Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    35s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    16/04/2023, 19:12

General

  • Target

    Yagami 1.0.rar

  • Size

    30.2MB

  • MD5

    c91363602b2ffd7a2a3387b2aac75714

  • SHA1

    3c618adb764ddccb04c2b8b4527fee3f71339c78

  • SHA256

    b53b9796303fb2d0969dd2bf5175e6f383d0689084d2a9b43037b9dbc1298748

  • SHA512

    d646758168780213e4f6d671cb10d46cba62d29c8a060101547cfc7e8e1429df88eff52866c9d856d2f265ae66bee4f2043669137034277f6d3841c6b67368b0

  • SSDEEP

    786432:saJ9gEiCrplQcQ4IfxIxSyoDJMC/HNxct0pIJA8FkxdCjaTdf:vJ9cO5aSxfoNMC/txcCWzAxxf

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 12 IoCs
  • Suspicious use of SendNotifyMessage 11 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\Yagami 1.0.rar"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2032
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Yagami 1.0.rar
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1476
      • C:\Program Files\VideoLAN\VLC\vlc.exe
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Yagami 1.0.rar"
        3⤵
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:1748

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1748-78-0x000000013F6D0000-0x000000013F7C8000-memory.dmp

    Filesize

    992KB

  • memory/1748-84-0x000007FEFB030000-0x000007FEFB064000-memory.dmp

    Filesize

    208KB

  • memory/1748-85-0x000007FEF6710000-0x000007FEF69C4000-memory.dmp

    Filesize

    2.7MB

  • memory/1748-86-0x000007FEFB560000-0x000007FEFB578000-memory.dmp

    Filesize

    96KB

  • memory/1748-87-0x000007FEF7160000-0x000007FEF7177000-memory.dmp

    Filesize

    92KB

  • memory/1748-88-0x000007FEF7140000-0x000007FEF7151000-memory.dmp

    Filesize

    68KB

  • memory/1748-89-0x000007FEF7120000-0x000007FEF7137000-memory.dmp

    Filesize

    92KB

  • memory/1748-91-0x000007FEF70E0000-0x000007FEF70FD000-memory.dmp

    Filesize

    116KB

  • memory/1748-90-0x000007FEF7100000-0x000007FEF7111000-memory.dmp

    Filesize

    68KB

  • memory/1748-92-0x000007FEF70C0000-0x000007FEF70D1000-memory.dmp

    Filesize

    68KB

  • memory/1748-93-0x000007FEF6490000-0x000007FEF6690000-memory.dmp

    Filesize

    2.0MB

  • memory/1748-94-0x000007FEF53E0000-0x000007FEF648B000-memory.dmp

    Filesize

    16.7MB

  • memory/1748-95-0x000007FEF6AB0000-0x000007FEF6AEF000-memory.dmp

    Filesize

    252KB

  • memory/1748-96-0x000007FEF6A80000-0x000007FEF6AA1000-memory.dmp

    Filesize

    132KB

  • memory/1748-98-0x000007FEF66F0000-0x000007FEF6701000-memory.dmp

    Filesize

    68KB

  • memory/1748-99-0x000007FEF66D0000-0x000007FEF66E1000-memory.dmp

    Filesize

    68KB

  • memory/1748-97-0x000007FEF6A60000-0x000007FEF6A78000-memory.dmp

    Filesize

    96KB

  • memory/1748-100-0x000007FEF53C0000-0x000007FEF53D1000-memory.dmp

    Filesize

    68KB

  • memory/1748-101-0x000007FEF53A0000-0x000007FEF53BB000-memory.dmp

    Filesize

    108KB

  • memory/1748-102-0x000007FEF5380000-0x000007FEF5391000-memory.dmp

    Filesize

    68KB

  • memory/1748-104-0x000007FEF5330000-0x000007FEF5360000-memory.dmp

    Filesize

    192KB

  • memory/1748-103-0x000007FEF5360000-0x000007FEF5378000-memory.dmp

    Filesize

    96KB

  • memory/1748-105-0x000007FEF52C0000-0x000007FEF5327000-memory.dmp

    Filesize

    412KB

  • memory/1748-106-0x000007FEF5230000-0x000007FEF529F000-memory.dmp

    Filesize

    444KB

  • memory/1748-107-0x000007FEF5210000-0x000007FEF5221000-memory.dmp

    Filesize

    68KB

  • memory/1748-108-0x000007FEF51B0000-0x000007FEF5206000-memory.dmp

