Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    89s
  • max time network
    32s
  • platform
    windows7_x64
  • resource
    win7-20230621-en
  • resource tags

    arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
  • submitted
    02/07/2023, 16:15

General

  • Target

    CR___SO_HACK__1337.rar

  • Size

    3KB

  • MD5

    44df73c6da4aa258f9dd70aaa968d365

  • SHA1

    c4ed4b91ed245700dcf7d1e592c4f7a52ff9113f

  • SHA256

    76a4f73b932dd826e2ad807e0084d39e19decb186ecfc0dcced29729ac7aa5e4

  • SHA512

    82558ad75a96a31cdf589ed572977884bd9669bbabf9e4b4b1492b36f13c441c4080972650899207d00d7cf7564f6d50ac95b8168eda362a1cd5de419119eb12

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\CR___SO_HACK__1337.rar
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1748
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\CR___SO_HACK__1337.rar
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1648
      • C:\Program Files\VideoLAN\VLC\vlc.exe
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\CR___SO_HACK__1337.rar"
        3⤵
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:428

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/428-78-0x000000013FEF0000-0x000000013FFE8000-memory.dmp

    Filesize

    992KB

  • memory/428-79-0x000007FEF7650000-0x000007FEF7684000-memory.dmp

    Filesize

    208KB

  • memory/428-80-0x000007FEF6C20000-0x000007FEF6ED4000-memory.dmp

    Filesize

    2.7MB

  • memory/428-81-0x000007FEFBAD0000-0x000007FEFBAE8000-memory.dmp

    Filesize

    96KB

  • memory/428-82-0x000007FEF7630000-0x000007FEF7647000-memory.dmp

    Filesize

    92KB

  • memory/428-83-0x000007FEF7610000-0x000007FEF7621000-memory.dmp

    Filesize

    68KB

  • memory/428-84-0x000007FEF6FE0000-0x000007FEF6FF7000-memory.dmp

    Filesize

    92KB

  • memory/428-85-0x000007FEF6FC0000-0x000007FEF6FD1000-memory.dmp

    Filesize

    68KB

  • memory/428-86-0x000007FEF6FA0000-0x000007FEF6FBD000-memory.dmp

    Filesize

    116KB

  • memory/428-87-0x000007FEF6F80000-0x000007FEF6F91000-memory.dmp

    Filesize

    68KB

  • memory/428-88-0x000007FEF5AF0000-0x000007FEF6B9B000-memory.dmp

    Filesize

    16.7MB

  • memory/428-89-0x000007FEF58F0000-0x000007FEF5AF0000-memory.dmp

    Filesize

    2.0MB

  • memory/428-90-0x000007FEF6BE0000-0x000007FEF6C1F000-memory.dmp

    Filesize

    252KB

  • memory/428-91-0x000007FEF58C0000-0x000007FEF58E1000-memory.dmp

    Filesize

    132KB

  • memory/428-92-0x000007FEF58A0000-0x000007FEF58B8000-memory.dmp

    Filesize

    96KB

  • memory/428-94-0x000007FEF5860000-0x000007FEF5871000-memory.dmp

    Filesize

    68KB

  • memory/428-93-0x000007FEF5880000-0x000007FEF5891000-memory.dmp

    Filesize

    68KB

  • memory/428-95-0x000007FEF5840000-0x000007FEF5851000-memory.dmp

    Filesize

    68KB

  • memory/428-96-0x000007FEF5820000-0x000007FEF583B000-memory.dmp

    Filesize

    108KB

  • memory/428-97-0x000007FEF5800000-0x000007FEF5811000-memory.dmp

    Filesize

    68KB

  • memory/428-98-0x000007FEF57E0000-0x000007FEF57F8000-memory.dmp

    Filesize

    96KB

  • memory/428-99-0x000007FEF57B0000-0x000007FEF57E0000-memory.dmp

    Filesize

    192KB

  • memory/428-100-0x000007FEF5740000-0x000007FEF57A7000-memory.dmp

    Filesize

    412KB

  • memory/428-101-0x000007FEF56B0000-0x000007FEF571F000-memory.dmp

    Filesize

    444KB

  • memory/428-102-0x000007FEF5690000-0x000007FEF56A1000-memory.dmp

    Filesize

    68KB

  • memory/428-103-0x000007FEF5630000-0x000007FEF5686000-memory.dmp

