Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
1scape 2.zip
windows7-x64
1scape 2.zip
windows10-2004-x64
1manifest.json
windows7-x64
3manifest.json
windows10-2004-x64
3modlist.html
windows7-x64
1modlist.html
windows10-2004-x64
1overrides/...ts.cfg
windows7-x64
3overrides/...ts.cfg
windows10-2004-x64
3overrides/...ls.cfg
windows7-x64
3overrides/...ls.cfg
windows10-2004-x64
3overrides/...ck.zip
windows7-x64
1overrides/...ck.zip
windows10-2004-x64
1overrides/...me.txt
windows7-x64
1overrides/...me.txt
windows10-2004-x64
1overrides/...s.json
windows7-x64
3overrides/...s.json
windows10-2004-x64
3overrides/...es.cfg
windows7-x64
3overrides/...es.cfg
windows10-2004-x64
3overrides/...s.json
windows7-x64
3overrides/...s.json
windows10-2004-x64
3overrides/...on.cfg
windows7-x64
3overrides/...on.cfg
windows10-2004-x64
3overrides/...al.cfg
windows7-x64
3overrides/...al.cfg
windows10-2004-x64
3overrides/...es.cfg
windows7-x64
3overrides/...es.cfg
windows10-2004-x64
3overrides/...es.cfg
windows7-x64
3overrides/...es.cfg
windows10-2004-x64
3overrides/...in.cfg
windows7-x64
3overrides/...in.cfg
windows10-2004-x64
3overrides/...es.cfg
windows7-x64
3overrides/...es.cfg
windows10-2004-x64
3Analysis
-
max time kernel
150s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
29/05/2023, 13:27
Static task
static1
Behavioral task
behavioral1
Sample
scape 2.zip
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
scape 2.zip
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
manifest.json
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
manifest.json
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
modlist.html
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
modlist.html
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
overrides/config/Artifacts.cfg
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
overrides/config/Artifacts.cfg
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
overrides/config/BaseMetals.cfg
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
overrides/config/BaseMetals.cfg
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
overrides/config/ChanceCubes/CustomRewards/Resourcepack/CustomSounds-Resourcepack.zip
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
overrides/config/ChanceCubes/CustomRewards/Resourcepack/CustomSounds-Resourcepack.zip
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
overrides/config/ChanceCubes/CustomRewards/Resourcepack/readme.txt
Resource
win7-20230220-en
Behavioral task
behavioral14
Sample
overrides/config/ChanceCubes/CustomRewards/Resourcepack/readme.txt
Resource
win10v2004-20230220-en
Behavioral task
behavioral15
Sample
overrides/config/ChanceCubes/CustomRewards/Sounds/sounds.json
Resource
win7-20230220-en
Behavioral task
behavioral16
Sample
overrides/config/ChanceCubes/CustomRewards/Sounds/sounds.json
Resource
win10v2004-20230220-en
Behavioral task
behavioral17
Sample
overrides/config/ChanceCubes/chancecubes.cfg
Resource
win7-20230220-en
Behavioral task
behavioral18
Sample
overrides/config/ChanceCubes/chancecubes.cfg
Resource
win10v2004-20230220-en
Behavioral task
behavioral19
Sample
overrides/config/ChanceCubes/global_rewards.json
Resource
win7-20230220-en
Behavioral task
behavioral20
Sample
overrides/config/ChanceCubes/global_rewards.json
Resource
win10v2004-20230220-en
Behavioral task
behavioral21
Sample
overrides/config/CoroUtil/BlockDestruction.cfg
Resource
win7-20230220-en
Behavioral task
behavioral22
Sample
overrides/config/CoroUtil/BlockDestruction.cfg
Resource
win10v2004-20230220-en
Behavioral task
behavioral23
Sample
overrides/config/CoroUtil/General.cfg
Resource
win7-20230220-en
Behavioral task
behavioral24
Sample
overrides/config/CoroUtil/General.cfg
Resource
win10v2004-20230220-en
Behavioral task
behavioral25
Sample
overrides/config/Enhanced Armaments/abilities.cfg
Resource
win7-20230220-en
Behavioral task
behavioral26
Sample
overrides/config/Enhanced Armaments/abilities.cfg
Resource
win10v2004-20230221-en
Behavioral task
behavioral27
Sample
overrides/config/Enhanced Armaments/abilitychances.cfg
Resource
win7-20230220-en
Behavioral task
behavioral28
Sample
overrides/config/Enhanced Armaments/abilitychances.cfg
Resource
win10v2004-20230220-en
Behavioral task
behavioral29
Sample
overrides/config/Enhanced Armaments/main.cfg
Resource
win7-20230220-en
Behavioral task
behavioral30
Sample
overrides/config/Enhanced Armaments/main.cfg
Resource
win10v2004-20230220-en
Behavioral task
behavioral31
Sample
overrides/config/Enhanced Armaments/rarities.cfg
Resource
win7-20230220-en
Behavioral task
behavioral32
Sample
overrides/config/Enhanced Armaments/rarities.cfg
Resource
win10v2004-20230220-en
General
-
Target
overrides/config/BaseMetals.cfg
-
Size
9KB
-
MD5
598d6980db95b5bb4f6e15e934a04e01
-
SHA1
7fab60c72c9fd1cc4dcdd84a7e1054c5b0680efe
-
SHA256
c05c24edda719e76f3aed34eab2a60ba0044fd59647442a968a3003ed1090080
-
SHA512
60dfc165df5eea73229228139e8741173b793d13da698f39d2d70242c84b1988cc7455f54274f222aa4181873436eec72285a6fa1857b5406f3d4882808bb2a9
-
SSDEEP
192:jMR51I5pzGjKyn4jeljxL4i+PWoiExqsiKEsQpvfF9:WmiExqsiKEsQpvfF9
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 10 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\cfg_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\cfg_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\.cfg rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\.cfg\ = "cfg_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\cfg_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\cfg_auto_file\shell\Read\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\cfg_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\cfg_auto_file\shell\Read rundll32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1816 AcroRd32.exe 1816 AcroRd32.exe 1816 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1344 wrote to memory of 376 1344 cmd.exe 28 PID 1344 wrote to memory of 376 1344 cmd.exe 28 PID 1344 wrote to memory of 376 1344 cmd.exe 28 PID 376 wrote to memory of 1816 376 rundll32.exe 29 PID 376 wrote to memory of 1816 376 rundll32.exe 29 PID 376 wrote to memory of 1816 376 rundll32.exe 29 PID 376 wrote to memory of 1816 376 rundll32.exe 29
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\overrides\config\BaseMetals.cfg1⤵
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\overrides\config\BaseMetals.cfg2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:376 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\overrides\config\BaseMetals.cfg"3⤵
- Suspicious use of SetWindowsHookEx
PID:1816
-
-