    Filesize

    344KB

  • memory/1748-109-0x000007FEF5180000-0x000007FEF51A8000-memory.dmp

    Filesize

    160KB

  • memory/1748-110-0x000007FEF5150000-0x000007FEF5174000-memory.dmp

    Filesize

    144KB

  • memory/1748-111-0x000007FEF5130000-0x000007FEF5147000-memory.dmp

    Filesize

    92KB

  • memory/1748-112-0x000007FEF5100000-0x000007FEF5123000-memory.dmp

    Filesize

    140KB

  • memory/1748-113-0x000007FEF50E0000-0x000007FEF50F1000-memory.dmp

    Filesize

    68KB

  • memory/1748-115-0x000007FEF4FC0000-0x000007FEF4FE1000-memory.dmp

    Filesize

    132KB

  • memory/1748-116-0x000007FEF4FA0000-0x000007FEF4FB3000-memory.dmp

    Filesize

    76KB

  • memory/1748-114-0x000007FEF4FF0000-0x000007FEF5002000-memory.dmp

    Filesize

    72KB

  • memory/1748-117-0x000007FEF4F80000-0x000007FEF4F92000-memory.dmp

    Filesize

    72KB

  • memory/1748-118-0x000007FEF4DA0000-0x000007FEF4EDB000-memory.dmp

    Filesize

    1.2MB

  • memory/1748-119-0x000007FEF4D70000-0x000007FEF4D9C000-memory.dmp

    Filesize

    176KB

  • memory/1748-120-0x000007FEF4BB0000-0x000007FEF4D62000-memory.dmp

    Filesize

    1.7MB

  • memory/1748-121-0x000007FEF3F60000-0x000007FEF3FBC000-memory.dmp

    Filesize

    368KB

  • memory/1748-122-0x000007FEF3F40000-0x000007FEF3F51000-memory.dmp

    Filesize

    68KB

  • memory/1748-123-0x000007FEF3C90000-0x000007FEF3D27000-memory.dmp

    Filesize

    604KB

  • memory/1748-124-0x000007FEF3EB0000-0x000007FEF3EC2000-memory.dmp

    Filesize

    72KB

  • memory/1748-125-0x000007FEF3A50000-0x000007FEF3C81000-memory.dmp

    Filesize

    2.2MB

  • memory/1748-126-0x000007FEF3E70000-0x000007FEF3EA5000-memory.dmp

    Filesize

    212KB

  • memory/1748-127-0x000007FEF3E40000-0x000007FEF3E65000-memory.dmp

    Filesize

    148KB

  • memory/1748-128-0x000007FEF3E20000-0x000007FEF3E31000-memory.dmp

    Filesize

    68KB

  • memory/1748-129-0x000007FEF3DB0000-0x000007FEF3E11000-memory.dmp

    Filesize

    388KB

  • memory/1748-130-0x000007FEF3D90000-0x000007FEF3DA1000-memory.dmp

    Filesize

    68KB

  • memory/1748-131-0x000007FEF3D70000-0x000007FEF3D82000-memory.dmp

    Filesize

    72KB

  • memory/1748-132-0x000007FEF3D50000-0x000007FEF3D63000-memory.dmp

    Filesize

    76KB

  • memory/1748-133-0x000007FEF3690000-0x000007FEF372F000-memory.dmp

    Filesize

    636KB

  • memory/1748-134-0x000007FEF3D30000-0x000007FEF3D41000-memory.dmp

    Filesize

    68KB

  • memory/1748-135-0x000007FEF3580000-0x000007FEF3682000-memory.dmp

    Filesize

    1.0MB

  • memory/1748-136-0x000007FEF3560000-0x000007FEF3571000-memory.dmp

    Filesize

    68KB

  • memory/1748-137-0x000007FEF33E0000-0x000007FEF3558000-memory.dmp

    Filesize

    1.5MB

  • memory/1748-138-0x000007FEF33C0000-0x000007FEF33D7000-memory.dmp

    Filesize

    92KB

  • memory/1748-139-0x000007FEF33A0000-0x000007FEF33B1000-memory.dmp

    Filesize

    68KB

  • memory/1748-140-0x000007FEF3380000-0x000007FEF3391000-memory.dmp

    Filesize

    68KB

  • memory/1748-141-0x000007FEF3360000-0x000007FEF3372000-memory.dmp

    Filesize

    72KB

  • memory/1748-142-0x000007FEF3340000-0x000007FEF3358000-memory.dmp

    Filesize

    96KB

  • memory/1748-143-0x000007FEF3320000-0x000007FEF3336000-memory.dmp

    Filesize

    88KB

  • memory/1748-144-0x000007FEF32F0000-0x000007FEF3319000-memory.dmp

    Filesize

    164KB

  • memory/1748-145-0x000007FEF32D0000-0x000007FEF32E2000-memory.dmp

    Filesize

    72KB

  • memory/1748-146-0x000007FEF32B0000-0x000007FEF32C1000-memory.dmp

    Filesize

    68KB