Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
7ItsOnFire.apk
android-9-x86
ItsOnFire.apk
android-10-x64
ItsOnFire.apk
android-11-x64
1baseline.prof
windows7-x64
3baseline.prof
windows10-2004-x64
3baseline.profm
windows7-x64
3baseline.profm
windows10-2004-x64
3damageshelter.ogg
windows7-x64
1damageshelter.ogg
windows10-2004-x64
7invaderexplode.ogg
windows7-x64
1invaderexplode.ogg
windows10-2004-x64
7oh.ogg
windows7-x64
1oh.ogg
windows10-2004-x64
7playerexplode.ogg
windows7-x64
1playerexplode.ogg
windows10-2004-x64
7shoot.ogg
windows7-x64
1shoot.ogg
windows10-2004-x64
7uh.ogg
windows7-x64
1uh.ogg
windows10-2004-x64
7Resubmissions
03/10/2023, 14:56
231003-sbdm7scb8z 703/10/2023, 14:35
231003-rx4abadf82 702/10/2023, 22:39
231002-2k417afa8s 702/10/2023, 21:20
231002-z68v6aeg3z 7Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
02/10/2023, 22:39
Static task
static1
Behavioral task
behavioral1
Sample
ItsOnFire.apk
Resource
android-x86-arm-20230831-en
Behavioral task
behavioral2
Sample
ItsOnFire.apk
Resource
android-x64-20230831-en
Behavioral task
behavioral3
Sample
ItsOnFire.apk
Resource
android-x64-arm64-20230831-en
Behavioral task
behavioral4
Sample
baseline.prof
Resource
win7-20230831-en
Behavioral task
behavioral5
Sample
baseline.prof
Resource
win10v2004-20230915-en
Behavioral task
behavioral6
Sample
baseline.profm
Resource
win7-20230831-en
Behavioral task
behavioral7
Sample
baseline.profm
Resource
win10v2004-20230915-en
Behavioral task
behavioral8
Sample
damageshelter.ogg
Resource
win7-20230831-en
Behavioral task
behavioral9
Sample
damageshelter.ogg
Resource
win10v2004-20230915-en
Behavioral task
behavioral10
Sample
invaderexplode.ogg
Resource
win7-20230831-en
Behavioral task
behavioral11
Sample
invaderexplode.ogg
Resource
win10v2004-20230915-en
Behavioral task
behavioral12
Sample
oh.ogg
Resource
win7-20230831-en
Behavioral task
behavioral13
Sample
oh.ogg
Resource
win10v2004-20230915-en
Behavioral task
behavioral14
Sample
playerexplode.ogg
Resource
win7-20230831-en
Behavioral task
behavioral15
Sample
playerexplode.ogg
Resource
win10v2004-20230915-en
Behavioral task
behavioral16
Sample
shoot.ogg
Resource
win7-20230831-en
Behavioral task
behavioral17
Sample
shoot.ogg
Resource
win10v2004-20230915-en
Behavioral task
behavioral18
Sample
uh.ogg
Resource
win7-20230831-en
Behavioral task
behavioral19
Sample
uh.ogg
Resource
win10v2004-20230915-en
General
-
Target
baseline.profm
-
Size
221B
-
MD5
0377ae1a0ef1536640de059558dfe2f1
-
SHA1
3bfb2902495195c40c7a52249ba4a56376c82b51
-
SHA256
fdecd30928773b75e9b77f358d5d984ce44d5a74ed75b5ea03f62b3080295882
-
SHA512
6e4d4ecae173bcc1094e1a26d743bf4808ab4a59983cde0f1b34c06274da122c1f77ff8fd5328e4a52cdd8e9f494112390f00d354773cd6899440fd2c0a6d716
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_CLASSES\profm_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_CLASSES\profm_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_CLASSES\.profm rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_CLASSES\profm_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_CLASSES\profm_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_CLASSES\profm_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_Classes\Local Settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_CLASSES\.profm\ = "profm_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_CLASSES\profm_auto_file\shell rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2816 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2816 AcroRd32.exe 2816 AcroRd32.exe 2816 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2252 wrote to memory of 2732 2252 cmd.exe 29 PID 2252 wrote to memory of 2732 2252 cmd.exe 29 PID 2252 wrote to memory of 2732 2252 cmd.exe 29 PID 2732 wrote to memory of 2816 2732 rundll32.exe 30 PID 2732 wrote to memory of 2816 2732 rundll32.exe 30 PID 2732 wrote to memory of 2816 2732 rundll32.exe 30 PID 2732 wrote to memory of 2816 2732 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\baseline.profm1⤵
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\baseline.profm2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\baseline.profm"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2816
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD55a335881561997f452fac61e75c36b80
SHA1177273145b94493ff014445b62fbef78b5761824
SHA25695a29e6568e9ed4e63ab6907e82a36f29e81353b698aba30e2e9d114bf0ca938
SHA5122c2192b4388b0c977f010622f5c7eb4b07e1a402e04f45290e690562982adcb82000098f6170ea4eeb0b86976f4d054fb09f8f7cc02f63122cb01352636c8b7e