Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10is155016.exe
windows7-x64
3is155016.exe
windows10-2004-x64
3setup_akl.exe
windows7-x64
10setup_akl.exe
windows10-2004-x64
10$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3AKV.exe
windows7-x64
3AKV.exe
windows10-2004-x64
3HTV.dll
windows7-x64
3HTV.dll
windows10-2004-x64
3HTV.exe
windows7-x64
6HTV.exe
windows10-2004-x64
6HTV.dll
windows7-x64
3HTV.dll
windows10-2004-x64
3HTV.dll
windows7-x64
3HTV.dll
windows10-2004-x64
3HTV.chm
windows7-x64
1HTV.chm
windows10-2004-x64
1HTV.exe
windows7-x64
6HTV.exe
windows10-2004-x64
6Uninstall.exe
windows7-x64
7Uninstall.exe
windows10-2004-x64
7qs.html
windows7-x64
3qs.html
windows10-2004-x64
3Analysis
-
max time kernel
93s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system -
submitted
02/02/2025, 12:53 UTC
Behavioral task
behavioral1
Sample
is155016.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
is155016.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral3
Sample
setup_akl.exe
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
setup_akl.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20250129-en
Behavioral task
behavioral7
Sample
AKV.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
AKV.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral9
Sample
HTV.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
HTV.dll
Resource
win10v2004-20250129-en
Behavioral task
behavioral11
Sample
HTV.exe
Resource
win7-20241010-en
Behavioral task
behavioral12
Sample
HTV.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral13
Sample
HTV.dll
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
HTV.dll
Resource
win10v2004-20250129-en
Behavioral task
behavioral15
Sample
HTV.dll
Resource
win7-20241010-en
Behavioral task
behavioral16
Sample
HTV.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
HTV.chm
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
HTV.chm
Resource
win10v2004-20250129-en
Behavioral task
behavioral19
Sample
HTV.exe
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
HTV.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral21
Sample
Uninstall.exe
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
Uninstall.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral23
Sample
qs.html
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
qs.html
Resource
win10v2004-20250129-en
General
-
Target
is155016.exe
-
Size
92KB
-
MD5
cd5ca8c901b504506c16915ead6131f0
-
SHA1
a49b2c83c00752c297579f32f4089555986a3e94
-
SHA256
7095d5866f8378beffedf836e451cd0416d8342e39138d91bc3391d49f472e45
-
SHA512
5ced517f81db55f0b3af70489efdb7a31898642b06a115c77651869383056253c4b179da6988ce3317a3f62584b99e7c84cf379a561667d1150b8feaa6a9f3e1
-
SSDEEP
1536:HUqkw/OYBCDVZC6iaYXcnk737NZiaQ8EpIGkbzdW8hT/W0/V2hX9GD0a2pl/Iyi9:0OOYBCD1NkuvkbzIQW0/UX9Ay7zM
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 3788 3584 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language is155016.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\is155016.exe"C:\Users\Admin\AppData\Local\Temp\is155016.exe"1⤵
- System Location Discovery: System Language Discovery
PID:3584 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3584 -s 2682⤵
- Program crash
PID:3788
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3584 -ip 35841⤵PID:2368
Network
-
Remote address:8.8.8.8:53Request130.160.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request22.49.80.91.in-addr.arpaIN PTRResponse
-
GEThttps://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90Remote address:95.101.143.177:443RequestGET /th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90 HTTP/2.0
host: www.bing.com
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-type: image/png
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QWthbWFp"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
content-length: 1107
date: Sun, 02 Feb 2025 12:53:57 GMT
alt-svc: h3=":443"; ma=93600
x-cdn-traceid: 0.2a367a5c.1738500837.1ec5a950
-
Remote address:8.8.8.8:53Request57.169.31.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request177.143.101.95.in-addr.arpaIN PTRResponse177.143.101.95.in-addr.arpaIN PTRa95-101-143-177deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request200.163.202.172.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request206.23.85.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request85.49.80.91.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request134.130.81.91.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.210.232.199.in-addr.arpaIN PTRResponse
-
95.101.143.177:443https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90tls, http21.5kB 6.4kB 17 13
HTTP Request
GET https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90HTTP Response
200
-
73 B 159 B 1 1
DNS Request
130.160.190.20.in-addr.arpa
-
70 B 145 B 1 1
DNS Request
22.49.80.91.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
57.169.31.20.in-addr.arpa
-
73 B 139 B 1 1
DNS Request
177.143.101.95.in-addr.arpa
-
74 B 160 B 1 1
DNS Request
200.163.202.172.in-addr.arpa
-
71 B 145 B 1 1
DNS Request
206.23.85.13.in-addr.arpa
-
70 B 145 B 1 1
DNS Request
85.49.80.91.in-addr.arpa
-
72 B 147 B 1 1
DNS Request
134.130.81.91.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.210.232.199.in-addr.arpa