Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
cardGamea/....class
windows7-x64
3cardGamea/....class
windows10-2004-x64
3cardGamea/....class
windows7-x64
3cardGamea/....class
windows10-2004-x64
3cardGamea/....class
windows7-x64
3cardGamea/....class
windows10-2004-x64
3cardGamea/....class
windows7-x64
3cardGamea/....class
windows10-2004-x64
3cardGamea/....class
windows7-x64
3cardGamea/....class
windows10-2004-x64
3cardGamea/....class
windows7-x64
3cardGamea/....class
windows10-2004-x64
3Analysis
-
max time kernel
178s -
max time network
37s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24/11/2022, 03:18
Static task
static1
Behavioral task
behavioral1
Sample
cardGamea/cardGamea.class
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
cardGamea/cardGamea.class
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
cardGamea/cardGameb.class
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
cardGamea/cardGameb.class
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
cardGamea/cardGamec.class
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
cardGamea/cardGamec.class
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
cardGamea/cardGamed.class
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
cardGamea/cardGamed.class
Resource
win10v2004-20221111-en
Behavioral task
behavioral9
Sample
cardGamea/cardGamee.class
Resource
win7-20221111-en
Behavioral task
behavioral10
Sample
cardGamea/cardGamee.class
Resource
win10v2004-20221111-en
Behavioral task
behavioral11
Sample
cardGamea/cardGamef.class
Resource
win7-20221111-en
Behavioral task
behavioral12
Sample
cardGamea/cardGamef.class
Resource
win10v2004-20221111-en
General
-
Target
cardGamea/cardGamee.class
-
Size
16KB
-
MD5
ef80921bccfa41d9dff6603164ae8ead
-
SHA1
a76fe212bf2e4f11a00ee48f56c83c952a599ca0
-
SHA256
97b51417e66fd5977347e4e957ae4786592979d60d73f33d9d1005319b513532
-
SHA512
cc75bd30f1f25130c9f43af04266f294f835c77cc280d97bdb0fff8d4e0871a95095f482e006903fb0996b5aa6a5016b236592740a5695149a44708f200f4209
-
SSDEEP
384:1cmICe2kmnl8RckTSstVvSr68OInnNSJpJQopAOKHP/vuu44o:vIwnktPK6yNSXJgHPnU7
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\class_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\class_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\.class rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\class_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\class_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\class_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\.class\ = "class_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\class_auto_file\shell\Read rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1852 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1852 AcroRd32.exe 1852 AcroRd32.exe 1852 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1368 wrote to memory of 1648 1368 cmd.exe 29 PID 1368 wrote to memory of 1648 1368 cmd.exe 29 PID 1368 wrote to memory of 1648 1368 cmd.exe 29 PID 1648 wrote to memory of 1852 1648 rundll32.exe 30 PID 1648 wrote to memory of 1852 1648 rundll32.exe 30 PID 1648 wrote to memory of 1852 1648 rundll32.exe 30 PID 1648 wrote to memory of 1852 1648 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\cardGamea\cardGamee.class1⤵
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\cardGamea\cardGamee.class2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\cardGamea\cardGamee.class"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1852
-
-