Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

03/10/2023, 14:56

231003-sbdm7scb8z 7

03/10/2023, 14:35

231003-rx4abadf82 7

02/10/2023, 22:39

231002-2k417afa8s 7

02/10/2023, 21:20

231002-z68v6aeg3z 7

Analysis

  • max time kernel
    159s
  • max time network
    165s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/10/2023, 14:35

General

  • Target

    damageshelter.ogg

  • Size

    16KB

  • MD5

    26df32d00fe1e5a754c43590eca08b8a

  • SHA1

    e2061ea74213ee1fa73e62f4cb00e5ca2d498b17

  • SHA256

    49eff40d58068528f8a4aeaef67027fa308f3d4b75a8e5e1c572d1fbfa5f710d

  • SHA512

    94e9859be87afd04b7eb4347530f00d54cd9e7f6e80d545fbc374374dbfb100a39997ecd4f4af09bfda5e4a4635f48dcac85abc833724728df3a4f04d0bfe899

  • SSDEEP

    192:XKv+FWxZknNi8XWWwbMIbkrk7lQ719rm663DIIIIIxyIIIII+ZF2HU39n8HUqUTa:XKqWQUCMb6k7iBZ634SIw9nrYvws

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\damageshelter.ogg
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2924
    • C:\Program Files\VideoLAN\VLC\vlc.exe
      "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\damageshelter.ogg"
      2⤵
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:4780
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x4f0 0x3f4
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3412

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4780-5-0x00007FF753E60000-0x00007FF753F58000-memory.dmp

