Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
1linux4.4_s...ch.zip
windows7-x64
1linux4.4_s...ch.zip
windows10-2004-x64
1DISCLAIMER-GPL
windows7-x64
1DISCLAIMER-GPL
windows10-2004-x64
1LICENSE.txt
windows7-x64
1LICENSE.txt
windows10-2004-x64
1linux4.4-mxic.patch
windows7-x64
3linux4.4-mxic.patch
windows10-2004-x64
3linux4.4-m...part.c
windows7-x64
3linux4.4-m...part.c
windows10-2004-x64
3linux4.4-m...-nor.c
windows7-x64
3linux4.4-m...-nor.c
windows10-2004-x64
3linux4.4-m...-nor.h
windows7-x64
3linux4.4-m...-nor.h
windows10-2004-x64
3linux4.4/d...char.c
windows7-x64
3linux4.4/d...char.c
windows10-2004-x64
3linux4.4/d...-nor.c
windows7-x64
3linux4.4/d...-nor.c
windows10-2004-x64
3linux4.4/i.../mtd.h
windows7-x64
3linux4.4/i.../mtd.h
windows10-2004-x64
3readme
windows7-x64
1readme
windows10-2004-x64
1Analysis
-
max time kernel
135s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
12/11/2023, 16:18
Static task
static1
Behavioral task
behavioral1
Sample
linux4.4_spi-nor-asp-mode_patch.zip
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
linux4.4_spi-nor-asp-mode_patch.zip
Resource
win10v2004-20231023-en
Behavioral task
behavioral3
Sample
DISCLAIMER-GPL
Resource
win7-20231023-en
Behavioral task
behavioral4
Sample
DISCLAIMER-GPL
Resource
win10v2004-20231023-en
Behavioral task
behavioral5
Sample
LICENSE.txt
Resource
win7-20231025-en
Behavioral task
behavioral6
Sample
LICENSE.txt
Resource
win10v2004-20231023-en
Behavioral task
behavioral7
Sample
linux4.4-mxic.patch
Resource
win7-20231023-en
Behavioral task
behavioral8
Sample
linux4.4-mxic.patch
Resource
win10v2004-20231023-en
Behavioral task
behavioral9
Sample
linux4.4-mxic/drivers/mtd/mtdpart.c
Resource
win7-20231023-en
Behavioral task
behavioral10
Sample
linux4.4-mxic/drivers/mtd/mtdpart.c
Resource
win10v2004-20231023-en
Behavioral task
behavioral11
Sample
linux4.4-mxic/drivers/mtd/spi-nor/spi-nor.c
Resource
win7-20231020-en
Behavioral task
behavioral12
Sample
linux4.4-mxic/drivers/mtd/spi-nor/spi-nor.c
Resource
win10v2004-20231020-en
Behavioral task
behavioral13
Sample
linux4.4-mxic/include/linux/mtd/spi-nor.h
Resource
win7-20231025-en
Behavioral task
behavioral14
Sample
linux4.4-mxic/include/linux/mtd/spi-nor.h
Resource
win10v2004-20231020-en
Behavioral task
behavioral15
Sample
linux4.4/drivers/mtd/mtdchar.c
Resource
win7-20231023-en
Behavioral task
behavioral16
Sample
linux4.4/drivers/mtd/mtdchar.c
Resource
win10v2004-20231023-en
Behavioral task
behavioral17
Sample
linux4.4/drivers/mtd/spi-nor/spi-nor.c
Resource
win7-20231023-en
Behavioral task
behavioral18
Sample
linux4.4/drivers/mtd/spi-nor/spi-nor.c
Resource
win10v2004-20231020-en
Behavioral task
behavioral19
Sample
linux4.4/include/linux/mtd/mtd.h
Resource
win7-20231020-en
Behavioral task
behavioral20
Sample
linux4.4/include/linux/mtd/mtd.h
Resource
win10v2004-20231020-en
Behavioral task
behavioral21
Sample
readme
Resource
win7-20231025-en
Behavioral task
behavioral22
Sample
readme
Resource
win10v2004-20231023-en
General
-
Target
linux4.4-mxic.patch
-
Size
39KB
-
MD5
40e03f543c9142ba34ca2098663097b2
-
SHA1
1a749230d9df57635fdad70290db1b814a97cb2c
-
SHA256
5d8bf9f072371cb64bf5e3249b2511bcc8c456ff70ca4af54a2cdba06eb0d800
-
SHA512
e5882acf7e8080c6a9a8f56168fa5467d93ebec236acfdf77c68a7e5659f8a569db06c927fe84d4e51367ff6aa9819a0db3dac29c20112ad2980f5891ff22b1d
-
SSDEEP
768:ZefhPkVhAhP4OhNhVhlAV6URiWGKvVWCE8GFznCybSr+8BOP4APBmnTwhuzvvGz9:skVhAhP4OhNhVhlAV6xCVTE8GFznCybj
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000_Classes\Local Settings cmd.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 420 OpenWith.exe