Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
112s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
22/04/2023, 20:33
General
-
Target
download.gz
-
Size
20KB
-
MD5
78689334c2aaad67f19ee8f0f09de7e0
-
SHA1
9ed086731b9e1c216bd97d9f7ae9bd2bca86eded
-
SHA256
9adf4ba601b65ffbacc8800a3c9826fe5127a51ba5c641651c9f7b147757bad2
-
SHA512
30e968b692773cb3fef308bdbd265b55971ee038fa2cb8f162f1dcf59dcffcb86f6ca16dd8e3fe16210e3ef44bae6f10828f930c6a59c41bc14fd78624e8c2c3
-
SSDEEP
384:eq0X3i6xKUuz7P13PTez7H6R6SLxLG0j0XzEfE6rSDPbkCqbaQ:h0nJ4U4LpK7AJpjCrL4baQ
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 29 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\download.gz1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\download.gz2⤵
- Opens file in notepad (likely ransom note)
-