Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3Registrati...ck.bat
windows11-21h2-x64
10Registrati...vn.exe
windows11-21h2-x64
8Registrati...CU.ps1
windows11-21h2-x64
6Registrati...an.vbs
windows11-21h2-x64
3Registrati...AR.exe
windows11-21h2-x64
3Registrati...RU.ps1
windows11-21h2-x64
3Registrati...UK.ps1
windows11-21h2-x64
10Registrati...in.ps1
windows11-21h2-x64
10Registrati...an.vbs
windows11-21h2-x64
3Registrati...ss.dll
windows11-21h2-x64
1Registrati...ng.exe
windows11-21h2-x64
3Registrati...es.dll
windows11-21h2-x64
1Registrati...es.dll
windows11-21h2-x64
1Registrati...es.dll
windows11-21h2-x64
1Registrati...es.dll
windows11-21h2-x64
1Registrati...es.dll
windows11-21h2-x64
1Registrati...es.dll
windows11-21h2-x64
1Registrati...es.dll
windows11-21h2-x64
1Registrati...es.dll
windows11-21h2-x64
1Registrati...es.dll
windows11-21h2-x64
1Registrati...es.dll
windows11-21h2-x64
1Registrati...es.dll
windows11-21h2-x64
1Registrati...es.dll
windows11-21h2-x64
1Registrati...es.dll
windows11-21h2-x64
1Registrati...es.dll
windows11-21h2-x64
1Registrati...es.dll
windows11-21h2-x64
1Registrati...es.dll
windows11-21h2-x64
1Registrati...es.dll
windows11-21h2-x64
1Registrati...es.dll
windows11-21h2-x64
1Registrati...es.dll
windows11-21h2-x64
1Registrati...es.dll
windows11-21h2-x64
1Registrati...es.dll
windows11-21h2-x64
1Analysis
-
max time kernel
462s -
max time network
527s -
platform
windows11-21h2_x64 -
resource
win11-20250217-en -
resource tags
arch:x64arch:x86image:win11-20250217-enlocale:en-usos:windows11-21h2-x64system -
submitted
12/03/2025, 18:41
Static task
static1
Behavioral task
behavioral1
Sample
Registration (Crack)/Crack.bat
Resource
win11-20250217-en
Behavioral task
behavioral2
Sample
Registration (Crack)/language/en-US/Devn.exe
Resource
win11-20250217-en
Behavioral task
behavioral3
Sample
Registration (Crack)/language/en-US/HKCU.ps1
Resource
win11-20250217-en
Behavioral task
behavioral4
Sample
Registration (Crack)/language/en-US/Lan.vbs
Resource
win11-20250217-en
Behavioral task
behavioral5
Sample
Registration (Crack)/language/en-US/RAR.exe
Resource
win11-20250217-en
Behavioral task
behavioral6
Sample
Registration (Crack)/language/en-US/RU.ps1
Resource
win11-20250217-en
Behavioral task
behavioral7
Sample
Registration (Crack)/language/en-US/UK.ps1
Resource
win11-20250217-en
Behavioral task
behavioral8
Sample
Registration (Crack)/language/en-US/Win.ps1
Resource
win11-20250217-en
Behavioral task
behavioral9
Sample
Registration (Crack)/language/uk-UA/Lan.vbs
Resource
win11-20250217-en
Behavioral task
behavioral10
Sample
Registration (Crack)/language/uk-UA/Lossless.dll
Resource
win11-20250217-en
Behavioral task
behavioral11
Sample
Registration (Crack)/language/uk-UA/LosslessScaling.exe
Resource
win11-20250217-en
Behavioral task
behavioral12
Sample
Registration (Crack)/language/uk-UA/ar/LosslessScaling.resources.dll
Resource
win11-20250218-en
Behavioral task
behavioral13
Sample
Registration (Crack)/language/uk-UA/bg/LosslessScaling.resources.dll
Resource
win11-20250217-en
Behavioral task
behavioral14
Sample
Registration (Crack)/language/uk-UA/cs/LosslessScaling.resources.dll
Resource
win11-20250217-en
Behavioral task
behavioral15
Sample
Registration (Crack)/language/uk-UA/de/LosslessScaling.resources.dll
Resource
win11-20250217-en
Behavioral task
behavioral16
