Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231130-en
  • resource tags

    arch:x64arch:x86image:win7-20231130-enlocale:en-usos:windows7-x64system
  • submitted
    07/12/2023, 16:09

General

  • Target

    scph10000.nvm

  • Size

    1024B

  • MD5

    0f343b0931126a20f133d67c2b018a3b

  • SHA1

    60cacbf3d72e1e7834203da608037b1bf83b40e8

  • SHA256

    5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef

  • SHA512

    8efb4f73c5655351c444eb109230c556d39e2c7624e9c11abc9e3fb4b9b9254218cc5085b454a9698d085cfa92198491f07a723be4574adc70617b73eb0b6461

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\scph10000.nvm
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2552
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\scph10000.nvm
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2612
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\scph10000.nvm"
        3⤵
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2736

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    c34601232710b80a10bdc83eaf1a76ff

    SHA1

    01f6d66599033082bf8d4879c31aea4a2468b944

    SHA256

    0f38d4ef2a92fd9e7f1d7f5d2e810285cee29f4793a18b288bdc85129af0a585

    SHA512

    be62e69aef7d07a5b7ab9ce19b3c11b27ee3939e2fb2bfae1161f926f80d364ac5211692eff8f1f394d0a77367647ba7d32412e41b45b65c7e98b9cb5f7fed8c