Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    137s
  • max time network
    32s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    25/08/2023, 03:13

General

  • Target

    GGXXACPRKV.part1.rar

  • Size

    500.0MB

  • MD5

    3fcba5756e5bedc15bc448fc15ed55d7

  • SHA1

    24a832d2c0963249df142b3c018f322fbc3f8f61

  • SHA256

    df3f0afdad0063eb89aae61632112b3f129a9976bf338f73347a31e6083d1a78

  • SHA512

    39f22ea0b497b8f1757b4a4b957738ff4e526c69801fb8ed50ee52905ea4e47f7202468d170bc17cf699e7863f4d6e5776ef743924e45809486aa6dc1f731e03

  • SSDEEP

    12582912:Krolh/3aUx1n+ocqVcHPpUVuzTMgmAvDgqq8UN6LZ:KUl9KZorcvpUVW3bD

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\GGXXACPRKV.part1.rar
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2184
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\GGXXACPRKV.part1.rar
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2144
      • C:\Program Files\VideoLAN\VLC\vlc.exe
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\GGXXACPRKV.part1.rar"
        3⤵
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:2812

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2812-29-0x000000013FAE0000-0x000000013FBD8000-memory.dmp

    Filesize

    992KB

  • memory/2812-30-0x000007FEFA5E0000-0x000007FEFA614000-memory.dmp

    Filesize

    208KB

  • memory/2812-31-0x000007FEF5AD0000-0x000007FEF5D84000-memory.dmp

    Filesize

    2.7MB

  • memory/2812-32-0x000007FEFB560000-0x000007FEFB578000-memory.dmp

    Filesize

    96KB

  • memory/2812-35-0x000007FEF74C0000-0x000007FEF74D7000-memory.dmp

    Filesize

    92KB

  • memory/2812-34-0x000007FEF74E0000-0x000007FEF74F1000-memory.dmp

    Filesize

    68KB

  • memory/2812-33-0x000007FEFA8C0000-0x000007FEFA8D7000-memory.dmp

    Filesize

    92KB

  • memory/2812-36-0x000007FEF74A0000-0x000007FEF74B1000-memory.dmp

    Filesize

    68KB

  • memory/2812-37-0x000007FEF7440000-0x000007FEF745D000-memory.dmp

    Filesize

    116KB

  • memory/2812-38-0x000007FEF58D0000-0x000007FEF5AD0000-memory.dmp

    Filesize

    2.0MB

  • memory/2812-39-0x000007FEF7420000-0x000007FEF7431000-memory.dmp

    Filesize

    68KB

  • memory/2812-40-0x000007FEF7230000-0x000007FEF726F000-memory.dmp

    Filesize

    252KB

  • memory/2812-41-0x000007FEF6CF0000-0x000007FEF6D11000-memory.dmp

    Filesize

    132KB

  • memory/2812-42-0x000007FEF7400000-0x000007FEF7418000-memory.dmp

    Filesize

    96KB

  • memory/2812-43-0x000007FEF6CD0000-0x000007FEF6CE1000-memory.dmp

    Filesize

    68KB

  • memory/2812-44-0x000007FEF6CB0000-0x000007FEF6CC1000-memory.dmp

    Filesize

    68KB

  • memory/2812-45-0x000007FEF6C90000-0x000007FEF6CA1000-memory.dmp

    Filesize

    68KB

  • memory/2812-46-0x000007FEF6670000-0x000007FEF668B000-memory.dmp

    Filesize

    108KB

  • memory/2812-47-0x000007FEF6650000-0x000007FEF6661000-memory.dmp

    Filesize

    68KB

  • memory/2812-48-0x000007FEF6630000-0x000007FEF6648000-memory.dmp

    Filesize

    96KB

  • memory/2812-49-0x000007FEF6600000-0x000007FEF6630000-memory.dmp

    Filesize

    192KB

  • memory/2812-50-0x000007FEF4820000-0x000007FEF58CB000-memory.dmp

    Filesize

    16.7MB

  • memory/2812-51-0x000007FEF61A0000-0x000007FEF6207000-memory.dmp

    Filesize

    412KB

  • memory/2812-52-0x000007FEF6130000-0x000007FEF619F000-memory.dmp

    Filesize

    444KB

  • memory/2812-53-0x000007FEF6110000-0x000007FEF6121000-memory.dmp

    Filesize

    68KB

  • memory/2812-54-0x000007FEF46F0000-0x000007FEF4746000-memory.dmp

