Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
7ItsOnFire.apk
android-9-x86
ItsOnFire.apk
android-10-x64
ItsOnFire.apk
android-11-x64
1baseline.prof
windows7-x64
3baseline.prof
windows10-2004-x64
3baseline.profm
windows7-x64
3baseline.profm
windows10-2004-x64
3damageshelter.ogg
windows7-x64
1damageshelter.ogg
windows10-2004-x64
7invaderexplode.ogg
windows7-x64
1invaderexplode.ogg
windows10-2004-x64
7oh.ogg
windows7-x64
1oh.ogg
windows10-2004-x64
7playerexplode.ogg
windows7-x64
1playerexplode.ogg
windows10-2004-x64
7shoot.ogg
windows7-x64
1shoot.ogg
windows10-2004-x64
7uh.ogg
windows7-x64
1uh.ogg
windows10-2004-x64
7Resubmissions
03/10/2023, 14:56
231003-sbdm7scb8z 703/10/2023, 14:35
231003-rx4abadf82 702/10/2023, 22:39
231002-2k417afa8s 702/10/2023, 21:20
231002-z68v6aeg3z 7Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
02/10/2023, 22:39
Static task
static1
Behavioral task
behavioral1
Sample
ItsOnFire.apk
Resource
android-x86-arm-20230831-en
Behavioral task
behavioral2
Sample
ItsOnFire.apk
Resource
android-x64-20230831-en
Behavioral task
behavioral3
Sample
ItsOnFire.apk
Resource
android-x64-arm64-20230831-en
Behavioral task
behavioral4
Sample
baseline.prof
Resource
win7-20230831-en
Behavioral task
behavioral5
Sample
baseline.prof
Resource
win10v2004-20230915-en
Behavioral task
behavioral6
Sample
baseline.profm
Resource
win7-20230831-en
Behavioral task
behavioral7
Sample
baseline.profm
Resource
win10v2004-20230915-en
Behavioral task
behavioral8
Sample
damageshelter.ogg
Resource
win7-20230831-en
Behavioral task
behavioral9
Sample
damageshelter.ogg
Resource
win10v2004-20230915-en
Behavioral task
behavioral10
Sample
invaderexplode.ogg
Resource
win7-20230831-en
Behavioral task
behavioral11
Sample
invaderexplode.ogg
Resource
win10v2004-20230915-en
Behavioral task
behavioral12
Sample
oh.ogg
Resource
win7-20230831-en
Behavioral task
behavioral13
Sample
oh.ogg
Resource
win10v2004-20230915-en
Behavioral task
behavioral14
Sample
playerexplode.ogg
Resource
win7-20230831-en
Behavioral task
behavioral15
Sample
playerexplode.ogg
Resource
win10v2004-20230915-en
Behavioral task
behavioral16
Sample
shoot.ogg
Resource
win7-20230831-en
Behavioral task
behavioral17
Sample
shoot.ogg
Resource
win10v2004-20230915-en
Behavioral task
behavioral18
Sample
uh.ogg
Resource
win7-20230831-en
Behavioral task
behavioral19
Sample
uh.ogg
Resource
win10v2004-20230915-en
General
-
Target
baseline.prof
-
Size
4KB
-
MD5
c0005febcc06500ffc1ddb2694b441a0
-
SHA1
1c4b85bed78d385b12297d23927ef3da14c62418
-
SHA256
56cbf8db20ca474791006480e26347722ba94e5a251b206a670654eb4c185613
-
SHA512
4d79fbc7b4cb86a9fe14eecc372966bd62818a2e6681ac563ab8046b608e700fec2caf93740d97d808ba9c2061c938128d2ba4e0310c0ade43749d4ae3c4a48f
-
SSDEEP
96:qasxxxx2XoTjBT7TlgWewHRABhIZOiWsea8L11cDHmC3d5aswSZXDWSiw:qtxxxx20jZTlzeOCBIf8SHhd8BSZX6Sd
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_Classes\Local Settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\prof_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\.prof rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\.prof\ = "prof_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\prof_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\prof_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\prof_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\prof_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\prof_auto_file\shell\Read rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2684 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2684 AcroRd32.exe 2684 AcroRd32.exe 2684 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2208 wrote to memory of 2940 2208 cmd.exe 29 PID 2208 wrote to memory of 2940 2208 cmd.exe 29 PID 2208 wrote to memory of 2940 2208 cmd.exe 29 PID 2940 wrote to memory of 2684 2940 rundll32.exe 30 PID 2940 wrote to memory of 2684 2940 rundll32.exe 30 PID 2940 wrote to memory of 2684 2940 rundll32.exe 30 PID 2940 wrote to memory of 2684 2940 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\baseline.prof1⤵
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\baseline.prof2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\baseline.prof"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2684
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5ebc2f070acb49fd73c364acb0d45a087
SHA1df9086d3f9292a3284605ddd180e078422f89b71
SHA256fdffcf14f3fcfc0b7ee9e44ed8f170f6d593034e852395d78cfb62da1e9db1bb
SHA512db52a6ab26cfb81a36830501b8c0de1711afffe1ab00a0b00e125d662bf3ef6eefb2be3c4726717a542474510f6fc876ac7c64479cd522f889c7240bc03dcb01