Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

03/10/2023, 14:56

231003-sbdm7scb8z 7

03/10/2023, 14:35

231003-rx4abadf82 7

02/10/2023, 22:39

231002-2k417afa8s 7

02/10/2023, 21:20

231002-z68v6aeg3z 7

Analysis

  • max time kernel
    150s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    02/10/2023, 22:39

General

  • Target

    baseline.prof

  • Size

    4KB

  • MD5

    c0005febcc06500ffc1ddb2694b441a0

  • SHA1

    1c4b85bed78d385b12297d23927ef3da14c62418

  • SHA256

    56cbf8db20ca474791006480e26347722ba94e5a251b206a670654eb4c185613

  • SHA512

    4d79fbc7b4cb86a9fe14eecc372966bd62818a2e6681ac563ab8046b608e700fec2caf93740d97d808ba9c2061c938128d2ba4e0310c0ade43749d4ae3c4a48f

  • SSDEEP

    96:qasxxxx2XoTjBT7TlgWewHRABhIZOiWsea8L11cDHmC3d5aswSZXDWSiw:qtxxxx20jZTlzeOCBIf8SHhd8BSZX6Sd

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\baseline.prof
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2208
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\baseline.prof
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2940
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\baseline.prof"
        3⤵
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2684

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    ebc2f070acb49fd73c364acb0d45a087

    SHA1

    df9086d3f9292a3284605ddd180e078422f89b71

    SHA256

    fdffcf14f3fcfc0b7ee9e44ed8f170f6d593034e852395d78cfb62da1e9db1bb

    SHA512

    db52a6ab26cfb81a36830501b8c0de1711afffe1ab00a0b00e125d662bf3ef6eefb2be3c4726717a542474510f6fc876ac7c64479cd522f889c7240bc03dcb01