Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
128s -
max time network
32s -
platform
windows7_x64 -
resource
win7-20230703-en -
resource tags
arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system -
submitted
08/07/2023, 07:03
Static task
static1
Behavioral task
behavioral1
Sample
sample.tar
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
sample.tar
Resource
win10v2004-20230703-en
Behavioral task
behavioral3
Sample
Serviio-2.3.1.pkg
Resource
macos-20220504-en
General
-
Target
sample.tar
-
Size
118.5MB
-
MD5
dd6b91364c768fb695d050af838cfd66
-
SHA1
2b01a57d8ab145a8ce550c788c47791c2c42d8ed
-
SHA256
34bab9b7405b9a6cb891218c72b4b22cc74521436d96a57e4dd9b5c26daf5cf3
-
SHA512
60ac64d19f8466ee02ce19b0a95382ad8f82b3a480b43518bb79df05787eee2d283247e483f5d215d1cb20fde07f09bde8b10528e196972ab87119d45db214e1
-
SSDEEP
1572864:EFlPNePr10q1vo8T5SnMp8dRlfC3KsRfOswBgFNBmy2yyq32M8l7uBfjG6d4B6cP:OQR0q1l5SnMuRlq3K8PbBmy2yCM8ssV
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000_CLASSES\tar_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000_CLASSES\tar_auto_file\ rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000_CLASSES\.tar\ = "tar_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000_CLASSES\tar_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000_CLASSES\tar_auto_file\shell rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000_CLASSES\tar_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000_CLASSES\.tar rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000_CLASSES\tar_auto_file\shell\Read\command rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3044 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3044 AcroRd32.exe 3044 AcroRd32.exe 3044 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2424 wrote to memory of 2448 2424 cmd.exe 29 PID 2424 wrote to memory of 2448 2424 cmd.exe 29 PID 2424 wrote to memory of 2448 2424 cmd.exe 29 PID 2448 wrote to memory of 3044 2448 rundll32.exe 30 PID 2448 wrote to memory of 3044 2448 rundll32.exe 30 PID 2448 wrote to memory of 3044 2448 rundll32.exe 30 PID 2448 wrote to memory of 3044 2448 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\sample.tar1⤵
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\sample.tar2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\sample.tar"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3044
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD58ecb6499422425431fa07b710891392b
SHA1599b37085a072a15927831daea059c2472cd5781
SHA2563dcde4ea86a30028208003c540a0fc76a41a609a855e45d110653d9e50a0e544
SHA5129683681bdf84e75ef0d38aad0345741591dbc131f252724cc7446cb8c70a23e5539de30ebfc80e0c824e883023a77105aad3903cf191f50d2e1a5037e42b6147