Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
5Static
static
1Bedless Client.zip
windows7-x64
1Bedless Client.zip
windows10-2004-x64
1Bedless Cl...s.json
windows7-x64
3Bedless Cl...s.json
windows10-2004-x64
3Bedless Cl...l.json
windows7-x64
3Bedless Cl...l.json
windows10-2004-x64
5Bedless Cl...s.json
windows7-x64
3Bedless Cl...s.json
windows10-2004-x64
3Bedless Cl...e.json
windows7-x64
3Bedless Cl...e.json
windows10-2004-x64
3Analysis
-
max time kernel
150s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
06/02/2023, 21:58
Static task
static1
Behavioral task
behavioral1
Sample
Bedless Client.zip
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Bedless Client.zip
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
Bedless Client/controls.json
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
Bedless Client/controls.json
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
Bedless Client/general.json
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
Bedless Client/general.json
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
Bedless Client/mods.json
Resource
win7-20220901-en
Behavioral task
behavioral8
Sample
Bedless Client/mods.json
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
Bedless Client/performance.json
Resource
win7-20221111-en
Behavioral task
behavioral10
Sample
Bedless Client/performance.json
Resource
win10v2004-20221111-en
General
-
Target
Bedless Client/general.json
-
Size
40B
-
MD5
9730f824ee4b461512b5eb0d90fe6ed4
-
SHA1
3a1e56af3757e9f21cfb818c552a4ce49751f82d
-
SHA256
e947ebea265931e303064f62555d4cafef4703ebdf8069a31937fb6432ad85ef
-
SHA512
88fd3f81a2c41779a9895fda77ae8336774e24b9c2be4646e79468225fca988ef4b2e94f63008934a288b0e65e236fba07682de85ddf4688bb40221b50f1d2d7
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\json_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\json_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\json_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\.json rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\.json\ = "json_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\json_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\json_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1768 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1768 AcroRd32.exe 1768 AcroRd32.exe 1768 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1652 wrote to memory of 2036 1652 cmd.exe 29 PID 1652 wrote to memory of 2036 1652 cmd.exe 29 PID 1652 wrote to memory of 2036 1652 cmd.exe 29 PID 2036 wrote to memory of 1768 2036 rundll32.exe 30 PID 2036 wrote to memory of 1768 2036 rundll32.exe 30 PID 2036 wrote to memory of 1768 2036 rundll32.exe 30 PID 2036 wrote to memory of 1768 2036 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Bedless Client\general.json"1⤵
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Bedless Client\general.json2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Bedless Client\general.json"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1768
-
-