Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

02/11/2023, 10:34

231102-mmgaksae71 1

02/11/2023, 10:34

231102-ml5xjsae7x 1

02/11/2023, 10:29

231102-mjqd3sae6v 1

05/07/2023, 08:42

230705-kl1xgsbc48 5

05/07/2023, 08:25

230705-kbnt6scg8t 1

05/07/2023, 08:22

230705-j9zhwscg7x 6

05/07/2023, 07:57

230705-jtdaqacg4x 3

04/07/2023, 14:49

230704-r67n4aff71 1

Analysis

  • max time kernel
    38s
  • max time network
    39s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/07/2023, 08:42

General

  • Target

    Screenshot 2022-11-10 13.41.34.png

  • Size

    1KB

  • MD5

    b38e48ea9655ce9b04556914b034b62c

  • SHA1

    abb0088bc9faf5d44fef3bed79729da1cac04be6

  • SHA256

    11b0eec98c8b9b8a41e0e77b1c660f3c582961d158a678a215c73c919f119f37

  • SHA512

    e737ef9b36fd17e6c6c101624fc6c6c2ff330b5b3fa9fd371af919a6711cca1354cc096dc01170c1ef629524c03c8e00230cada17faf2a6a2e2f6c689f154f6c

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\Screenshot 2022-11-10 13.41.34.png"
    1⤵
      PID:1068
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:3624
      • C:\Windows\system32\mspaint.exe
        "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\Screenshot 2022-11-10 13.41.34.png" /ForceBootstrapPaint3D
        1⤵
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:2596
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
        1⤵
        • Drops file in System32 directory
        PID:1092
      • C:\Windows\system32\mspaint.exe
        "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\Screenshot 2022-11-10 13.41.34.png" /ForceBootstrapPaint3D
        1⤵
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:4716
      • C:\Windows\system32\OpenWith.exe
        C:\Windows\system32\OpenWith.exe -Embedding
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:3780
      • C:\Windows\system32\OpenWith.exe
        C:\Windows\system32\OpenWith.exe -Embedding
        1⤵
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2004

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1092-133-0x0000020975B60000-0x0000020975B70000-memory.dmp

        Filesize

        64KB

      • memory/1092-137-0x0000020975BB0000-0x0000020975BC0000-memory.dmp

        Filesize

        64KB

      • memory/1092-144-0x000002097E7F0000-0x000002097E7F1000-memory.dmp

        Filesize

        4KB

      • memory/1092-146-0x000002097E870000-0x000002097E871000-memory.dmp

        Filesize

        4KB

      • memory/1092-148-0x000002097E870000-0x000002097E871000-memory.dmp

        Filesize

        4KB

      • memory/1092-149-0x000002097E900000-0x000002097E901000-memory.dmp

        Filesize

        4KB

      • memory/1092-150-0x000002097E900000-0x000002097E901000-memory.dmp

        Filesize

        4KB

      • memory/1092-151-0x000002097E910000-0x000002097E911000-memory.dmp

        Filesize

        4KB

      • memory/1092-152-0x000002097E910000-0x000002097E911000-memory.dmp

        Filesize

        4KB