Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    130s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    16/10/2023, 14:31

General

  • Target

    AnodonsGame.rar

  • Size

    62.0MB

  • MD5

    dd799f24932b6c8a0ea41bc790a6ceb6

  • SHA1

    1ea54b0d76669002dbff4d737349152982426545

  • SHA256

    13cb6ed7d730bb91d797474c14c5b7f6061d6991c7557c44cceb44edcfd92016

  • SHA512

    83894b22b1d90ffa572c46969c8600dab8308a673d1aee6404a5ffa6d5cb143b158975a4421c4e9818bc4aa6f01e8493c34f1e5bb35aed6104e264220bc195f4

  • SSDEEP

    1572864:ayV0pH8WptH2X80j7HqV6HfKi7ZF7v4O5H:ayOtjR0XqcHfKi777QaH

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 9 IoCs
  • Suspicious use of SendNotifyMessage 8 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\AnodonsGame.rar
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2576
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\AnodonsGame.rar
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2812
      • C:\Program Files\VideoLAN\VLC\vlc.exe
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\AnodonsGame.rar"
        3⤵
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:2528

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2528-29-0x000000013F0B0000-0x000000013F1A8000-memory.dmp

    Filesize

    992KB

  • memory/2528-30-0x000007FEF7A60000-0x000007FEF7A94000-memory.dmp

    Filesize

    208KB

  • memory/2528-31-0x000007FEF6120000-0x000007FEF63D4000-memory.dmp

    Filesize

    2.7MB

  • memory/2528-32-0x000007FEFBBB0000-0x000007FEFBBC8000-memory.dmp

    Filesize

    96KB

  • memory/2528-33-0x000007FEF7BA0000-0x000007FEF7BB7000-memory.dmp

    Filesize

    92KB

  • memory/2528-34-0x000007FEF7A40000-0x000007FEF7A51000-memory.dmp

    Filesize

    68KB

  • memory/2528-35-0x000007FEF7660000-0x000007FEF7677000-memory.dmp

    Filesize

    92KB

  • memory/2528-36-0x000007FEF6ED0000-0x000007FEF6EE1000-memory.dmp

    Filesize

    68KB

  • memory/2528-37-0x000007FEF6D70000-0x000007FEF6D8D000-memory.dmp

    Filesize

    116KB

  • memory/2528-38-0x000007FEF6D50000-0x000007FEF6D61000-memory.dmp

    Filesize

    68KB

  • memory/2528-39-0x000007FEF5F20000-0x000007FEF6120000-memory.dmp

    Filesize

    2.0MB

  • memory/2528-40-0x000007FEF4E70000-0x000007FEF5F1B000-memory.dmp

    Filesize

    16.7MB

  • memory/2528-41-0x000007FEF6820000-0x000007FEF685F000-memory.dmp

    Filesize

    252KB

  • memory/2528-42-0x000007FEF6D20000-0x000007FEF6D41000-memory.dmp

    Filesize

    132KB

  • memory/2528-43-0x000007FEF6800000-0x000007FEF6818000-memory.dmp

    Filesize

    96KB

  • memory/2528-44-0x000007FEF67E0000-0x000007FEF67F1000-memory.dmp

    Filesize

    68KB

  • memory/2528-46-0x000007FEF6780000-0x000007FEF6791000-memory.dmp

    Filesize

    68KB

  • memory/2528-47-0x000007FEF6760000-0x000007FEF677B000-memory.dmp

    Filesize

    108KB

  • memory/2528-48-0x000007FEF4E50000-0x000007FEF4E61000-memory.dmp

    Filesize

    68KB

  • memory/2528-45-0x000007FEF67C0000-0x000007FEF67D1000-memory.dmp

    Filesize

    68KB

  • memory/2528-49-0x000007FEF4E30000-0x000007FEF4E48000-memory.dmp

    Filesize

    96KB

  • memory/2528-50-0x000007FEF4E00000-0x000007FEF4E30000-memory.dmp

    Filesize

    192KB

  • memory/2528-51-0x000007FEF4D90000-0x000007FEF4DF7000-memory.dmp

    Filesize

    412KB

  • memory/2528-52-0x000007FEF4BB0000-0x000007FEF4C1F000-memory.dmp

    Filesize

    444KB

  • memory/2528-53-0x000007FEF4B90000-0x000007FEF4BA1000-memory.dmp

    Filesize

    68KB

  • memory/2528-54-0x000007FEF4B30000-0x000007FEF4B86000-memory.dmp

