Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
6Static
static
3Delta V3.61.zip
windows7-x64
1Delta V3.61.zip
windows10-2004-x64
1Delta V3.61/Delta.exe
windows7-x64
3Delta V3.61/Delta.exe
windows10-2004-x64
6Delta V3.6...it.dll
windows7-x64
1Delta V3.6...it.dll
windows10-2004-x64
1Delta V3.6...on.dll
windows7-x64
1Delta V3.6...on.dll
windows10-2004-x64
1Delta V3.6...90.dll
windows7-x64
3Delta V3.6...90.dll
windows10-2004-x64
3Delta V3.6...92.dll
windows7-x64
3Delta V3.6...92.dll
windows10-2004-x64
3Delta V3.6...PI.dll
windows7-x64
3Delta V3.6...PI.dll
windows10-2004-x64
3Delta V3.6...ua.xml
windows7-x64
3Delta V3.6...ua.xml
windows10-2004-x64
1Delta V3.6...s.json
windows7-x64
3Delta V3.6...s.json
windows10-2004-x64
3Delta V3.6...rs.txt
windows7-x64
1Delta V3.6...rs.txt
windows10-2004-x64
1Delta V3.6...re.txt
windows7-x64
1Delta V3.6...re.txt
windows10-2004-x64
1Resubmissions
07/11/2024, 21:24
241107-z8z12ayfnb 807/11/2024, 21:23
241107-z8jdaa1pdl 607/11/2024, 21:21
241107-z7ptnsyjdx 7Analysis
-
max time kernel
121s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
07/11/2024, 21:23
Static task
static1
Behavioral task
behavioral1
Sample
Delta V3.61.zip
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Delta V3.61.zip
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Delta V3.61/Delta.exe
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
Delta V3.61/Delta.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Delta V3.61/ICSharpCode.AvalonEdit.dll
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
Delta V3.61/ICSharpCode.AvalonEdit.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Delta V3.61/Newtonsoft.Json.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
Delta V3.61/Newtonsoft.Json.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
Delta V3.61/bin/590.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
Delta V3.61/bin/590.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
Delta V3.61/bin/592.dll
Resource
win7-20241023-en
Behavioral task
behavioral12
Sample
Delta V3.61/bin/592.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
Delta V3.61/bin/Fluxteam_net_API.dll
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
Delta V3.61/bin/Fluxteam_net_API.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
Delta V3.61/bin/lua.xml
Resource
win7-20241010-en
Behavioral task
behavioral16
Sample
Delta V3.61/bin/lua.xml
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
Delta V3.61/bin/modules.json
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
Delta V3.61/bin/modules.json
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
Delta V3.61/bin/vers.txt
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
Delta V3.61/bin/vers.txt
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
Delta V3.61/scripts/Put your own scripts in here.txt
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
Delta V3.61/scripts/Put your own scripts in here.txt
Resource
win10v2004-20241007-en
General
-
Target
Delta V3.61/Delta.exe
-
Size
17.0MB
-
MD5
774ffee84d8e760761b8819edd2bc252
-
SHA1
74ff2bcc3baf64790181b97dc09ab951d9440379
-
SHA256
3c2cbcfb0dc0b92e1a0f15e725a1f8c4756a990e298098d94087cdd3fd491758
-
SHA512
935624fdaa9ae57d4515a456a9383c20240988848046fcab69948450413e573167c0f17a456f0f5120ec13e3215759ad11c4857873900606116c3e495dd69650
-
SSDEEP
196608:LOM8QZXcqPrn0guhegnueaIN3l4X+yBXeLUpcgwBj9aR:LOM8EmegnBaS1C+yBaUpcgwBj0
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2200 3056 WerFault.exe 29 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Delta.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3056 wrote to memory of 2200 3056 Delta.exe 30 PID 3056 wrote to memory of 2200 3056 Delta.exe 30 PID 3056 wrote to memory of 2200 3056 Delta.exe 30 PID 3056 wrote to memory of 2200 3056 Delta.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\Delta V3.61\Delta.exe"C:\Users\Admin\AppData\Local\Temp\Delta V3.61\Delta.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 8082⤵
- Program crash
PID:2200
-