Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
102s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
08/07/2023, 07:03
Static task
static1
Behavioral task
behavioral1
Sample
sample.tar
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
sample.tar
Resource
win10v2004-20230703-en
Behavioral task
behavioral3
Sample
Serviio-2.3.1.pkg
Resource
macos-20220504-en
General
-
Target
sample.tar
-
Size
118.5MB
-
MD5
dd6b91364c768fb695d050af838cfd66
-
SHA1
2b01a57d8ab145a8ce550c788c47791c2c42d8ed
-
SHA256
34bab9b7405b9a6cb891218c72b4b22cc74521436d96a57e4dd9b5c26daf5cf3
-
SHA512
60ac64d19f8466ee02ce19b0a95382ad8f82b3a480b43518bb79df05787eee2d283247e483f5d215d1cb20fde07f09bde8b10528e196972ab87119d45db214e1
-
SSDEEP
1572864:EFlPNePr10q1vo8T5SnMp8dRlfC3KsRfOswBgFNBmy2yyq32M8l7uBfjG6d4B6cP:OQR0q1l5SnMuRlq3K8PbBmy2yCM8ssV
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1088 OpenWith.exe