Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
03/09/2023, 11:13
Static task
static1
Behavioral task
behavioral1
Sample
Setup Ozone Pro v10.4.0.7z
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
Setup Ozone Pro v10.4.0.7z
Resource
win10v2004-20230831-en
Behavioral task
behavioral3
Sample
Setup Ozone Pro v10.4.0-1.bin
Resource
win7-20230831-en
Behavioral task
behavioral4
Sample
Setup Ozone Pro v10.4.0-1.bin
Resource
win10v2004-20230831-en
General
-
Target
Setup Ozone Pro v10.4.0.7z
-
Size
297.6MB
-
MD5
33098f96ff3635a55dc660c798ea293a
-
SHA1
b4ad9b4efeace61e99e9611eefccfc2fa4176a50
-
SHA256
c38a6c61a77f5374a54f5a62ea9487052d57fbad2cb89167d81a79802fd53c5f
-
SHA512
7252c0809aa8052ff3072405107de5f34af574e8a7c33a00794d5a08b2d875010c75db0c1b1337a6f8ce9384c307177c04a02c04f16c43e5c58a7c7d5bd7948f
-
SSDEEP
6291456:tcGgBoEzp2e/MzsZmybC7Dgtzq25x6FGaPFL5Bv4tLODYuZK8s:tcGgBBf/MzAmqOktRx6RPFLL4mYGKX
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000_Classes\Local Settings rundll32.exe -
Suspicious use of FindShellTrayWindow 28 IoCs
pid Process 2672 rundll32.exe 2672 rundll32.exe 2672 rundll32.exe 2672 rundll32.exe 2672 rundll32.exe 2672 rundll32.exe 2672 rundll32.exe 2672 rundll32.exe 2672 rundll32.exe 2672 rundll32.exe 2672 rundll32.exe 2672 rundll32.exe 2672 rundll32.exe 2672 rundll32.exe 2672 rundll32.exe 2672 rundll32.exe 2672 rundll32.exe 2672 rundll32.exe 2672 rundll32.exe 2672 rundll32.exe 2672 rundll32.exe 2672 rundll32.exe 2672 rundll32.exe 2672 rundll32.exe 2672 rundll32.exe 2672 rundll32.exe 2672 rundll32.exe 2672 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1208 wrote to memory of 2672 1208 cmd.exe 31 PID 1208 wrote to memory of 2672 1208 cmd.exe 31 PID 1208 wrote to memory of 2672 1208 cmd.exe 31
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Setup Ozone Pro v10.4.0.7z"1⤵
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Setup Ozone Pro v10.4.0.7z2⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:2672
-