Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
7anyunlock-...up.exe
windows11-21h2-x64
7$PLUGINSDI...Vs.dll
windows11-21h2-x64
3$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...up.exe
windows11-21h2-x64
7$PLUGINSDI...ec.dll
windows11-21h2-x64
3$PLUGINSDI...ss.dll
windows11-21h2-x64
3$PLUGINSDIR/setup.exe
windows11-21h2-x64
3$PLUGINSDI...ll.exe
windows11-21h2-x64
7$PLUGINSDI...er.dll
windows11-21h2-x64
3$PLUGINSDI...Vs.dll
windows11-21h2-x64
3$PLUGINSDI...ib.dll
windows11-21h2-x64
3$PLUGINSDI...el.dll
windows11-21h2-x64
7out.dll
windows11-21h2-x64
3$PLUGINSDI...tn.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...gs.dll
windows11-21h2-x64
3$PLUGINSDI...ss.dll
windows11-21h2-x64
3$PLUGINSDI...ry.dll
windows11-21h2-x64
3$PLUGINSDIR/un.exe
windows11-21h2-x64
3Analysis
-
max time kernel
441s -
max time network
1161s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
25/11/2024, 07:50
Behavioral task
behavioral1
Sample
anyunlock-iphone-password-unlocker-en-setup.exe
Resource
win11-20241007-en
Behavioral task
behavioral2
Sample
$PLUGINSDIR/CheckProVs.dll
Resource
win11-20241023-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/SkinnedControls.dll
Resource
win11-20241007-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win11-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/dotNetFx45_Full_setup.exe
Resource
win11-20241007-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11-20241007-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win11-20241007-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/setup.exe
Resource
win11-20241007-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/uninstall.exe
Resource
win11-20241007-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/BgWorker.dll
Resource
win11-20241007-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/CheckProVs.dll
Resource
win11-20241007-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/GoogleTracingLib.dll
Resource
win11-20241007-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/SelfDel.dll
Resource
win11-20241007-en
Behavioral task
behavioral14
Sample
out.dll
Resource
win11-20241023-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/SkinBtn.dll
Resource
win11-20241007-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/System.dll
Resource
win11-20241007-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11-20241007-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win11-20241007-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/registry.dll
Resource
win11-20241007-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/un.exe
Resource
win11-20241007-en
General
-
Target
$PLUGINSDIR/SkinnedControls.dll
-
Size
77KB
-
MD5
364bb3c9218429dd1315ad1db47e152d
-
SHA1
3253c1a381161c268bce8c487e892c8e5dd29dc3
-
SHA256
5f7998711ea856730139c4dac403f11b947ed94a464dc6d2d4b22f928c3a8536
-
SHA512
d9084068a259acb9a1691d10da8610053d3abdf6dc78d7357d80d1ac794d940478d2b05c3050484680ddee4c832ae30d71a67b2c2978845e298aca48058e01f6
-
SSDEEP
768:Q0p2dJFs6nYFg0vxrF9jd+IpMCGC8BnmmfJmLVp1aB5tEEThyX7QirbTGgyhTFDK:Q0YsX7vxGjBvJgVTadaXBTeh55axv
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1564 3556 WerFault.exe 80 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2468 wrote to memory of 3556 2468 rundll32.exe 80 PID 2468 wrote to memory of 3556 2468 rundll32.exe 80 PID 2468 wrote to memory of 3556 2468 rundll32.exe 80
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SkinnedControls.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SkinnedControls.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:3556 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3556 -s 4483⤵
- Program crash
PID:1564
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3556 -ip 35561⤵PID:4956