    Filesize

    344KB

  • memory/428-104-0x000007FEF5600000-0x000007FEF5628000-memory.dmp

    Filesize

    160KB

  • memory/428-105-0x000007FEF55D0000-0x000007FEF55F4000-memory.dmp

    Filesize

    144KB

  • memory/428-106-0x000007FEF55B0000-0x000007FEF55C7000-memory.dmp

    Filesize

    92KB

  • memory/428-107-0x000007FEF5580000-0x000007FEF55A3000-memory.dmp

    Filesize

    140KB

  • memory/428-108-0x000007FEF5490000-0x000007FEF54A1000-memory.dmp

    Filesize

    68KB

  • memory/428-109-0x000007FEF5470000-0x000007FEF5482000-memory.dmp

    Filesize

    72KB

  • memory/428-110-0x000007FEF5440000-0x000007FEF5461000-memory.dmp

    Filesize

    132KB

  • memory/428-111-0x000007FEF5420000-0x000007FEF5433000-memory.dmp

    Filesize

    76KB

  • memory/428-112-0x000007FEF5400000-0x000007FEF5412000-memory.dmp

    Filesize

    72KB

  • memory/428-113-0x000007FEF52C0000-0x000007FEF53FB000-memory.dmp

    Filesize

    1.2MB

  • memory/428-114-0x000007FEF5290000-0x000007FEF52BC000-memory.dmp

    Filesize

    176KB

  • memory/428-115-0x000007FEF50D0000-0x000007FEF5282000-memory.dmp

    Filesize

    1.7MB

  • memory/428-116-0x000007FEF4FD0000-0x000007FEF502C000-memory.dmp

    Filesize

    368KB

  • memory/428-117-0x000007FEF4FB0000-0x000007FEF4FC1000-memory.dmp

    Filesize

    68KB

  • memory/428-118-0x000007FEF4F10000-0x000007FEF4FA7000-memory.dmp

    Filesize

    604KB

  • memory/428-119-0x000007FEF4DB0000-0x000007FEF4DC2000-memory.dmp

    Filesize

    72KB

  • memory/428-120-0x000007FEF4B70000-0x000007FEF4DA1000-memory.dmp

    Filesize

    2.2MB

  • memory/428-121-0x000007FEF49E0000-0x000007FEF4AF2000-memory.dmp

    Filesize

    1.1MB

  • memory/428-122-0x000007FEF4530000-0x000007FEF4565000-memory.dmp

    Filesize

    212KB

  • memory/428-123-0x000007FEF4490000-0x000007FEF44B5000-memory.dmp

    Filesize

    148KB

  • memory/428-124-0x000007FEF42B0000-0x000007FEF42C1000-memory.dmp

    Filesize

    68KB

  • memory/428-125-0x000007FEF4240000-0x000007FEF42A1000-memory.dmp

    Filesize

    388KB

  • memory/428-126-0x000007FEF4220000-0x000007FEF4231000-memory.dmp

    Filesize

    68KB

  • memory/428-127-0x000007FEF4200000-0x000007FEF4212000-memory.dmp

    Filesize

    72KB

  • memory/428-128-0x000007FEF41E0000-0x000007FEF41F3000-memory.dmp

    Filesize

    76KB

  • memory/428-129-0x000007FEF40F0000-0x000007FEF418F000-memory.dmp

    Filesize

    636KB

  • memory/428-130-0x000007FEF3F80000-0x000007FEF3F91000-memory.dmp

    Filesize

    68KB

  • memory/428-131-0x000007FEF3E70000-0x000007FEF3F72000-memory.dmp

    Filesize

    1.0MB

  • memory/428-132-0x000007FEF3E50000-0x000007FEF3E61000-memory.dmp

    Filesize

    68KB

  • memory/428-133-0x000007FEF3E30000-0x000007FEF3E41000-memory.dmp

    Filesize

    68KB

  • memory/428-134-0x000007FEF3AC0000-0x000007FEF3AD1000-memory.dmp

    Filesize

    68KB

  • memory/428-135-0x000007FEF3AA0000-0x000007FEF3AB2000-memory.dmp

    Filesize

    72KB

  • memory/428-136-0x000007FEF3A80000-0x000007FEF3A98000-memory.dmp

    Filesize

    96KB

  • memory/428-137-0x000007FEF3A60000-0x000007FEF3A76000-memory.dmp

    Filesize

    88KB

  • memory/428-138-0x000007FEF3A30000-0x000007FEF3A59000-memory.dmp

    Filesize

    164KB

  • memory/428-139-0x000007FEF3A10000-0x000007FEF3A22000-memory.dmp

    Filesize

    72KB

  • memory/428-140-0x000007FEF37F0000-0x000007FEF3801000-memory.dmp

    Filesize

    68KB

  • memory/428-141-0x000007FEF37D0000-0x000007FEF37E1000-memory.dmp

    Filesize

    68KB