    Filesize

    344KB

  • memory/2812-55-0x000007FEF46C0000-0x000007FEF46E8000-memory.dmp

    Filesize

    160KB

  • memory/2812-56-0x000007FEF4690000-0x000007FEF46B4000-memory.dmp

    Filesize

    144KB

  • memory/2812-57-0x000007FEF4670000-0x000007FEF4687000-memory.dmp

    Filesize

    92KB

  • memory/2812-58-0x000007FEF4640000-0x000007FEF4663000-memory.dmp

    Filesize

    140KB

  • memory/2812-59-0x000007FEF4620000-0x000007FEF4631000-memory.dmp

    Filesize

    68KB

  • memory/2812-60-0x000007FEF4600000-0x000007FEF4612000-memory.dmp

    Filesize

    72KB

  • memory/2812-61-0x000007FEF45D0000-0x000007FEF45F1000-memory.dmp

    Filesize

    132KB

  • memory/2812-62-0x000007FEF4510000-0x000007FEF4523000-memory.dmp

    Filesize

    76KB

  • memory/2812-63-0x000007FEF44F0000-0x000007FEF4502000-memory.dmp

    Filesize

    72KB

  • memory/2812-65-0x000007FEF3C70000-0x000007FEF3C9C000-memory.dmp

    Filesize

    176KB

  • memory/2812-64-0x000007FEF43B0000-0x000007FEF44EB000-memory.dmp

    Filesize

    1.2MB

  • memory/2812-66-0x000007FEF3A60000-0x000007FEF3C12000-memory.dmp

    Filesize

    1.7MB

  • memory/2812-67-0x000007FEF3520000-0x000007FEF357C000-memory.dmp

    Filesize

    368KB

  • memory/2812-68-0x000007FEF3500000-0x000007FEF3511000-memory.dmp

    Filesize

    68KB

  • memory/2812-69-0x000007FEF3440000-0x000007FEF34D7000-memory.dmp

    Filesize

    604KB

  • memory/2812-70-0x000007FEF3420000-0x000007FEF3432000-memory.dmp

    Filesize

    72KB

  • memory/2812-71-0x000007FEF31E0000-0x000007FEF3411000-memory.dmp

    Filesize

    2.2MB

  • memory/2812-73-0x000007FEF3070000-0x000007FEF3095000-memory.dmp

    Filesize

    148KB

  • memory/2812-72-0x000007FEF31A0000-0x000007FEF31D5000-memory.dmp

    Filesize

    212KB

  • memory/2812-74-0x000007FEF3050000-0x000007FEF3061000-memory.dmp

    Filesize

    68KB

  • memory/2812-75-0x000007FEF2FE0000-0x000007FEF3041000-memory.dmp

    Filesize

    388KB

  • memory/2812-77-0x000007FEF2FC0000-0x000007FEF2FD2000-memory.dmp

    Filesize

    72KB

  • memory/2812-76-0x000007FEF2DC0000-0x000007FEF2DD1000-memory.dmp

    Filesize

    68KB

  • memory/2812-78-0x000007FEF2FA0000-0x000007FEF2FB3000-memory.dmp

    Filesize

    76KB

  • memory/2812-80-0x000007FEF2EE0000-0x000007FEF2EF1000-memory.dmp

    Filesize

    68KB

  • memory/2812-79-0x000007FEF2F00000-0x000007FEF2F9F000-memory.dmp

    Filesize

    636KB

  • memory/2812-81-0x000007FEF2CB0000-0x000007FEF2DB2000-memory.dmp

    Filesize

    1.0MB

  • memory/2812-82-0x000007FEF2EC0000-0x000007FEF2ED1000-memory.dmp

    Filesize

    68KB

  • memory/2812-83-0x000007FEF2B30000-0x000007FEF2CA8000-memory.dmp

    Filesize

    1.5MB

  • memory/2812-84-0x000007FEF2EA0000-0x000007FEF2EB7000-memory.dmp

    Filesize

    92KB

  • memory/2812-85-0x000007FEF2E80000-0x000007FEF2E91000-memory.dmp

    Filesize

    68KB

  • memory/2812-86-0x000007FEF2E60000-0x000007FEF2E71000-memory.dmp

    Filesize

    68KB

  • memory/2812-87-0x000007FEF2E40000-0x000007FEF2E52000-memory.dmp

    Filesize

    72KB

  • memory/2812-88-0x000007FEF2E20000-0x000007FEF2E38000-memory.dmp

    Filesize

    96KB

  • memory/2812-89-0x000007FEF2E00000-0x000007FEF2E16000-memory.dmp

    Filesize

    88KB

  • memory/2812-90-0x000007FEF29C0000-0x000007FEF29E9000-memory.dmp

    Filesize

    164KB

  • memory/2812-91-0x000007FEF2DE0000-0x000007FEF2DF2000-memory.dmp

    Filesize

    72KB

  • memory/2812-92-0x000007FEF29A0000-0x000007FEF29B1000-memory.dmp

    Filesize

    68KB