Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
cardGamea/....class
windows7-x64
3cardGamea/....class
windows10-2004-x64
3cardGamea/....class
windows7-x64
3cardGamea/....class
windows10-2004-x64
3cardGamea/....class
windows7-x64
3cardGamea/....class
windows10-2004-x64
3cardGamea/....class
windows7-x64
3cardGamea/....class
windows10-2004-x64
3cardGamea/....class
windows7-x64
3cardGamea/....class
windows10-2004-x64
3cardGamea/....class
windows7-x64
3cardGamea/....class
windows10-2004-x64
3Analysis
-
max time kernel
167s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24/11/2022, 03:18
Static task
static1
Behavioral task
behavioral1
Sample
cardGamea/cardGamea.class
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
cardGamea/cardGamea.class
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
cardGamea/cardGameb.class
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
cardGamea/cardGameb.class
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
cardGamea/cardGamec.class
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
cardGamea/cardGamec.class
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
cardGamea/cardGamed.class
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
cardGamea/cardGamed.class
Resource
win10v2004-20221111-en
Behavioral task
behavioral9
Sample
cardGamea/cardGamee.class
Resource
win7-20221111-en
Behavioral task
behavioral10
Sample
cardGamea/cardGamee.class
Resource
win10v2004-20221111-en
Behavioral task
behavioral11
Sample
cardGamea/cardGamef.class
Resource
win7-20221111-en
Behavioral task
behavioral12
Sample
cardGamea/cardGamef.class
Resource
win10v2004-20221111-en
General
-
Target
cardGamea/cardGameb.class
-
Size
14KB
-
MD5
cbc8317e6e353173077bc853099ac89d
-
SHA1
92a64abf9a1b7a3d5cdf715ef6a9079e6a99f1cb
-
SHA256
30b5bc3a2faec721f6da8373c884ac587654b9a3b1416b30ec0195841e65614f
-
SHA512
7d8509a2ca4d0a40988db28a76a1fbcce9c4ac08aa00cd2b95f73c7a434d8e391b33f3156cdd3092b9b3367484a91a47ee053293b71ebe062b3783ad63195b88
-
SSDEEP
192:iHBOwXM5QfmGf8/efn0Wd8hqEmUX9c7PzqtMnG6aNU9mYIdMnXkWCeMW2UKPU:FwXTfDEGfn0WdpmA2tx09mYIkxCeThK8
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\class_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\class_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\class_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\class_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\class_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\.class rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\.class\ = "class_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\class_auto_file\shell\Read rundll32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 520 AcroRd32.exe 520 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 304 wrote to memory of 1084 304 cmd.exe 28 PID 304 wrote to memory of 1084 304 cmd.exe 28 PID 304 wrote to memory of 1084 304 cmd.exe 28 PID 1084 wrote to memory of 520 1084 rundll32.exe 29 PID 1084 wrote to memory of 520 1084 rundll32.exe 29 PID 1084 wrote to memory of 520 1084 rundll32.exe 29 PID 1084 wrote to memory of 520 1084 rundll32.exe 29
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\cardGamea\cardGameb.class1⤵
- Suspicious use of WriteProcessMemory
PID:304 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\cardGamea\cardGameb.class2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\cardGamea\cardGameb.class"3⤵
- Suspicious use of SetWindowsHookEx
PID:520
-
-