Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
3Meteos_Tes...000.7z
windows7-x64
3Meteos_Tes...000.7z
windows10-2004-x64
3Meteos Tes...st.exe
windows7-x64
1Meteos Tes...st.exe
windows10-2004-x64
1Meteos Tes...rp.dll
windows7-x64
1Meteos Tes...rp.dll
windows10-2004-x64
1Meteos Tes...ty.dll
windows7-x64
1Meteos Tes...ty.dll
windows10-2004-x64
1Meteos Tes...on.dll
windows7-x64
1Meteos Tes...on.dll
windows10-2004-x64
1Meteos Tes...on.dll
windows7-x64
1Meteos Tes...on.dll
windows10-2004-x64
1Meteos Tes...re.dll
windows7-x64
1Meteos Tes...re.dll
windows10-2004-x64
1Meteos Tes...ns.dll
windows7-x64
1Meteos Tes...ns.dll
windows10-2004-x64
1Meteos Tes...ta.dll
windows7-x64
1Meteos Tes...ta.dll
windows10-2004-x64
1Meteos Tes...ng.dll
windows7-x64
1Meteos Tes...ng.dll
windows10-2004-x64
1Meteos Tes...es.dll
windows7-x64
1Meteos Tes...es.dll
windows10-2004-x64
1Meteos Tes...em.dll
windows7-x64
1Meteos Tes...em.dll
windows10-2004-x64
1Meteos Tes...on.dll
windows7-x64
1Meteos Tes...on.dll
windows10-2004-x64
1Meteos Tes...tp.dll
windows7-x64
1Meteos Tes...tp.dll
windows10-2004-x64
1Meteos Tes...cs.dll
windows7-x64
1Meteos Tes...cs.dll
windows10-2004-x64
1Meteos Tes...on.dll
windows7-x64
1Meteos Tes...on.dll
windows10-2004-x64
1Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
12/11/2023, 07:24
Static task
static1
Behavioral task
behavioral1
Sample
Meteos_Test_version_negative_10000.7z
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
Meteos_Test_version_negative_10000.7z
Resource
win10v2004-20231023-en
Behavioral task
behavioral3
Sample
Meteos Test version negative 10000/Meteos Test.exe
Resource
win7-20231025-en
Behavioral task
behavioral4
Sample
Meteos Test version negative 10000/Meteos Test.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral5
Sample
Meteos Test version negative 10000/Meteos Test_Data/Managed/Assembly-CSharp.dll
Resource
win7-20231020-en
Behavioral task
behavioral6
Sample
Meteos Test version negative 10000/Meteos Test_Data/Managed/Assembly-CSharp.dll
Resource
win10v2004-20231023-en
Behavioral task
behavioral7
Sample
Meteos Test version negative 10000/Meteos Test_Data/Managed/Mono.Security.dll
Resource
win7-20231023-en
Behavioral task
behavioral8
Sample
Meteos Test version negative 10000/Meteos Test_Data/Managed/Mono.Security.dll
Resource
win10v2004-20231023-en
Behavioral task
behavioral9
Sample
Meteos Test version negative 10000/Meteos Test_Data/Managed/System.ComponentModel.Composition.dll
Resource
win7-20231020-en
Behavioral task
behavioral10
Sample
Meteos Test version negative 10000/Meteos Test_Data/Managed/System.ComponentModel.Composition.dll
Resource
win10v2004-20231023-en
Behavioral task
behavioral11
Sample
Meteos Test version negative 10000/Meteos Test_Data/Managed/System.Configuration.dll
Resource
win7-20231025-en
Behavioral task
behavioral12
Sample
Meteos Test version negative 10000/Meteos Test_Data/Managed/System.Configuration.dll
Resource
win10v2004-20231023-en
Behavioral task
behavioral13
Sample
Meteos Test version negative 10000/Meteos Test_Data/Managed/System.Core.dll
Resource
win7-20231020-en
Behavioral task
behavioral14
Sample
Meteos Test version negative 10000/Meteos Test_Data/Managed/System.Core.dll
Resource
win10v2004-20231020-en
Behavioral task
behavioral15
Sample
Meteos Test version negative 10000/Meteos Test_Data/Managed/System.Data.DataSetExtensions.dll
Resource
win7-20231023-en
Behavioral task
behavioral16
Sample
Meteos Test version negative 10000/Meteos Test_Data/Managed/System.Data.DataSetExtensions.dll
Resource
win10v2004-20231023-en
Behavioral task
behavioral17
Sample
Meteos Test version negative 10000/Meteos Test_Data/Managed/System.Data.dll
Resource
win7-20231020-en
Behavioral task
behavioral18
Sample
Meteos Test version negative 10000/Meteos Test_Data/Managed/System.Data.dll
Resource
win10v2004-20231023-en
Behavioral task
behavioral19
Sample
Meteos Test version negative 10000/Meteos Test_Data/Managed/System.Drawing.dll
Resource
win7-20231020-en
Behavioral task
behavioral20
Sample
Meteos Test version negative 10000/Meteos Test_Data/Managed/System.Drawing.dll