    Filesize

    344KB

  • memory/2528-55-0x000007FEF4B00000-0x000007FEF4B28000-memory.dmp

    Filesize

    160KB

  • memory/2528-56-0x000007FEF4AD0000-0x000007FEF4AF4000-memory.dmp

    Filesize

    144KB

  • memory/2528-57-0x000007FEF4AB0000-0x000007FEF4AC7000-memory.dmp

    Filesize

    92KB

  • memory/2528-59-0x000007FEF4A60000-0x000007FEF4A71000-memory.dmp

    Filesize

    68KB

  • memory/2528-61-0x000007FEF45D0000-0x000007FEF45F1000-memory.dmp

    Filesize

    132KB

  • memory/2528-60-0x000007FEF4640000-0x000007FEF4652000-memory.dmp

    Filesize

    72KB

  • memory/2528-62-0x000007FEF4540000-0x000007FEF4553000-memory.dmp

    Filesize

    76KB

  • memory/2528-63-0x000007FEF4520000-0x000007FEF4532000-memory.dmp

    Filesize

    72KB

  • memory/2528-58-0x000007FEF4A80000-0x000007FEF4AA3000-memory.dmp

    Filesize

    140KB

  • memory/2528-64-0x000007FEF43E0000-0x000007FEF451B000-memory.dmp

    Filesize

    1.2MB

  • memory/2528-65-0x000007FEF4180000-0x000007FEF41AC000-memory.dmp

    Filesize

    176KB

  • memory/2528-66-0x000007FEF3FC0000-0x000007FEF4172000-memory.dmp

    Filesize

    1.7MB

  • memory/2528-67-0x000007FEF3A30000-0x000007FEF3A8C000-memory.dmp

    Filesize

    368KB

  • memory/2528-69-0x000007FEF3950000-0x000007FEF39E7000-memory.dmp

    Filesize

    604KB

  • memory/2528-68-0x000007FEF39F0000-0x000007FEF3A01000-memory.dmp

    Filesize

    68KB

  • memory/2528-70-0x000007FEF3930000-0x000007FEF3942000-memory.dmp

    Filesize

    72KB

  • memory/2528-71-0x000007FEF36F0000-0x000007FEF3921000-memory.dmp

    Filesize

    2.2MB

  • memory/2528-72-0x000007FEF3490000-0x000007FEF35A2000-memory.dmp

    Filesize

    1.1MB

  • memory/2528-73-0x000007FEF3450000-0x000007FEF3485000-memory.dmp

    Filesize

    212KB

  • memory/2528-75-0x000007FEF3400000-0x000007FEF3411000-memory.dmp

    Filesize

    68KB

  • memory/2528-74-0x000007FEF3420000-0x000007FEF3445000-memory.dmp

    Filesize

    148KB

  • memory/2528-76-0x000007FEF3390000-0x000007FEF33F1000-memory.dmp

    Filesize

    388KB

  • memory/2528-77-0x000007FEF3370000-0x000007FEF3381000-memory.dmp

    Filesize

    68KB

  • memory/2528-78-0x000007FEF3350000-0x000007FEF3362000-memory.dmp

    Filesize

    72KB

  • memory/2528-79-0x000007FEF3330000-0x000007FEF3343000-memory.dmp

    Filesize

    76KB

  • memory/2528-80-0x000007FEF3290000-0x000007FEF332F000-memory.dmp

    Filesize

    636KB

  • memory/2528-81-0x000007FEF3270000-0x000007FEF3281000-memory.dmp

    Filesize

    68KB

  • memory/2528-82-0x000007FEF3160000-0x000007FEF3262000-memory.dmp

    Filesize

    1.0MB

  • memory/2528-83-0x000007FEF3140000-0x000007FEF3151000-memory.dmp

    Filesize

    68KB

  • memory/2528-84-0x000007FEF3120000-0x000007FEF3131000-memory.dmp

    Filesize

    68KB

  • memory/2528-85-0x000007FEF3100000-0x000007FEF3111000-memory.dmp

    Filesize

    68KB

  • memory/2528-86-0x000007FEF30E0000-0x000007FEF30F2000-memory.dmp

    Filesize

    72KB

  • memory/2528-87-0x000007FEF30C0000-0x000007FEF30D8000-memory.dmp

    Filesize

    96KB

  • memory/2528-88-0x000007FEF30A0000-0x000007FEF30B6000-memory.dmp

    Filesize

    88KB

  • memory/2528-89-0x000007FEF3070000-0x000007FEF3099000-memory.dmp

    Filesize

    164KB

  • memory/2528-90-0x000007FEF3050000-0x000007FEF3062000-memory.dmp

    Filesize

    72KB

  • memory/2528-91-0x000007FEF3030000-0x000007FEF3041000-memory.dmp

    Filesize

    68KB

  • memory/2528-92-0x000007FEF3010000-0x000007FEF3021000-memory.dmp

    Filesize

    68KB