Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
43s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
12/09/2022, 10:22
Static task
static1
Behavioral task
behavioral1
Sample
tdft5hkb.cmdline
Resource
win7-20220812-en
windows7-x64
6 signatures
60 seconds
Behavioral task
behavioral2
Sample
tdft5hkb.cmdline
Resource
win10-20220812-en
windows10-1703-x64
9 signatures
60 seconds
Behavioral task
behavioral3
Sample
tdft5hkb.cmdline
Resource
win10v2004-20220812-en
windows10-2004-x64
3 signatures
60 seconds
General
-
Target
tdft5hkb.cmdline
-
Size
369B
-
MD5
8008a8ac8ae991e78a867ed52a90bf1f
-
SHA1
c8af66739bdb118fd92804548c87163a0fb1eb20
-
SHA256
6765c36d392a0d07a8ce911e92ff0e29bfa6d703353abde7cb602e3a24f811c6
-
SHA512
5719d07646e74cedca9cc50534f9de9eaa82dcab2e5286d1124181cc2ea0e81f88ffb1acd36da88eb1006bd76f21f8c242157018964fa50ba421e31b2cf9e312
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 968 rundll32.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 968 rundll32.exe 968 rundll32.exe 968 rundll32.exe 968 rundll32.exe 968 rundll32.exe 968 rundll32.exe 968 rundll32.exe 968 rundll32.exe 968 rundll32.exe 968 rundll32.exe 968 rundll32.exe 968 rundll32.exe 968 rundll32.exe 968 rundll32.exe 968 rundll32.exe 968 rundll32.exe 968 rundll32.exe 968 rundll32.exe 968 rundll32.exe 968 rundll32.exe 968 rundll32.exe 968 rundll32.exe 968 rundll32.exe 968 rundll32.exe 968 rundll32.exe 968 rundll32.exe 968 rundll32.exe 968 rundll32.exe 968 rundll32.exe 968 rundll32.exe 968 rundll32.exe 968 rundll32.exe 968 rundll32.exe 968 rundll32.exe 968 rundll32.exe 968 rundll32.exe 968 rundll32.exe 968 rundll32.exe 968 rundll32.exe 968 rundll32.exe 968 rundll32.exe 968 rundll32.exe 968 rundll32.exe 968 rundll32.exe 968 rundll32.exe 968 rundll32.exe 968 rundll32.exe 968 rundll32.exe 968 rundll32.exe 968 rundll32.exe 968 rundll32.exe 968 rundll32.exe 968 rundll32.exe 968 rundll32.exe 968 rundll32.exe 968 rundll32.exe 968 rundll32.exe 968 rundll32.exe 968 rundll32.exe 968 rundll32.exe 968 rundll32.exe 968 rundll32.exe 968 rundll32.exe 968 rundll32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1976 AcroRd32.exe 1976 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1100 wrote to memory of 968 1100 cmd.exe 29 PID 1100 wrote to memory of 968 1100 cmd.exe 29 PID 1100 wrote to memory of 968 1100 cmd.exe 29 PID 968 wrote to memory of 1976 968 rundll32.exe 30 PID 968 wrote to memory of 1976 968 rundll32.exe 30 PID 968 wrote to memory of 1976 968 rundll32.exe 30 PID 968 wrote to memory of 1976 968 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tdft5hkb.cmdline1⤵
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tdft5hkb.cmdline2⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\tdft5hkb.cmdline"3⤵
- Suspicious use of SetWindowsHookEx
PID:1976
-
-