Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
971s -
max time network
974s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
27/05/2023, 19:52
General
-
Target
VIRUS.jpg
-
Size
223KB
-
MD5
9efda22e0c4c3011596aaec8776219e3
-
SHA1
e1d81a0454f801c4e18fa13bcca2fc62b3d41f19
-
SHA256
c6536099e6e9b816f6d9e25ccf6f1e6335fa734d23f7f9ada7068a610cdf6490
-
SHA512
9fa336b0f1f954d2703040b61172f57acbd03b097467cafa333f7dbaa068c6e17cba8b15163ee812493c09668d4b5fa2dbf8b4d4a13a5abb0972c1ee8a75de78
-
SSDEEP
3072:SDdObmhguAtsWmE+2jceSXRg3Hv8KN7DhdC6kzWypvaQ0FxyNTBfqMXERseQF8:gdOby8zmPxupBlkZvaF4NTBSAesPF8
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 11 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\VIRUS.jpg1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\MInecraft.jpg" /ForceBootstrapPaint3D1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc1⤵
- Drops file in System32 directory
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB