Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20231023-en
  • resource tags

    arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
  • submitted
    03/11/2023, 19:45

General

  • Target

    IMG_20220209_162041.jpg.ppvw

  • Size

    3.1MB

  • MD5

    cf67fe997e85aff3d446272862a342a8

  • SHA1

    2f4442a734ecc7633e651b1872f03ec20e50ed02

  • SHA256

    0f123d682b897bd0e86fe283e2037688ce11dd07f2a6a3f214ab67a0724af757

  • SHA512

    6487709ec6390e3d537362983d1e550d69d8aadf76c2405ce6f3b61e8c04e535193a2d11cecdfe7a434818930cc1f48625c8d85dc17194e1deb317ecb25379a6

  • SSDEEP

    49152:ozrxgLsZH+p3aoBQAKPIfN/RN3umGO074MpJE26p98OKXL+nYE4nI0S7Q:mxgTpKsQUl5NeN8MbEN9JKXqH2MQ

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\IMG_20220209_162041.jpg.ppvw
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1080
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\IMG_20220209_162041.jpg.ppvw
      2⤵
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      PID:1900

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads