Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    86s
  • max time network
    44s
  • platform
    windows7_x64
  • resource
    win7-20230703-en
  • resource tags

    arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
  • submitted
    06/07/2023, 22:10

General

  • Target

    MaritasGame.rar

  • Size

    46.9MB

  • MD5

    2be360b964a23bdb077791fc0b95e5e3

  • SHA1

    8b9e207bdfb1307f3f53b52a7a4abb4c6af74f3e

  • SHA256

    a9ac9bec8258026d4a82c4bbc46bbf5e7fbdc95acef7619185051a50f8b9a702

  • SHA512

    0787c14ae2af4c588984120d1bae32b4010ae788a50e8f37521b5ee544390519f970f90e7f1ac4738e30fd776dd9a7d3033703e8ebbd41ca48f63aa1ee80e03e

  • SSDEEP

    786432:a4DKYy7zy3Nz2mM26w6+iMPibavUz9PQABKGNlOJvVoiEKPLYk/f3zNZ4:aMYzc5h57tGBKGNIJOiDD/f3zN2

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 10 IoCs
  • Suspicious use of SendNotifyMessage 9 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\MaritasGame.rar
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2424
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\MaritasGame.rar
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2448
      • C:\Program Files\VideoLAN\VLC\vlc.exe
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\MaritasGame.rar"
        3⤵
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:3044
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:2688
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x5d0
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2096

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3044-85-0x000000013FF20000-0x0000000140018000-memory.dmp

