Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
14/10/2023, 12:48
231014-p1xktseb9s 414/10/2023, 12:03
231014-n799tsdf8w 314/10/2023, 11:00
231014-m4b27afa32 8Analysis
-
max time kernel
155s -
max time network
169s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
14/10/2023, 12:48
General
-
Target
RPGMV-DECRYPTOR.exe
-
Size
1.2MB
-
MD5
1bdedbe20afb89236a7902804906aeda
-
SHA1
bf9c619e4e672ee1bcb02139d938d8291f3aa1ce
-
SHA256
f8df4d44bd5491dadfcf25353e38b192b629e4af2500bdc9a3816739d7bbd510
-
SHA512
bfc75d03bd782d0d2d947b93d8c462a193e3e5bd22f42dc81e3fd1d490a6a9bce0564b756b4f43018b795bc9ec52b99c71d227bc7edfe353c90e39053a232464
-
SSDEEP
24576:Z/0PTG+usn0/nCocageeHQ6i4W1RH0N7wqHrU26dPFJ9:Z/UTG9umnCoca+w6DW1+iMUzdPFJ
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of FindShellTrayWindow 33 IoCs
-
Suspicious use of SendNotifyMessage 32 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RPGMV-DECRYPTOR.exe"C:\Users\Admin\AppData\Local\Temp\RPGMV-DECRYPTOR.exe"1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PublishFind.vbe"1⤵
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\WriteClose.mpeg"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\UnpublishCompress.bmp"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
76B
MD5a185dab0473ba08ec766ac8245af63ba
SHA1e805aeefa4b3e34124f0c71f2a671d80583d3300
SHA256ca073952c612fe89f85bc3ed1fd0089c2f6ddebbc9f6d1d3ed329e3b2467d969
SHA512f073208ab567f9927d018fecd5ed08645b67e262fa73b6e53ab8aad915cf8481c5f7c71b9883ea9e904c0b4c16e0e2b1fad22ac8a406b454125020e248bf6f00
-
Filesize
77B
MD5173173e759903e04d1229ad740e772f0
SHA14885a72b0b9106cfd94b53a57aa5d03f78901885
SHA256dc7ff06f39c0d5f1cdf55db591f305c5c61dbbb2eed875cbff7186e0a2800976
SHA512cacb5875666a03030b3429effa4f1d92ddd8e1f9063eac7531452265efd1f0d7a590d97450f02c1ebfe9f93cd27af4d60930cbc8a867b630a8889a91401a1804
-
Filesize
18B
MD5f796d4769f84cc8a59f10036f6d2ce76
SHA1acc1a439a8754006dbdbdc72ba0da83c87f48310
SHA256568166577b53c6ce9a6f2f714c6486cde061d3c426f7a882fd12eabd819a982b
SHA5127a504c87a9f2f1a2edbf845d72a5173283eeb0bb974337ae6916b3ef420b1e2e39d91deedac17a4c738faac405ae1b56893bb72fc39ff6082066765a22667899
-
Filesize
68KB
-
Filesize
96KB
-
Filesize
92KB
-
Filesize
116KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
92KB
-
Filesize
2.0MB
-
Filesize
16.7MB
-
Filesize
252KB
-
Filesize
96KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
144KB
-
Filesize
68KB
-
Filesize
92KB
-
Filesize
68KB
-
Filesize
108KB
-
Filesize
192KB
-
Filesize
412KB
-
Filesize
444KB
-
Filesize
992KB
-
Filesize
68KB
-
Filesize
344KB
-
Filesize
132KB
-
Filesize
68KB
-
Filesize
140KB
-
Filesize
132KB
-
Filesize
72KB
-
Filesize
160KB
-
Filesize
76KB
-
Filesize
72KB
-
Filesize
1.2MB
-
Filesize
176KB
-
Filesize
1.7MB
-
Filesize
368KB
-
Filesize
68KB
-
Filesize
604KB
-
Filesize
72KB
-
Filesize
2.2MB
-
Filesize
2.7MB
-
Filesize
16.7MB
-
Filesize
96KB
-
Filesize
2.7MB
-
Filesize
208KB