Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
1linux4.4_s...ch.zip
windows7-x64
1linux4.4_s...ch.zip
windows10-2004-x64
1DISCLAIMER-GPL
windows7-x64
1DISCLAIMER-GPL
windows10-2004-x64
1LICENSE.txt
windows7-x64
1LICENSE.txt
windows10-2004-x64
1linux4.4-mxic.patch
windows7-x64
3linux4.4-mxic.patch
windows10-2004-x64
3linux4.4-m...part.c
windows7-x64
3linux4.4-m...part.c
windows10-2004-x64
3linux4.4-m...-nor.c
windows7-x64
3linux4.4-m...-nor.c
windows10-2004-x64
3linux4.4-m...-nor.h
windows7-x64
3linux4.4-m...-nor.h
windows10-2004-x64
3linux4.4/d...char.c
windows7-x64
3linux4.4/d...char.c
windows10-2004-x64
3linux4.4/d...-nor.c
windows7-x64
3linux4.4/d...-nor.c
windows10-2004-x64
3linux4.4/i.../mtd.h
windows7-x64
3linux4.4/i.../mtd.h
windows10-2004-x64
3readme
windows7-x64
1readme
windows10-2004-x64
1Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
12/11/2023, 16:18
Static task
static1
Behavioral task
behavioral1
Sample
linux4.4_spi-nor-asp-mode_patch.zip
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
linux4.4_spi-nor-asp-mode_patch.zip
Resource
win10v2004-20231023-en
Behavioral task
behavioral3
Sample
DISCLAIMER-GPL
Resource
win7-20231023-en
Behavioral task
behavioral4
Sample
DISCLAIMER-GPL
Resource
win10v2004-20231023-en
Behavioral task
behavioral5
Sample
LICENSE.txt
Resource
win7-20231025-en
Behavioral task
behavioral6
Sample
LICENSE.txt
Resource
win10v2004-20231023-en
Behavioral task
behavioral7
Sample
linux4.4-mxic.patch
Resource
win7-20231023-en
Behavioral task
behavioral8
Sample
linux4.4-mxic.patch
Resource
win10v2004-20231023-en
Behavioral task
behavioral9
Sample
linux4.4-mxic/drivers/mtd/mtdpart.c
Resource
win7-20231023-en
Behavioral task
behavioral10
Sample
linux4.4-mxic/drivers/mtd/mtdpart.c
Resource
win10v2004-20231023-en
Behavioral task
behavioral11
Sample
linux4.4-mxic/drivers/mtd/spi-nor/spi-nor.c
Resource
win7-20231020-en
Behavioral task
behavioral12
Sample
linux4.4-mxic/drivers/mtd/spi-nor/spi-nor.c
Resource
win10v2004-20231020-en
Behavioral task
behavioral13
Sample
linux4.4-mxic/include/linux/mtd/spi-nor.h
Resource
win7-20231025-en
Behavioral task
behavioral14
Sample
linux4.4-mxic/include/linux/mtd/spi-nor.h
Resource
win10v2004-20231020-en
Behavioral task
behavioral15
Sample
linux4.4/drivers/mtd/mtdchar.c
Resource
win7-20231023-en
Behavioral task
behavioral16
Sample
linux4.4/drivers/mtd/mtdchar.c
Resource
win10v2004-20231023-en
Behavioral task
behavioral17
Sample
linux4.4/drivers/mtd/spi-nor/spi-nor.c
Resource
win7-20231023-en
Behavioral task
behavioral18
Sample
linux4.4/drivers/mtd/spi-nor/spi-nor.c
Resource
win10v2004-20231020-en
Behavioral task
behavioral19
Sample
linux4.4/include/linux/mtd/mtd.h
Resource
win7-20231020-en
Behavioral task
behavioral20
Sample
linux4.4/include/linux/mtd/mtd.h
Resource
win10v2004-20231020-en
Behavioral task
behavioral21
Sample
readme
Resource
win7-20231025-en
Behavioral task
behavioral22
Sample
readme
Resource
win10v2004-20231023-en
General
-
Target
linux4.4-mxic.patch
-
Size
39KB
-
MD5
40e03f543c9142ba34ca2098663097b2
-
SHA1
1a749230d9df57635fdad70290db1b814a97cb2c
-
SHA256
5d8bf9f072371cb64bf5e3249b2511bcc8c456ff70ca4af54a2cdba06eb0d800
-
SHA512
e5882acf7e8080c6a9a8f56168fa5467d93ebec236acfdf77c68a7e5659f8a569db06c927fe84d4e51367ff6aa9819a0db3dac29c20112ad2980f5891ff22b1d
-
SSDEEP
768:ZefhPkVhAhP4OhNhVhlAV6URiWGKvVWCE8GFznCybSr+8BOP4APBmnTwhuzvvGz9:skVhAhP4OhNhVhlAV6xCVTE8GFznCybj
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\patch_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\patch_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\patch_auto_file\ rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\.patch\ = "patch_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\patch_auto_file\shell\Read\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\.patch rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\patch_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\patch_auto_file\shell rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2672 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2672 AcroRd32.exe 2672 AcroRd32.exe 2672 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2968 wrote to memory of 2704 2968 cmd.exe 29 PID 2968 wrote to memory of 2704 2968 cmd.exe 29 PID 2968 wrote to memory of 2704 2968 cmd.exe 29 PID 2704 wrote to memory of 2672 2704 rundll32.exe 30 PID 2704 wrote to memory of 2672 2704 rundll32.exe 30 PID 2704 wrote to memory of 2672 2704 rundll32.exe 30 PID 2704 wrote to memory of 2672 2704 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\linux4.4-mxic.patch1⤵
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\linux4.4-mxic.patch2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\linux4.4-mxic.patch"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2672
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD56977f49c66450ad40242c751f5555205
SHA1de334a744e1ef0d0df282c2f3dfecc6d027b908d
SHA256cf097b25e35896e887f4748fd442c50ba5fcab9bdddc13d2fecadf576ae4046c
SHA51288987e4ce15326013761c500b070a0b26f2fcc29b0bb637ce9c7bba36b68afa81064c995c85f6674e9f981224264ec513915cea691135381f3393ab8a2d6fbc4