Resource
win10v2004-20231023-en
Behavioral task
behavioral21
Sample
Meteos Test version negative 10000/Meteos Test_Data/Managed/System.EnterpriseServices.dll
Resource
win7-20231020-en
Behavioral task
behavioral22
Sample
Meteos Test version negative 10000/Meteos Test_Data/Managed/System.EnterpriseServices.dll
Resource
win10v2004-20231025-en
Behavioral task
behavioral23
Sample
Meteos Test version negative 10000/Meteos Test_Data/Managed/System.IO.Compression.FileSystem.dll
Resource
win7-20231023-en
Behavioral task
behavioral24
Sample
Meteos Test version negative 10000/Meteos Test_Data/Managed/System.IO.Compression.FileSystem.dll
Resource
win10v2004-20231023-en
Behavioral task
behavioral25
Sample
Meteos Test version negative 10000/Meteos Test_Data/Managed/System.IO.Compression.dll
Resource
win7-20231020-en
Behavioral task
behavioral26
Sample
Meteos Test version negative 10000/Meteos Test_Data/Managed/System.IO.Compression.dll
Resource
win10v2004-20231023-en
Behavioral task
behavioral27
Sample
Meteos Test version negative 10000/Meteos Test_Data/Managed/System.Net.Http.dll
Resource
win7-20231020-en
Behavioral task
behavioral28
Sample
Meteos Test version negative 10000/Meteos Test_Data/Managed/System.Net.Http.dll
Resource
win10v2004-20231025-en
Behavioral task
behavioral29
Sample
Meteos Test version negative 10000/Meteos Test_Data/Managed/System.Numerics.dll
Resource
win7-20231020-en
Behavioral task
behavioral30
Sample
Meteos Test version negative 10000/Meteos Test_Data/Managed/System.Numerics.dll
Resource
win10v2004-20231023-en
Behavioral task
behavioral31
Sample
Meteos Test version negative 10000/Meteos Test_Data/Managed/System.Runtime.Serialization.dll
Resource
win7-20231023-en
Behavioral task
behavioral32
Sample
Meteos Test version negative 10000/Meteos Test_Data/Managed/System.Runtime.Serialization.dll
Resource
win10v2004-20231020-en
General
-
Target
Meteos_Test_version_negative_10000.7z
-
Size
19.6MB
-
MD5
0297e2072afb71157afe0e6c7648fff2
-
SHA1
9d65a524ef08982f04dd11eebe4dece4c63559ec
-
SHA256
a971785f310f7a2c8907b8094a585b2d66df20087b9d3b9ef9c2ed02b8e04f77
-
SHA512
8d1465426d6a3795416e15f0450c29848be6e4252ec507a8ea44b3cd5936291cf46762f727fadca45e8db0118be92ec6376f330d8430efa46a65bfb3d2f2027d
-
SSDEEP
393216:ZzhNZ3eTCLNMAhBvhu/jqCs9vovIj++4aRdqDXCp0Q:xZ3eT8NMghu/jq9voD+FRcDWJ
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\7z_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\.7z rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\.7z\ = "7z_auto_file" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\7z_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\7z_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\7z_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\7z_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\7z_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2612 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2612 AcroRd32.exe 2612 AcroRd32.exe 2612 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2576 wrote to memory of 2648 2576 cmd.exe 29 PID 2576 wrote to memory of 2648 2576 cmd.exe 29 PID 2576 wrote to memory of 2648 2576 cmd.exe 29 PID 2648 wrote to memory of 2612 2648 rundll32.exe 30 PID 2648 wrote to memory of 2612 2648 rundll32.exe 30 PID 2648 wrote to memory of 2612 2648 rundll32.exe 30 PID 2648 wrote to memory of 2612 2648 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Meteos_Test_version_negative_10000.7z1⤵
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Meteos_Test_version_negative_10000.7z2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Meteos_Test_version_negative_10000.7z"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2612
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5a24ead97086f231f28c560b6144b807e
SHA1a61ce79bcec39a0ab569e477d0f94ab9a1b26955
SHA2562d1b65e78b68ff9c7dbd00d7942db6522c3f356a099908efa9f977c6816c5674
SHA512e7fcf1bbf7ae5cfe863a32d104bf21bc4edac566d1a2aa39519aabe2bd5003655bc8a67e86d65810e00cbed03838286efcb94ec09b04da08c2460f45fc519427