Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/12/2023, 04:59

General

  • Target

    多任务网页刷新器/多任务网页定时刷新器 V3.0.lnk

  • Size

    765B

  • MD5

    74c6c65df8d1042fab4e0d8cfd8a83a6

  • SHA1

    833703974d9764b29f577465d4bc7f5adb450769

  • SHA256

    855e60d3299e1a417e2e9c2ec213fc35becdd966b3661c9538510779a506bd30

  • SHA512

    2bd636f38611c1d0fbbaa9341f81f4e2c146a84d773b191b917a4cd40cdbe71e10cfabd9ec85e4ca1dc1fd77dfbfcb482d9691e802c225807c370123b3b76965

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of FindShellTrayWindow 10 IoCs
  • Suspicious use of SendNotifyMessage 10 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\多任务网页刷新器\多任务网页定时刷新器 V3.0.lnk"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4264
    • C:\Users\Admin\AppData\Local\Temp\多任务网页刷新器\Arw.exe
      "C:\Users\Admin\AppData\Local\Temp\多任务网页刷新器\Arw.exe"
      2⤵
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3656

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3656-2-0x0000000000870000-0x0000000000871000-memory.dmp

    Filesize

    4KB

  • memory/3656-3-0x0000000000400000-0x0000000000557000-memory.dmp

    Filesize

    1.3MB