Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
31s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
03/06/2023, 16:00
Static task
static1
Behavioral task
behavioral1
Sample
Nový textový dokument.txt.vs
Resource
win7-20230220-en
4 signatures
60 seconds
Behavioral task
behavioral2
Sample
Nový textový dokument.txt.vs
Resource
win10v2004-20230220-en
7 signatures
60 seconds
General
-
Target
Nový textový dokument.txt.vs
-
Size
43B
-
MD5
dc8a33c9e7bc143facd1fba3ff81c20a
-
SHA1
0840d1cd2ed03714c765b297f831bdea6d56956c
-
SHA256
b29f9f6f7cff2de77f57efad229da6879e7efff691f9e3d8b2c684a0aa0dba1b
-
SHA512
3f65e0e76f275d7d8acbaa965158cfb50db34cdb0accfa97f55af01d643b8c5906191f655d6f2f08de70c2125dfe5f5849152ed472fc671ba26e0dc861ff0d34
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1580 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 948 wrote to memory of 1580 948 cmd.exe 29 PID 948 wrote to memory of 1580 948 cmd.exe 29 PID 948 wrote to memory of 1580 948 cmd.exe 29
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Nový textový dokument.txt.vs"1⤵
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Nový textový dokument.txt.vs2⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:1580
-