Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
322s -
max time network
326s -
platform
windows10-1703_x64 -
resource
win10-20230220-es -
resource tags
arch:x64arch:x86image:win10-20230220-eslocale:es-esos:windows10-1703-x64systemwindows -
submitted
12/06/2023, 00:36
Static task
static1
Behavioral task
behavioral1
Sample
Nueva carpeta.rar
Resource
win10-20230220-es
Behavioral task
behavioral2
Sample
e4551
Resource
win10-20230220-es
Behavioral task
behavioral3
Sample
e45511.155
Resource
win10-20230220-es
Behavioral task
behavioral4
Sample
e4551ai.exe
Resource
win10-20230220-es
General
-
Target
Nueva carpeta.rar
-
Size
3.1MB
-
MD5
570be0eba71407eb421079b5bf2f63a3
-
SHA1
ba8438cf87e096a496887d4e4ac5845364b0474f
-
SHA256
d5ab26dd15b9d540ee6c471730dc63c66aab8ae3b409083de087688f877d1c18
-
SHA512
d9ed826c1d3f1b945b0beef870f98c2a9b55f60c91def6c039e3fc038cf34806433409ca2f7f043d7fe1c7584290a5b191cf32193e0aa01f163debf350453b7a
-
SSDEEP
49152:w0sXQdnxCN59eB1U0oeKkra+889aqWhPinEVorDr2UbJyrua/Z3g9BWXnTxNFeHj:w864B5fKI7zGPiEYrVVJ+CWXnFNSeC
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings OpenWith.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 972 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 5028 OpenWith.exe 972 vlc.exe -
Suspicious use of FindShellTrayWindow 10 IoCs
pid Process 972 vlc.exe 972 vlc.exe 972 vlc.exe 972 vlc.exe 972 vlc.exe 972 vlc.exe 972 vlc.exe 972 vlc.exe 972 vlc.exe 972 vlc.exe -
Suspicious use of SendNotifyMessage 9 IoCs
pid Process 972 vlc.exe 972 vlc.exe 972 vlc.exe 972 vlc.exe 972 vlc.exe 972 vlc.exe 972 vlc.exe 972 vlc.exe 972 vlc.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 5028 OpenWith.exe 5028 OpenWith.exe 5028 OpenWith.exe 5028 OpenWith.exe 5028 OpenWith.exe 5028 OpenWith.exe 5028 OpenWith.exe 972 vlc.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 5028 wrote to memory of 972 5028 OpenWith.exe 68 PID 5028 wrote to memory of 972 5028 OpenWith.exe 68
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Nueva carpeta.rar"1⤵
- Modifies registry class
PID:3148
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Nueva carpeta.rar"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:972
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3640
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
93KB
MD57d5ef2dffb8d0f8c5dfde20525d9e9ec
SHA1875f7115389c71f411249b9e619c6c3c76ad4972
SHA25697f54303096bd3b0925de62fff499ebcaf6b152a7a49a805491b249fc2723b1e
SHA512a37ad0ecb44b1d10293792bc9b6e79c9d507ccab608ba82576c7e27f6f167a0c122593a2dce5da79a5bb5d6deb5a80707873e69307e106a3632f925c7c0b8d39