Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
31s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
13/03/2023, 03:09
Static task
static1
Behavioral task
behavioral1
Sample
activity-stream.discovery_stream.json.tmp
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
activity-stream.discovery_stream.json.tmp
Resource
win10v2004-20230220-en
General
-
Target
activity-stream.discovery_stream.json.tmp
-
Size
150KB
-
MD5
f01d9d69f04ed1f2fa8bb865e9187e72
-
SHA1
2b56b9a6ff4c98e6ffb09202f2cb985538abd4ac
-
SHA256
831ac79ed62ae4688653129acbbf95097c7aa79b8e2e65f4024acd4c645569e1
-
SHA512
bd37eecfcd8c84f172fc9997b7c9867308375f4d14f7eeeae105e45017571dfba78cdc732f2acd42df3519d90c4d73e4019ccda69e5786d48870f9dfeaa40f3e
-
SSDEEP
3072:hcc1cMdCafCAhcVzG/CmCWo1GpCoGvcG4+ZcoF:hcMcMF/cu6U+ZcoF
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 12 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\tmp_auto_file\shell\open rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\tmp_auto_file\shell\open\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\tmp_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\tmp_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\.tmp\ = "tmp_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\tmp_auto_file\shell rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\tmp_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\tmp_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\.tmp rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\tmp_auto_file\shell\edit rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\tmp_auto_file\shell\edit\command rundll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1400 wrote to memory of 268 1400 cmd.exe 29 PID 1400 wrote to memory of 268 1400 cmd.exe 29 PID 1400 wrote to memory of 268 1400 cmd.exe 29 PID 268 wrote to memory of 1188 268 rundll32.exe 30 PID 268 wrote to memory of 1188 268 rundll32.exe 30 PID 268 wrote to memory of 1188 268 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\activity-stream.discovery_stream.json.tmp1⤵
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\activity-stream.discovery_stream.json.tmp2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:268 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\activity-stream.discovery_stream.json.tmp3⤵PID:1188
-
-