Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10InstalIеr...vg.dll
windows7-x64
1InstalIеr...vg.dll
windows10-2004-x64
1InstalIеr...sg.dll
windows7-x64
1InstalIеr...sg.dll
windows10-2004-x64
1InstalIеr...kc.dll
windows7-x64
1InstalIеr...kc.dll
windows10-2004-x64
1InstalIеr...18.exe
windows7-x64
8InstalIеr...18.exe
windows10-2004-x64
10InstalIеr...ws.dll
windows7-x64
1InstalIеr...ws.dll
windows10-2004-x64
1InstalIеr...le.dll
windows7-x64
1InstalIеr...le.dll
windows10-2004-x64
1TT18.exe
windows7-x64
8TT18.exe
windows10-2004-x64
10TTDesktop18.exe
windows7-x64
8TTDesktop18.exe
windows10-2004-x64
10TikTokDesktop18.exe
windows7-x64
8TikTokDesktop18.exe
windows10-2004-x64
10adjthjawdth.exe
windows7-x64
10adjthjawdth.exe
windows10-2004-x64
10bxftjhksaef.exe
windows7-x64
10bxftjhksaef.exe
windows10-2004-x64
10cli.exe
windows7-x64
3cli.exe
windows10-2004-x64
3dujkgsf.exe
windows7-x64
3dujkgsf.exe
windows10-2004-x64
5fdaerghawd.exe
windows7-x64
7fdaerghawd.exe
windows10-2004-x64
7fkydjyhjadg.exe
windows7-x64
10fkydjyhjadg.exe
windows10-2004-x64
10fsyjawdr.exe
windows7-x64
10fsyjawdr.exe
windows10-2004-x64
10Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
30/11/2024, 21:21
Static task
static1
Behavioral task
behavioral1
Sample
InstalIеr-x86/Qts5Svg.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
InstalIеr-x86/Qts5Svg.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
InstalIеr-x86/SbieMsg.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
InstalIеr-x86/SbieMsg.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
InstalIеr-x86/SbieShelIPkc.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
InstalIеr-x86/SbieShelIPkc.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
InstalIеr-x86/TTDesktop18.exe
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
InstalIеr-x86/TTDesktop18.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
InstalIеr-x86/cfg/platforms/qwindows.dll
Resource
win7-20241010-en
Behavioral task
behavioral10
Sample
InstalIеr-x86/cfg/platforms/qwindows.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
InstalIеr-x86/cfg/styles/qwindowsvistastyle.dll
Resource
win7-20240729-en
Behavioral task
behavioral12
Sample
InstalIеr-x86/cfg/styles/qwindowsvistastyle.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
TT18.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
TT18.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
TTDesktop18.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
TTDesktop18.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
TikTokDesktop18.exe
Resource
win7-20241010-en
Behavioral task
behavioral18
Sample
TikTokDesktop18.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
adjthjawdth.exe
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
adjthjawdth.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
bxftjhksaef.exe
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
bxftjhksaef.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
cli.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
cli.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
dujkgsf.exe
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
dujkgsf.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
fdaerghawd.exe
Resource
win7-20240708-en
Behavioral task
behavioral28
Sample
fdaerghawd.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
fkydjyhjadg.exe
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
fkydjyhjadg.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
fsyjawdr.exe
Resource
win7-20240903-en
General
-
Target
TTDesktop18.exe
-
Size
13KB
-
MD5
22bded153b8c1ec4b1d1b45e0467f7c6
-
SHA1
1c8825442a455da9ffa0fd56e0e2848dfa58bf2c
-
SHA256
f07f39ca504a15d670eecad52c272ed5cdc4025fede61cd910d7da2a55d1d052
-
SHA512
f6022cbf7120e1771e7ba992bcd59ba5f8f68507d91c10c997a3186766547ea0632347facfdec667c3bde261748eb93ee8df35c71600fd7c459539f629b408bb
-
SSDEEP
192:0qgaiJUFTQcHVPtAXjJ9vT2O3yP8B50LOZdBcmCEJXVWwTnkVOvQu:57zFEcH769vT2OCkB50LknnVTnkVUQ
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3020 powershell.exe 2560 powershell.exe 372 powershell.exe 2816 powershell.exe 2772 powershell.exe 2616 powershell.exe -
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TTDesktop18.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2816 powershell.exe 2772 powershell.exe 2616 powershell.exe 3020 powershell.exe 2560 powershell.exe 372 powershell.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 2816 powershell.exe Token: SeDebugPrivilege 2772 powershell.exe Token: SeDebugPrivilege 2616 powershell.exe Token: SeDebugPrivilege 3020 powershell.exe Token: SeDebugPrivilege 2560 powershell.exe Token: SeDebugPrivilege 372 powershell.exe Token: SeDebugPrivilege 2668 TTDesktop18.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2668 wrote to memory of 2816 2668 TTDesktop18.exe 31 PID 2668 wrote to memory of 2816 2668 TTDesktop18.exe 31 PID 2668 wrote to memory of 2816 2668 TTDesktop18.exe 31 PID 2668 wrote to memory of 2816 2668 TTDesktop18.exe 31 PID 2816 wrote to memory of 2772 2816 powershell.exe 33 PID 2816 wrote to memory of 2772 2816 powershell.exe 33 PID 2816 wrote to memory of 2772 2816 powershell.exe 33 PID 2816 wrote to memory of 2772 2816 powershell.exe 33 PID 2668 wrote to memory of 2616 2668 TTDesktop18.exe 34 PID 2668 wrote to memory of 2616 2668 TTDesktop18.exe 34 PID 2668 wrote to memory of 2616 2668 TTDesktop18.exe 34 PID 2668 wrote to memory of 2616 2668 TTDesktop18.exe 34 PID 2616 wrote to memory of 3020 2616 powershell.exe 36 PID 2616 wrote to memory of 3020 2616 powershell.exe 36 PID 2616 wrote to memory of 3020 2616 powershell.exe 36 PID 2616 wrote to memory of 3020 2616 powershell.exe 36 PID 2668 wrote to memory of 2560 2668 TTDesktop18.exe 37 PID 2668 wrote to memory of 2560 2668 TTDesktop18.exe 37 PID 2668 wrote to memory of 2560 2668 TTDesktop18.exe 37 PID 2668 wrote to memory of 2560 2668 TTDesktop18.exe 37 PID 2560 wrote to memory of 372 2560 powershell.exe 39 PID 2560 wrote to memory of 372 2560 powershell.exe 39 PID 2560 wrote to memory of 372 2560 powershell.exe 39 PID 2560 wrote to memory of 372 2560 powershell.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\TTDesktop18.exe"C:\Users\Admin\AppData\Local\Temp\TTDesktop18.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" powershell -Command "Add-MpPreference -ExclusionPath 'C:\zJbNeNwUcE'"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath C:\zJbNeNwUcE3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2772
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users'"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath C:\Users3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3020
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows'"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath C:\Windows3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:372
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD565de7613b3560647a22896183dd208ce
SHA1d729f7df31c0eb8fdaeb37161528b5f583948618
SHA2568b9b4a3b94cfeaceb08580a214e2e636ac94386b277a65bb49cc5f1ba4a23231
SHA5120240b3d51fcb48fd5dbdf96f153d34e5af2c5e6543c8eaa82dc846d6d11bd9784790083cfcf34d9405ea59f886d34f3c7eb950c65867030eed1dfb732778859c