Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
cardGamea/....class
windows7-x64
3cardGamea/....class
windows10-2004-x64
3cardGamea/....class
windows7-x64
3cardGamea/....class
windows10-2004-x64
3cardGamea/....class
windows7-x64
3cardGamea/....class
windows10-2004-x64
3cardGamea/....class
windows7-x64
3cardGamea/....class
windows10-2004-x64
3cardGamea/....class
windows7-x64
3cardGamea/....class
windows10-2004-x64
3cardGamea/....class
windows7-x64
3cardGamea/....class
windows10-2004-x64
3Analysis
-
max time kernel
151s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24/11/2022, 03:18
Static task
static1
Behavioral task
behavioral1
Sample
cardGamea/cardGamea.class
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
cardGamea/cardGamea.class
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
cardGamea/cardGameb.class
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
cardGamea/cardGameb.class
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
cardGamea/cardGamec.class
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
cardGamea/cardGamec.class
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
cardGamea/cardGamed.class
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
cardGamea/cardGamed.class
Resource
win10v2004-20221111-en
Behavioral task
behavioral9
Sample
cardGamea/cardGamee.class
Resource
win7-20221111-en
Behavioral task
behavioral10
Sample
cardGamea/cardGamee.class
Resource
win10v2004-20221111-en
Behavioral task
behavioral11
Sample
cardGamea/cardGamef.class
Resource
win7-20221111-en
Behavioral task
behavioral12
Sample
cardGamea/cardGamef.class
Resource
win10v2004-20221111-en
General
-
Target
cardGamea/cardGamec.class
-
Size
11KB
-
MD5
91b9120df0d9bb7212d96ec93fb062f7
-
SHA1
0a2619402d783e9dbf427e033af9e35229c22a31
-
SHA256
55d037dfef03bb715810e431b2168080275ba96414d2f8b9ec284c620bd17736
-
SHA512
700f390b8194a5f6f07bd8b8d5862808ea57129d3386da0cb650e12ecc29b420fa89cd1d141557cc87026d84bac0117d5b1145ed373de6d3396b734dced1404a
-
SSDEEP
192:rmvrKQ/Sd0cOhsVdMDSEGFEic27mTTHENy8W79Hn4QlyCT:r1Q/SVOSV+wFc2aTuHIH/JT
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\class_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\class_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\.class rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\class_auto_file\shell rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\.class\ = "class_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\class_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\class_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\class_auto_file\ rundll32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1944 AcroRd32.exe 1944 AcroRd32.exe 1944 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1528 wrote to memory of 2000 1528 cmd.exe 28 PID 1528 wrote to memory of 2000 1528 cmd.exe 28 PID 1528 wrote to memory of 2000 1528 cmd.exe 28 PID 2000 wrote to memory of 1944 2000 rundll32.exe 29 PID 2000 wrote to memory of 1944 2000 rundll32.exe 29 PID 2000 wrote to memory of 1944 2000 rundll32.exe 29 PID 2000 wrote to memory of 1944 2000 rundll32.exe 29
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\cardGamea\cardGamec.class1⤵
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\cardGamea\cardGamec.class2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\cardGamea\cardGamec.class"3⤵
- Suspicious use of SetWindowsHookEx
PID:1944
-
-