Sample
Registration (Crack)/language/uk-UA/es-ES/LosslessScaling.resources.dll
Resource
win11-20250217-en
Behavioral task
behavioral17
Sample
Registration (Crack)/language/uk-UA/fa/LosslessScaling.resources.dll
Resource
win11-20250218-en
Behavioral task
behavioral18
Sample
Registration (Crack)/language/uk-UA/fr/LosslessScaling.resources.dll
Resource
win11-20250217-en
Behavioral task
behavioral19
Sample
Registration (Crack)/language/uk-UA/he/LosslessScaling.resources.dll
Resource
win11-20250217-en
Behavioral task
behavioral20
Sample
Registration (Crack)/language/uk-UA/hr/LosslessScaling.resources.dll
Resource
win11-20250217-en
Behavioral task
behavioral21
Sample
Registration (Crack)/language/uk-UA/id/LosslessScaling.resources.dll
Resource
win11-20250217-en
Behavioral task
behavioral22
Sample
Registration (Crack)/language/uk-UA/it/LosslessScaling.resources.dll
Resource
win11-20250217-en
Behavioral task
behavioral23
Sample
Registration (Crack)/language/uk-UA/ja/LosslessScaling.resources.dll
Resource
win11-20250217-en
Behavioral task
behavioral24
Sample
Registration (Crack)/language/uk-UA/ko/LosslessScaling.resources.dll
Resource
win11-20250217-en
Behavioral task
behavioral25
Sample
Registration (Crack)/language/uk-UA/lt/LosslessScaling.resources.dll
Resource
win11-20250217-en
Behavioral task
behavioral26
Sample
Registration (Crack)/language/uk-UA/pl/LosslessScaling.resources.dll
Resource
win11-20250217-en
Behavioral task
behavioral27
Sample
Registration (Crack)/language/uk-UA/pt-BR/LosslessScaling.resources.dll
Resource
win11-20250217-en
Behavioral task
behavioral28
Sample
Registration (Crack)/language/uk-UA/pt-PT/LosslessScaling.resources.dll
Resource
win11-20250217-en
Behavioral task
behavioral29
Sample
Registration (Crack)/language/uk-UA/ro/LosslessScaling.resources.dll
Resource
win11-20250217-en
Behavioral task
behavioral30
Sample
Registration (Crack)/language/uk-UA/sr-Latn/LosslessScaling.resources.dll
Resource
win11-20250217-en
Behavioral task
behavioral31
Sample
Registration (Crack)/language/uk-UA/tr/LosslessScaling.resources.dll
Resource
win11-20250217-en
Behavioral task
behavioral32
Sample
Registration (Crack)/language/uk-UA/uk/LosslessScaling.resources.dll
Resource
win11-20250217-en
General
-
Target
Registration (Crack)/language/en-US/Lan.vbs
-
Size
432B
-
MD5
49af07d132592c9a62eaaef421e3e589
-
SHA1
cb7cc0a4a492dba5773506e816467975cabdc227
-
SHA256
487985d63734cd4828eaf03284e0d1d2fa684afc2d46da489c99d498f31a83ab
-
SHA512
7525522f2b648aaf94e52fd1c1787931c11ca03e656ccbcca5879d6132d383aa40228256cbf93d0e7741f0003de6fe94ca537151a2162d33c077943b90fe5908
Malware Config
Signatures
-
pid Process 236 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 236 powershell.exe 236 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 236 powershell.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3316 wrote to memory of 236 3316 WScript.exe 81 PID 3316 wrote to memory of 236 3316 WScript.exe 81
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Registration (Crack)\language\en-US\Lan.vbs"1⤵
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -ExecutionPolicy Bypass -Command "Invoke-Expression (Get-Content 'C:\Users\Public\IObitUnlocker\RU.dll' -Raw)"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:236
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82