Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10InstalIеr...vg.dll
windows7-x64
1InstalIеr...vg.dll
windows10-2004-x64
1InstalIеr...sg.dll
windows7-x64
1InstalIеr...sg.dll
windows10-2004-x64
1InstalIеr...kc.dll
windows7-x64
1InstalIеr...kc.dll
windows10-2004-x64
1InstalIеr...18.exe
windows7-x64
8InstalIеr...18.exe
windows10-2004-x64
10InstalIеr...ws.dll
windows7-x64
1InstalIеr...ws.dll
windows10-2004-x64
1InstalIеr...le.dll
windows7-x64
1InstalIеr...le.dll
windows10-2004-x64
1TT18.exe
windows7-x64
8TT18.exe
windows10-2004-x64
10TTDesktop18.exe
windows7-x64
8TTDesktop18.exe
windows10-2004-x64
10TikTokDesktop18.exe
windows7-x64
8TikTokDesktop18.exe
windows10-2004-x64
10adjthjawdth.exe
windows7-x64
10adjthjawdth.exe
windows10-2004-x64
10bxftjhksaef.exe
windows7-x64
10bxftjhksaef.exe
windows10-2004-x64
10cli.exe
windows7-x64
3cli.exe
windows10-2004-x64
3dujkgsf.exe
windows7-x64
3dujkgsf.exe
windows10-2004-x64
5fdaerghawd.exe
windows7-x64
7fdaerghawd.exe
windows10-2004-x64
7fkydjyhjadg.exe
windows7-x64
10fkydjyhjadg.exe
windows10-2004-x64
10fsyjawdr.exe
windows7-x64
10fsyjawdr.exe
windows10-2004-x64
10Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
30/11/2024, 21:21
Static task
static1
Behavioral task
behavioral1
Sample
InstalIеr-x86/Qts5Svg.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
InstalIеr-x86/Qts5Svg.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
InstalIеr-x86/SbieMsg.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
InstalIеr-x86/SbieMsg.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
InstalIеr-x86/SbieShelIPkc.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
InstalIеr-x86/SbieShelIPkc.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
InstalIеr-x86/TTDesktop18.exe
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
InstalIеr-x86/TTDesktop18.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
InstalIеr-x86/cfg/platforms/qwindows.dll
Resource
win7-20241010-en
Behavioral task
behavioral10
Sample
InstalIеr-x86/cfg/platforms/qwindows.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
InstalIеr-x86/cfg/styles/qwindowsvistastyle.dll
Resource
win7-20240729-en
Behavioral task
behavioral12
Sample
InstalIеr-x86/cfg/styles/qwindowsvistastyle.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
TT18.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
TT18.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
TTDesktop18.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
TTDesktop18.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
TikTokDesktop18.exe
Resource
win7-20241010-en
Behavioral task
behavioral18
Sample
TikTokDesktop18.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
adjthjawdth.exe
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
adjthjawdth.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
bxftjhksaef.exe
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
bxftjhksaef.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
cli.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
cli.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
dujkgsf.exe
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
dujkgsf.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
fdaerghawd.exe
Resource
win7-20240708-en
Behavioral task
behavioral28
Sample
fdaerghawd.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
fkydjyhjadg.exe
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
fkydjyhjadg.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
fsyjawdr.exe
Resource
win7-20240903-en
General
-
Target
InstalIеr-x86/TTDesktop18.exe
-
Size
26.0MB
-
MD5
13eb2bb3303156d695ecf3f2b2c09eb7
-
SHA1
db1f2877681d02201c6c9d71d8c52a872c3612b9
-
SHA256
8680e9ff0246c2b7cd4a45a9c6262851ce8d12e4638e48cb1baec267c2b6ea6b
-
SHA512
6f44a7f1612f0eb4843c1e0de757a03f53d2b14e7aa8b7f983c2ca9baf0701d30f129edeab9c889655840782a1289fb4d0bf0699223e3c584afdaa4ee5172172
-
SSDEEP
192:0qgaiJUFTQcHVPtAXjJ9vT2O3yP8B50LOZdBcmCEJXVWwTnkVOvQu:57zFEcH769vT2OCkB50LknnVTnkVUQ
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2752 powershell.exe 1008 powershell.exe 3044 powershell.exe 3008 powershell.exe 2136 powershell.exe 1596 powershell.exe -
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TTDesktop18.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2752 powershell.exe 1008 powershell.exe 3044 powershell.exe 3008 powershell.exe 2136 powershell.exe 1596 powershell.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 2752 powershell.exe Token: SeDebugPrivilege 1008 powershell.exe Token: SeDebugPrivilege 3044 powershell.exe Token: SeDebugPrivilege 3008 powershell.exe Token: SeDebugPrivilege 2136 powershell.exe Token: SeDebugPrivilege 1596 powershell.exe Token: SeDebugPrivilege 3060 TTDesktop18.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 3060 wrote to memory of 2752 3060 TTDesktop18.exe 31 PID 3060 wrote to memory of 2752 3060 TTDesktop18.exe 31 PID 3060 wrote to memory of 2752 3060 TTDesktop18.exe 31 PID 3060 wrote to memory of 2752 3060 TTDesktop18.exe 31 PID 2752 wrote to memory of 1008 2752 powershell.exe 33 PID 2752 wrote to memory of 1008 2752 powershell.exe 33 PID 2752 wrote to memory of 1008 2752 powershell.exe 33 PID 2752 wrote to memory of 1008 2752 powershell.exe 33 PID 3060 wrote to memory of 3044 3060 TTDesktop18.exe 34 PID 3060 wrote to memory of 3044 3060 TTDesktop18.exe 34 PID 3060 wrote to memory of 3044 3060 TTDesktop18.exe 34 PID 3060 wrote to memory of 3044 3060 TTDesktop18.exe 34 PID 3044 wrote to memory of 3008 3044 powershell.exe 36 PID 3044 wrote to memory of 3008 3044 powershell.exe 36 PID 3044 wrote to memory of 3008 3044 powershell.exe 36 PID 3044 wrote to memory of 3008 3044 powershell.exe 36 PID 3060 wrote to memory of 2136 3060 TTDesktop18.exe 37 PID 3060 wrote to memory of 2136 3060 TTDesktop18.exe 37 PID 3060 wrote to memory of 2136 3060 TTDesktop18.exe 37 PID 3060 wrote to memory of 2136 3060 TTDesktop18.exe 37 PID 2136 wrote to memory of 1596 2136 powershell.exe 39 PID 2136 wrote to memory of 1596 2136 powershell.exe 39 PID 2136 wrote to memory of 1596 2136 powershell.exe 39 PID 2136 wrote to memory of 1596 2136 powershell.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\InstalIеr-x86\TTDesktop18.exe"C:\Users\Admin\AppData\Local\Temp\InstalIеr-x86\TTDesktop18.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" powershell -Command "Add-MpPreference -ExclusionPath 'C:\OFCLbCSL'"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath C:\OFCLbCSL3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1008
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users'"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath C:\Users3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3008
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows'"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath C:\Windows3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1596
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD5c5917224d180ff88af8a2251e10a6338
SHA180ab0cdfc252bb66189fb9937168bac8acbdee72
SHA256241052b4d68eeda4ef72a7e24392794370d019d8fb3ca1a40e4ca99fa7da2a4c
SHA5120eeab11b84fb67791d1b015374e89ede9395ae4780170ce567d78a228f6af0f0b5a007fb676ea466ea1d89b2acc7d63e6814fea179ac713c465ea0b6b2632eb5