Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
7Minecraft ...om.apk
android-9-x86
0-0caa7.png
windows7-x64
30-0caa7.png
windows10-2004-x64
300_dcast_lineup.png
windows7-x64
300_dcast_lineup.png
windows10-2004-x64
301_Alex_Dcast.json
windows7-x64
301_Alex_Dcast.json
windows10-2004-x64
301_dcast_l...ri.png
windows7-x64
301_dcast_l...ri.png
windows10-2004-x64
302_ Noor_Dcast.json
windows7-x64
302_ Noor_Dcast.json
windows10-2004-x64
302_dcast_l...or.png
windows7-x64
302_dcast_l...or.png
windows10-2004-x64
503_Ari_Dcast.json
windows7-x64
303_Ari_Dcast.json
windows10-2004-x64
303_dcast_l...ai.png
windows7-x64
303_dcast_l...ai.png
windows10-2004-x64
304_Sunny_Dcast.json
windows7-x64
304_Sunny_Dcast.json
windows10-2004-x64
304_dcast_l...ri.png
windows7-x64
304_dcast_l...ri.png
windows10-2004-x64
305_Makena_Dcast.json
windows7-x64
305_Makena_Dcast.json
windows10-2004-x64
505_dcast_l...ve.png
windows7-x64
305_dcast_l...ve.png
windows10-2004-x64
306_Efe_Dcast.json
windows7-x64
306_Efe_Dcast.json
windows10-2004-x64
306_dcast_l...ex.png
windows7-x64
306_dcast_l...ex.png
windows10-2004-x64
307_Zuri_Dcast.json
windows7-x64
307_Zuri_Dcast.json
windows10-2004-x64
507_dcast_l...fe.png
windows7-x64
3Analysis
-
max time kernel
153s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20230621-en -
resource tags
arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system -
submitted
30/06/2023, 18:56
Static task
static1
Behavioral task
behavioral1
Sample
Minecraft PE 1.20.1. armyofgrissbyoficial.com.apk
Resource
android-x86-arm-20230621-en
Behavioral task
behavioral2
Sample
0-0caa7.png
Resource
win7-20230621-en
Behavioral task
behavioral3
Sample
0-0caa7.png
Resource
win10v2004-20230621-en
Behavioral task
behavioral4
Sample
00_dcast_lineup.png
Resource
win7-20230621-en
Behavioral task
behavioral5
Sample
00_dcast_lineup.png
Resource
win10v2004-20230621-en
Behavioral task
behavioral6
Sample
01_Alex_Dcast.json
Resource
win7-20230621-en
Behavioral task
behavioral7
Sample
01_Alex_Dcast.json
Resource
win10v2004-20230621-en
Behavioral task
behavioral8
Sample
01_dcast_lineup_zuri.png
Resource
win7-20230621-en
Behavioral task
behavioral9
Sample
01_dcast_lineup_zuri.png
Resource
win10v2004-20230621-en
Behavioral task
behavioral10
Sample
02_ Noor_Dcast.json
Resource
win7-20230621-en
Behavioral task
behavioral11
Sample
02_ Noor_Dcast.json
Resource
win10v2004-20230621-en
Behavioral task
behavioral12
Sample
02_dcast_lineup_noor.png
Resource
win7-20230621-en
Behavioral task
behavioral13
Sample
02_dcast_lineup_noor.png
Resource
win10v2004-20230621-en
Behavioral task
behavioral14
Sample
03_Ari_Dcast.json
Resource
win7-20230621-en
Behavioral task
behavioral15
Sample
03_Ari_Dcast.json
Resource
win10v2004-20230621-en
Behavioral task
behavioral16
Sample
03_dcast_lineup_kai.png
Resource
win7-20230621-en
Behavioral task
behavioral17
Sample
03_dcast_lineup_kai.png
Resource
win10v2004-20230621-en
Behavioral task
behavioral18
Sample
04_Sunny_Dcast.json
Resource
win7-20230621-en
Behavioral task
behavioral19
Sample
04_Sunny_Dcast.json
Resource
win10v2004-20230621-en
Behavioral task
behavioral20
Sample
04_dcast_lineup_ari.png
Resource
win7-20230621-en
Behavioral task
behavioral21
Sample
04_dcast_lineup_ari.png
Resource
win10v2004-20230621-en
Behavioral task
behavioral22
Sample
05_Makena_Dcast.json
Resource
win7-20230621-en
Behavioral task
behavioral23
Sample
05_Makena_Dcast.json
Resource
win10v2004-20230621-en
Behavioral task
behavioral24
Sample
05_dcast_lineup_steve.png
Resource
win7-20230621-en
Behavioral task
behavioral25
Sample
05_dcast_lineup_steve.png
Resource
win10v2004-20230621-en
Behavioral task
behavioral26
Sample
06_Efe_Dcast.json
Resource
win7-20230621-en
Behavioral task
behavioral27
Sample
06_Efe_Dcast.json
Resource
win10v2004-20230621-en
Behavioral task
behavioral28
Sample
06_dcast_lineup_alex.png
Resource
win7-20230621-en
Behavioral task
behavioral29
Sample
06_dcast_lineup_alex.png
Resource
win10v2004-20230621-en
Behavioral task
behavioral30
Sample
07_Zuri_Dcast.json
Resource
win7-20230621-en
Behavioral task
behavioral31
Sample
07_Zuri_Dcast.json
Resource
win10v2004-20230621-en
Behavioral task
behavioral32
Sample
07_dcast_lineup_efe.png
Resource
win7-20230621-en
General
-
Target
01_Alex_Dcast.json
-
Size
1KB
-
MD5
eb3161bfe706207cc4fdcc49ccd7bb0f
-
SHA1
392593bb0eb8d4cfd4319d97ed780694a7b46ed3
-
SHA256
8938f9c3ea27d7c972cb96e02547b37f0d3e90d8b03eb0c691573bce27c9f800
-
SHA512
dbb7607b3f27b4bf3515e12d76800e247127eccad5721317387cedd72fca1e5cb8e509f6b3fdb5890567053f996ea21791db7a664eca03d2320602294dcb0cf8
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_CLASSES\.json rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_CLASSES\.json\ = "json_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_CLASSES\json_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_CLASSES\json_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_CLASSES\json_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_CLASSES\json_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_CLASSES\json_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1240 AcroRd32.exe 1240 AcroRd32.exe 1240 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 304 wrote to memory of 1496 304 cmd.exe 28 PID 304 wrote to memory of 1496 304 cmd.exe 28 PID 304 wrote to memory of 1496 304 cmd.exe 28 PID 1496 wrote to memory of 1240 1496 rundll32.exe 30 PID 1496 wrote to memory of 1240 1496 rundll32.exe 30 PID 1496 wrote to memory of 1240 1496 rundll32.exe 30 PID 1496 wrote to memory of 1240 1496 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\01_Alex_Dcast.json1⤵
- Suspicious use of WriteProcessMemory
PID:304 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\01_Alex_Dcast.json2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\01_Alex_Dcast.json"3⤵
- Suspicious use of SetWindowsHookEx
PID:1240
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD51eb4a05526f59673c2959a1bc5e6fa55
SHA10a60a2d9d6ecdf36afdae91aeb0815485f467749
SHA2561117e8e932afaa6ec16af19723b4b1457d3d637656f5f76ea08632b08264cee3
SHA51289ee143ae1f51f13483c8b9d3c9df99fb8f92b4881a96295b4cdef749ace09848b4199969e914c2630bcbcaaf1c4f7723ea5c9baff731e200a0b8b2f49ce09f6