Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
31s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
13/05/2023, 15:02
Static task
static1
Behavioral task
behavioral1
Sample
Ready-Or-Not-by-Igruha.torrent
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Ready-Or-Not-by-Igruha.torrent
Resource
win10v2004-20230220-en
General
-
Target
Ready-Or-Not-by-Igruha.torrent
-
Size
297KB
-
MD5
a69418b67aa39f406b5f057721dd4e8b
-
SHA1
c0b9dbfffc562068b8155e8f1a8ad804e67a3290
-
SHA256
a73d8af2d27cee637b437265a5ba9c5fb02598233f05bcb1af73bdddf14391c2
-
SHA512
d2fc9b2d15776a12ca1a369e32cf990aa345d660d757ecbd2a83d37618e46dec79afdc2649e0694572f7f15a12b0702e30214b135c750c0290e340aaabed67da
-
SSDEEP
6144:bfmlBrdt9/bPFhlF3UynwFnpAgp6lJM1G1Dz/qCwrGZ9Or:bM9bzlFXnwFpXAJM1G//wqZIr
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1928 wrote to memory of 580 1928 cmd.exe 29 PID 1928 wrote to memory of 580 1928 cmd.exe 29 PID 1928 wrote to memory of 580 1928 cmd.exe 29
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Ready-Or-Not-by-Igruha.torrent1⤵
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Ready-Or-Not-by-Igruha.torrent2⤵
- Modifies registry class
PID:580
-