    Filesize

    992KB

  • memory/4780-6-0x00007FFA50770000-0x00007FFA507A4000-memory.dmp

    Filesize

    208KB

  • memory/4780-7-0x00007FFA40140000-0x00007FFA403F4000-memory.dmp

    Filesize

    2.7MB

  • memory/4780-8-0x00007FFA50890000-0x00007FFA508A8000-memory.dmp

    Filesize

    96KB

  • memory/4780-9-0x00007FFA50260000-0x00007FFA50277000-memory.dmp

    Filesize

    92KB

  • memory/4780-10-0x00007FFA4A550000-0x00007FFA4A561000-memory.dmp

    Filesize

    68KB

  • memory/4780-11-0x00007FFA4A530000-0x00007FFA4A547000-memory.dmp

    Filesize

    92KB

  • memory/4780-12-0x00007FFA49C40000-0x00007FFA49C51000-memory.dmp

    Filesize

    68KB

  • memory/4780-13-0x00007FFA479E0000-0x00007FFA479FD000-memory.dmp

    Filesize

    116KB

  • memory/4780-14-0x00007FFA479C0000-0x00007FFA479D1000-memory.dmp

    Filesize

    68KB

  • memory/4780-15-0x00007FFA3FD30000-0x00007FFA3FF30000-memory.dmp

    Filesize

    2.0MB

  • memory/4780-16-0x00007FFA3EC80000-0x00007FFA3FD2B000-memory.dmp

    Filesize

    16.7MB

  • memory/4780-18-0x00007FFA472D0000-0x00007FFA472F1000-memory.dmp

    Filesize

    132KB

  • memory/4780-20-0x00007FFA41D40000-0x00007FFA41D51000-memory.dmp

    Filesize

    68KB

  • memory/4780-19-0x00007FFA46F60000-0x00007FFA46F78000-memory.dmp

    Filesize

    96KB

  • memory/4780-17-0x00007FFA47980000-0x00007FFA479BF000-memory.dmp

    Filesize

    252KB

  • memory/4780-22-0x00007FFA3EC40000-0x00007FFA3EC51000-memory.dmp

    Filesize

    68KB

  • memory/4780-23-0x00007FFA3EC20000-0x00007FFA3EC3B000-memory.dmp

    Filesize

    108KB

  • memory/4780-24-0x00007FFA3EC00000-0x00007FFA3EC11000-memory.dmp

    Filesize

    68KB

  • memory/4780-26-0x00007FFA3EB50000-0x00007FFA3EB80000-memory.dmp

    Filesize

    192KB

  • memory/4780-25-0x00007FFA3EBE0000-0x00007FFA3EBF8000-memory.dmp

    Filesize

    96KB

  • memory/4780-21-0x00007FFA3EC60000-0x00007FFA3EC71000-memory.dmp

    Filesize

    68KB

  • memory/4780-27-0x00007FFA3EA30000-0x00007FFA3EA97000-memory.dmp

    Filesize

    412KB

  • memory/4780-28-0x00007FFA3E9C0000-0x00007FFA3EA2F000-memory.dmp

    Filesize

    444KB

  • memory/4780-29-0x00007FFA3E9A0000-0x00007FFA3E9B1000-memory.dmp

    Filesize

    68KB

  • memory/4780-30-0x00007FFA3E940000-0x00007FFA3E99C000-memory.dmp

    Filesize

    368KB

  • memory/4780-31-0x00007FFA3E8E0000-0x00007FFA3E936000-memory.dmp

    Filesize

    344KB

  • memory/4780-32-0x00007FFA3E8B0000-0x00007FFA3E8D8000-memory.dmp

    Filesize

    160KB

  • memory/4780-34-0x00007FFA3E860000-0x00007FFA3E877000-memory.dmp

    Filesize

    92KB

  • memory/4780-33-0x00007FFA3E880000-0x00007FFA3E8A4000-memory.dmp

    Filesize

    144KB

  • memory/4780-35-0x00007FFA3E830000-0x00007FFA3E853000-memory.dmp

    Filesize

    140KB

  • memory/4780-36-0x00007FFA3E810000-0x00007FFA3E821000-memory.dmp

    Filesize

    68KB

  • memory/4780-37-0x00007FFA3E7F0000-0x00007FFA3E802000-memory.dmp

    Filesize

    72KB

  • memory/4780-38-0x00007FFA3E7C0000-0x00007FFA3E7E1000-memory.dmp

    Filesize

    132KB

  • memory/4780-39-0x00007FFA3E7A0000-0x00007FFA3E7B3000-memory.dmp

    Filesize

    76KB

  • memory/4780-40-0x00007FFA3E620000-0x00007FFA3E798000-memory.dmp

    Filesize

    1.5MB

  • memory/4780-41-0x00007FFA3E600000-0x00007FFA3E617000-memory.dmp

    Filesize

    92KB

  • memory/4780-42-0x00007FFA58C20000-0x00007FFA58C30000-memory.dmp

    Filesize

    64KB

  • memory/4780-43-0x00007FFA50AE0000-0x00007FFA50B0F000-memory.dmp

    Filesize

    188KB

  • memory/4780-44-0x00007FFA50AC0000-0x00007FFA50AD1000-memory.dmp

    Filesize

    68KB

  • memory/4780-45-0x00007FFA50AA0000-0x00007FFA50AB6000-memory.dmp

    Filesize

    88KB

  • memory/4780-46-0x00007FFA50A80000-0x00007FFA50A95000-memory.dmp

    Filesize

    84KB

  • memory/4780-47-0x00007FFA3D5B0000-0x00007FFA3D5C1000-memory.dmp

    Filesize

    68KB

  • memory/4780-48-0x00007FFA3D590000-0x00007FFA3D5A2000-memory.dmp

    Filesize

    72KB

  • memory/4780-49-0x00007FFA3D410000-0x00007FFA3D58A000-memory.dmp

    Filesize

    1.5MB

  • memory/4780-55-0x00007FFA3D350000-0x00007FFA3D366000-memory.dmp

    Filesize

    88KB

  • memory/4780-54-0x00007FFA3D370000-0x00007FFA3D381000-memory.dmp

    Filesize

    68KB

  • memory/4780-53-0x00007FFA3D390000-0x00007FFA3D3A1000-memory.dmp

    Filesize

    68KB

  • memory/4780-52-0x00007FFA3D3B0000-0x00007FFA3D3C1000-memory.dmp

    Filesize

    68KB

  • memory/4780-51-0x00007FFA3D3D0000-0x00007FFA3D3E4000-memory.dmp

    Filesize

    80KB

  • memory/4780-50-0x00007FFA3D3F0000-0x00007FFA3D403000-memory.dmp

    Filesize

    76KB