
Resource
win10v2004-20240802-en
General
-
Target
setup.exe
-
Size
995KB
-
MD5
cdf558ffaa5c202a5084cc198300d975
-
SHA1
2caa8287fa7a817c2529c185fbde29c8da6728da
-
SHA256
c64b3021b4190b508c350ba2538207d418945d0014a5467d1aec1ca76b3e9e91
-
SHA512
4643ec7cd89b98e16a8512f9c59301b27bfaf38037745c08d60858fe04e1bb7136b2dc54bbf846ab54c8b6fe3f10c5e7251f02fe934025811d7277685aeed469
-
SSDEEP
12288:ZHXfdUgIC+kZhpKiCQo4wqLWgg85A09ijarEnxJy+3kZuHGMzvPjkiW1:Z3mgIC+QvtlzRtTsjaQnxoHwmMb7
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
pid Process 2692 setup.exe 2692 setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2692 setup.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
720B
MD5fc879be670fac960315759a24a91db84
SHA17b5cacfa0fe70f0cf6500065efaf169af5ec6573
SHA256502d3aaa0a4c2abca08ccc7b413b4cc8b833075bc1747a09f2e42a2129f192b3
SHA5128d515ed72cc30a162a0341fbf753d2600f60fbf4ec98e6a24df5ecc00e626b818e556825a33c27a23dca793308f7839d7e6f10c40ac1badd3a4d2afd93e8a41a
-
Filesize
12KB
MD5f407939127208a009b9a825cb77ed3c7
SHA1051d7fccf3fb544acaa8ab6be590bb4bc79cef82
SHA256191fab998e58b66a2416873b06062166b547eb3ba06b1326a4a785a566aaf76d
SHA512d45d08823ac7667f071b21d238b7fda43115db3195a442cb17d880d147e8a930374403c970afc31f676f01a83fb9c63e3be047de7e16718a08a1fdbe4b690901
-
Filesize
6KB
MD5740bd475a180892e4cb98acc14cd360b
SHA1f71ea3c855d3a0f96c3dd1a2776d21fa273833c6
SHA256adf51f6f088f3bed7d88350cc77812d9c19a575ec0d477bbe6d744dd9cea06cc
SHA512b8a51cd72acfdc3e589f5baa941537d4e51cfb6f73572f228651208aa89bcfd737beb7a8675e235fd0327a19516dbcd393fb8e6c5faee5a879cca28f46da840b