Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    20/12/2023, 16:34

General

  • Target

    empyrean-main/.github/ISSUE_TEMPLATE/feature_request.md

  • Size

    481B

  • MD5

    0bce4d73d7c3d57f7d2f6a08a0b1cd76

  • SHA1

    251f8d66cfbefce71e3a167c0e72f3fbcc054eeb

  • SHA256

    bd45fd9fbddab45ad4de963a3c71a7327b05f94f4bfafb7042224d53c568af73

  • SHA512

    251fe8989563a17d35bee8161f72ddc6a9de569a568fd2fcf7bb650297d85d56aa4d50f2a5fab64c100ca2ee925e14eed6de8d57574715774ba43d2826d48293

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\empyrean-main\.github\ISSUE_TEMPLATE\feature_request.md
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2432
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\empyrean-main\.github\ISSUE_TEMPLATE\feature_request.md
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2660
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\empyrean-main\.github\ISSUE_TEMPLATE\feature_request.md"
        3⤵
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2328

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    e1c4f9d377a0224578b9f7df98ec19a7

    SHA1

    bdf7aff264e412f8a77b1488f1a6ba02bb5c5d85

    SHA256

    766c829c19387ed925d6c7f7f82250750b20dc30d06cea4d81e458044e936086

    SHA512

    8e666818b18be8c3c59a07ff596ab344b69abc5eddbbb2cd43344801ef35d7eebe5f417c90e80dfc4ecae5b055b99cb1a948c729eda8196162e58f5ccf9c986a