Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
cardGamea/....class
windows7-x64
3cardGamea/....class
windows10-2004-x64
3cardGamea/....class
windows7-x64
3cardGamea/....class
windows10-2004-x64
3cardGamea/....class
windows7-x64
3cardGamea/....class
windows10-2004-x64
3cardGamea/....class
windows7-x64
3cardGamea/....class
windows10-2004-x64
3cardGamea/....class
windows7-x64
3cardGamea/....class
windows10-2004-x64
3cardGamea/....class
windows7-x64
3cardGamea/....class
windows10-2004-x64
3Analysis
-
max time kernel
160s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24/11/2022, 03:18
Static task
static1
Behavioral task
behavioral1
Sample
cardGamea/cardGamea.class
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
cardGamea/cardGamea.class
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
cardGamea/cardGameb.class
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
cardGamea/cardGameb.class
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
cardGamea/cardGamec.class
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
cardGamea/cardGamec.class
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
cardGamea/cardGamed.class
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
cardGamea/cardGamed.class
Resource
win10v2004-20221111-en
Behavioral task
behavioral9
Sample
cardGamea/cardGamee.class
Resource
win7-20221111-en
Behavioral task
behavioral10
Sample
cardGamea/cardGamee.class
Resource
win10v2004-20221111-en
Behavioral task
behavioral11
Sample
cardGamea/cardGamef.class
Resource
win7-20221111-en
Behavioral task
behavioral12
Sample
cardGamea/cardGamef.class
Resource
win10v2004-20221111-en
General
-
Target
cardGamea/cardGamea.class
-
Size
5KB
-
MD5
24389160ac3f8d2a312a6093f012dc9a
-
SHA1
f5bd4110b22739e0366773ede56733494140bb22
-
SHA256
f72b1a84198b127c2d66bb372dc5d4b0fde3a4917bcc0dc088e077d99dc2e9af
-
SHA512
270089ce6c9c0a5cb32de1b34f9487c5702ecdffcd866a05437250da76f4accdeac43fc5dbfb750240859edd6f06d5cff96f1bdf9dc4ca913e38f506d6ce5d39
-
SSDEEP
96:Gw5OGl6jEzyOhNVoqwv3UvM9KvO9m92qD+kaBATm:l6uhNVolviMcT95QATm
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\.class\ = "class_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_Classes\Local Settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\class_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\.class rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\class_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\class_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\class_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\class_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\class_auto_file rundll32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 660 AcroRd32.exe 660 AcroRd32.exe 660 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2020 wrote to memory of 2044 2020 cmd.exe 29 PID 2020 wrote to memory of 2044 2020 cmd.exe 29 PID 2020 wrote to memory of 2044 2020 cmd.exe 29 PID 2044 wrote to memory of 660 2044 rundll32.exe 30 PID 2044 wrote to memory of 660 2044 rundll32.exe 30 PID 2044 wrote to memory of 660 2044 rundll32.exe 30 PID 2044 wrote to memory of 660 2044 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\cardGamea\cardGamea.class1⤵
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\cardGamea\cardGamea.class2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\cardGamea\cardGamea.class"3⤵
- Suspicious use of SetWindowsHookEx
PID:660
-
-