      Filesize

      992KB

    • memory/3044-86-0x000007FEFB120000-0x000007FEFB154000-memory.dmp

      Filesize

      208KB

    • memory/3044-88-0x000007FEFB7C0000-0x000007FEFB7D8000-memory.dmp

      Filesize

      96KB

    • memory/3044-87-0x000007FEF6570000-0x000007FEF6824000-memory.dmp

      Filesize

      2.7MB

    • memory/3044-89-0x000007FEFB0D0000-0x000007FEFB0E7000-memory.dmp

      Filesize

      92KB

    • memory/3044-90-0x000007FEFB0B0000-0x000007FEFB0C1000-memory.dmp

      Filesize

      68KB

    • memory/3044-91-0x000007FEFB090000-0x000007FEFB0A7000-memory.dmp

      Filesize

      92KB

    • memory/3044-92-0x000007FEFADF0000-0x000007FEFAE01000-memory.dmp

      Filesize

      68KB

    • memory/3044-93-0x000007FEFADD0000-0x000007FEFADED000-memory.dmp

      Filesize

      116KB

    • memory/3044-94-0x000007FEFADB0000-0x000007FEFADC1000-memory.dmp

      Filesize

      68KB

    • memory/3044-95-0x000007FEF6990000-0x000007FEF6B90000-memory.dmp

      Filesize

      2.0MB

    • memory/3044-96-0x000007FEF4DE0000-0x000007FEF5E8B000-memory.dmp

      Filesize

      16.7MB

    • memory/3044-97-0x000007FEFAD70000-0x000007FEFADAF000-memory.dmp

      Filesize

      252KB

    • memory/3044-98-0x000007FEFAD40000-0x000007FEFAD61000-memory.dmp

      Filesize

      132KB

    • memory/3044-100-0x000007FEFABD0000-0x000007FEFABE1000-memory.dmp

      Filesize

      68KB

    • memory/3044-101-0x000007FEFABB0000-0x000007FEFABC1000-memory.dmp

      Filesize

      68KB

    • memory/3044-99-0x000007FEFABF0000-0x000007FEFAC08000-memory.dmp

      Filesize

      96KB

    • memory/3044-102-0x000007FEFAB90000-0x000007FEFABA1000-memory.dmp

      Filesize

      68KB

    • memory/3044-103-0x000007FEFAB70000-0x000007FEFAB8B000-memory.dmp

      Filesize

      108KB

    • memory/3044-105-0x000007FEF6C90000-0x000007FEF6CA8000-memory.dmp

      Filesize

      96KB

    • memory/3044-106-0x000007FEF6C60000-0x000007FEF6C90000-memory.dmp

      Filesize

      192KB

    • memory/3044-104-0x000007FEFAB50000-0x000007FEFAB61000-memory.dmp

      Filesize

      68KB

    • memory/3044-107-0x000007FEF6920000-0x000007FEF6987000-memory.dmp

      Filesize

      412KB

    • memory/3044-108-0x000007FEF6500000-0x000007FEF656F000-memory.dmp

      Filesize

      444KB

    • memory/3044-109-0x000007FEF6C40000-0x000007FEF6C51000-memory.dmp

      Filesize

      68KB

    • memory/3044-110-0x000007FEF64A0000-0x000007FEF64F6000-memory.dmp

      Filesize

      344KB

    • memory/3044-111-0x000007FEF68A0000-0x000007FEF68C8000-memory.dmp

      Filesize

      160KB

    • memory/3044-112-0x000007FEF6470000-0x000007FEF6494000-memory.dmp

      Filesize

      144KB

    • memory/3044-113-0x000007FEF6C20000-0x000007FEF6C37000-memory.dmp

      Filesize

      92KB

    • memory/3044-114-0x000007FEF6440000-0x000007FEF6463000-memory.dmp

      Filesize

      140KB

    • memory/3044-116-0x000007FEF6400000-0x000007FEF6412000-memory.dmp

      Filesize

      72KB

    • memory/3044-117-0x000007FEF63D0000-0x000007FEF63F1000-memory.dmp

      Filesize

      132KB

    • memory/3044-115-0x000007FEF6420000-0x000007FEF6431000-memory.dmp

      Filesize

      68KB

    • memory/3044-118-0x000007FEF63B0000-0x000007FEF63C3000-memory.dmp

      Filesize

      76KB

    • memory/3044-119-0x000007FEF7320000-0x000007FEF7332000-memory.dmp

      Filesize

      72KB

    • memory/3044-120-0x000007FEF6270000-0x000007FEF63AB000-memory.dmp

      Filesize

      1.2MB

    • memory/3044-121-0x000007FEF72F0000-0x000007FEF731C000-memory.dmp

      Filesize

      176KB

    • memory/3044-122-0x000007FEF60B0000-0x000007FEF6262000-memory.dmp

      Filesize

      1.7MB

    • memory/3044-123-0x000007FEF7290000-0x000007FEF72EC000-memory.dmp

      Filesize

      368KB

    • memory/3044-124-0x000007FEF7270000-0x000007FEF7281000-memory.dmp

      Filesize

      68KB

    • memory/3044-125-0x000007FEF5F40000-0x000007FEF5FD7000-memory.dmp

      Filesize

      604KB

    • memory/3044-126-0x000007FEF5F20000-0x000007FEF5F32000-memory.dmp

      Filesize

      72KB

    • memory/3044-127-0x000007FEF4BA0000-0x000007FEF4DD1000-memory.dmp

      Filesize

      2.2MB

    • memory/3044-128-0x000007FEF4A80000-0x000007FEF4B92000-memory.dmp

      Filesize

      1.1MB

    • memory/3044-129-0x000007FEF5EE0000-0x000007FEF5F15000-memory.dmp

      Filesize

      212KB

    • memory/3044-130-0x000007FEF49B0000-0x000007FEF49D5000-memory.dmp

      Filesize

      148KB

    • memory/3044-131-0x000007FEF5EC0000-0x000007FEF5ED1000-memory.dmp

      Filesize

      68KB

    • memory/3044-132-0x000007FEF48D0000-0x000007FEF4931000-memory.dmp

      Filesize

      388KB

    • memory/3044-133-0x000007FEF48B0000-0x000007FEF48C1000-memory.dmp

      Filesize

      68KB

    • memory/3044-134-0x000007FEF4890000-0x000007FEF48A2000-memory.dmp

      Filesize

      72KB

    • memory/3044-135-0x000007FEF4620000-0x000007FEF4633000-memory.dmp

      Filesize

      76KB

    • memory/3044-136-0x000007FEF4580000-0x000007FEF461F000-memory.dmp

      Filesize

      636KB

    • memory/3044-137-0x000007FEF3EC0000-0x000007FEF3ED1000-memory.dmp

      Filesize

      68KB

    • memory/3044-138-0x000007FEF3DB0000-0x000007FEF3EB2000-memory.dmp

      Filesize

      1.0MB

    • memory/3044-139-0x000007FEF36A0000-0x000007FEF36B1000-memory.dmp

      Filesize

      68KB

    • memory/3044-140-0x000007FEF3680000-0x000007FEF3691000-memory.dmp

      Filesize

      68KB

    • memory/3044-141-0x000007FEF3860000-0x000007FEF3871000-memory.dmp

      Filesize

      68KB

    • memory/3044-142-0x000007FEF3840000-0x000007FEF3852000-memory.dmp

      Filesize

      72KB

    • memory/3044-143-0x000007FEF3800000-0x000007FEF3818000-memory.dmp

      Filesize

      96KB

    • memory/3044-144-0x000007FEF37E0000-0x000007FEF37F6000-memory.dmp

      Filesize

      88KB

    • memory/3044-145-0x000007FEF37B0000-0x000007FEF37D9000-memory.dmp

      Filesize

      164KB

    • memory/3044-146-0x000007FEF3790000-0x000007FEF37A2000-memory.dmp

      Filesize

      72KB

    • memory/3044-147-0x000007FEF3770000-0x000007FEF3781000-memory.dmp

      Filesize

      68KB

    • memory/3044-148-0x000007FEF3750000-0x000007FEF3761000-memory.dmp

      Filesize

      68KB