Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
5b4f1d0cc80...e7.exe
windows7-x64
3b4f1d0cc80...e7.exe
windows10-2004-x64
3$PLUGINSDI...nt.dll
windows7-x64
3$PLUGINSDI...nt.dll
windows10-2004-x64
3$PLUGINSDI...nd.dll
windows7-x64
10$PLUGINSDI...nd.dll
windows10-2004-x64
10$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...st.dll
windows7-x64
10$PLUGINSDI...st.dll
windows10-2004-x64
10$PLUGINSDI...em.dll
windows7-x64
10$PLUGINSDI...em.dll
windows10-2004-x64
10$PLUGINSDI...te.dll
windows7-x64
3$PLUGINSDI...te.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...om.dll
windows7-x64
10$PLUGINSDI...om.dll
windows10-2004-x64
10$PLUGINSDIR/xml.dll
windows7-x64
10$PLUGINSDIR/xml.dll
windows10-2004-x64
10$TEMP/$_89...in.dll
windows7-x64
10$TEMP/$_89...in.dll
windows10-2004-x64
107za.exe
windows7-x64
37za.exe
windows10-2004-x64
3BORLNDMM.dll
windows7-x64
3BORLNDMM.dll
windows10-2004-x64
3CC3250MT.dll
windows7-x64
3CC3250MT.dll
windows10-2004-x64
3aq7z.dll
windows7-x64
3aq7z.dll
windows10-2004-x64
3aqhttp.dll
windows7-x64
3aqhttp.dll
windows10-2004-x64
3Analysis
-
max time kernel
93s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24/01/2025, 18:35
Behavioral task
behavioral1
Sample
b4f1d0cc80de69dbd5e9250aacc2b09bcb9aff4e97c52d91889aff751f1beee7.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
b4f1d0cc80de69dbd5e9250aacc2b09bcb9aff4e97c52d91889aff751f1beee7.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/ButtonEvent.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/ButtonEvent.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/MyNsisExtend.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/MyNsisExtend.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/PackageAssist.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/PackageAssist.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/locate.dll
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/locate.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/nsRandom.dll
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/nsRandom.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/xml.dll
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/xml.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
$TEMP/$_89_/MyNsisSkin.dll
Resource
win7-20241010-en
Behavioral task
behavioral22
Sample
$TEMP/$_89_/MyNsisSkin.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
7za.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
7za.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
BORLNDMM.dll
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
BORLNDMM.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
CC3250MT.dll
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
CC3250MT.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
aq7z.dll
Resource
win7-20240729-en
Behavioral task
behavioral30
Sample
aq7z.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
aqhttp.dll
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
aqhttp.dll
Resource
win10v2004-20241007-en
General
-
Target
$PLUGINSDIR/PackageAssist.dll
-
Size
204KB
-
MD5
3ad657fc9507467d770e297803473d66
-
SHA1
0d33fba778b0e91ebc503a3686cf1903d1b80266
-
SHA256
1a8e33f27002549ad3bd44e0032028a4f84ffb7ce07889605f5a9219aea9691e
-
SHA512
a6a06c103d5f8e19b139071f24c640ebe77a17bb249de6b64321d9a28ace5a6c37582701db90b8754f9db523f3085cb71271c84dd4dbb609e9c40b06a3aa35fe
-
SSDEEP
3072:iOHvt3fbTYYout98liJICstj3GDijRGoqVvbaNXubJ1JI:5Hvt3fwYollgq24LqVvWIdjI
Malware Config
Signatures
-
Ramnit family
-
Executes dropped EXE 2 IoCs
pid Process 4984 rundll32Srv.exe 1864 DesktopLayer.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\rundll32Srv.exe rundll32.exe -
resource yara_rule behavioral10/files/0x000c000000023b35-3.dat upx behavioral10/memory/4984-4-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral10/memory/1864-17-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral10/memory/1864-15-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral10/memory/1864-12-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral10/memory/4984-8-0x0000000000400000-0x000000000042E000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\px731D.tmp rundll32Srv.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe rundll32Srv.exe File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe rundll32Srv.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 384 2280 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DesktopLayer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32Srv.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{0B8814E2-DA82-11EF-9361-FA9F886F8D04} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3757466937" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31157902" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31157902" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "444508729" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3761685780" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1864 DesktopLayer.exe 1864 DesktopLayer.exe 1864 DesktopLayer.exe 1864 DesktopLayer.exe 1864 DesktopLayer.exe 1864 DesktopLayer.exe 1864 DesktopLayer.exe 1864 DesktopLayer.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1476 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1476 iexplore.exe 1476 iexplore.exe 2652 IEXPLORE.EXE 2652 IEXPLORE.EXE 2652 IEXPLORE.EXE 2652 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 4376 wrote to memory of 2280 4376 rundll32.exe 82 PID 4376 wrote to memory of 2280 4376 rundll32.exe 82 PID 4376 wrote to memory of 2280 4376 rundll32.exe 82 PID 2280 wrote to memory of 4984 2280 rundll32.exe 83 PID 2280 wrote to memory of 4984 2280 rundll32.exe 83 PID 2280 wrote to memory of 4984 2280 rundll32.exe 83 PID 4984 wrote to memory of 1864 4984 rundll32Srv.exe 85 PID 4984 wrote to memory of 1864 4984 rundll32Srv.exe 85 PID 4984 wrote to memory of 1864 4984 rundll32Srv.exe 85 PID 1864 wrote to memory of 1476 1864 DesktopLayer.exe 86 PID 1864 wrote to memory of 1476 1864 DesktopLayer.exe 86 PID 1476 wrote to memory of 2652 1476 iexplore.exe 89 PID 1476 wrote to memory of 2652 1476 iexplore.exe 89 PID 1476 wrote to memory of 2652 1476 iexplore.exe 89
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\PackageAssist.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\PackageAssist.dll,#12⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\SysWOW64\rundll32Srv.exeC:\Windows\SysWOW64\rundll32Srv.exe3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1476 CREDAT:17410 /prefetch:26⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2652
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 6243⤵
- Program crash
PID:384
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2280 -ip 22801⤵PID:1452
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD5ce36378334f2edb4e728e0632afebb70
SHA189d54efcb8c7bbe532e5ad91b38468279d3f5c93
SHA2566be47a3ecfbf81a123c297ee65d70177b4010bfbe728b94b4337453683b9a6e1
SHA5123e09cc9ece1907c072f02f768ec749ceef3b8913f394bb075b1948d0409b7910670b91da7d35160c211d0bf8df05e83409a1ad7493ea53864c41f37305f75aa2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD5a7401532a2d1d2614860ebdfa9da1fca
SHA16d9c104804c44186fa1f4b09d811a938ad7633aa
SHA2562d4ab5cb62992faa835b7fa57586df99b677c977d72770b1fb2a90283a0680fa
SHA512107532cb7b9a61dfce8345b5225762dee347a2621fc6dde20a79d6c62d4faf54efa85dd8365267b8bb5aac8202c6388d4ac82019a3bc334d638b5933a9263893
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a