Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
29/12/2023, 18:24
Static task
static1
Behavioral task
behavioral1
Sample
AJAZZ_AK33 RGB_Keyboard Driver.rar
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
AJAZZ_AK33 RGB_Keyboard Driver.rar
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
黑爵AK33-RGB机械键盘驱动/AJAZZ AK33 RGB Keyboard Driver.exe
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
黑爵AK33-RGB机械键盘驱动/AJAZZ AK33 RGB Keyboard Driver.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
黑爵AK33-RGB机械键盘驱动/AK33 RGB键盘宏设置教程.jpg
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
黑爵AK33-RGB机械键盘驱动/AK33 RGB键盘宏设置教程.jpg
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
黑爵AK33-RGB机械键盘驱动/任何驱动问题,可扫此二维码咨询解决.jpg
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
黑爵AK33-RGB机械键盘驱动/任何驱动问题,可扫此二维码咨询解决.jpg
Resource
win10v2004-20231215-en
General
-
Target
AJAZZ_AK33 RGB_Keyboard Driver.rar
-
Size
6.1MB
-
MD5
8c163c22750f1555e94e4587c87d4782
-
SHA1
2cd0f5f239e354714c1a3f7281eb664808319621
-
SHA256
0f87fe2577ecff0b8b24158c8bebd88bd37c338c6f48111c1c284017e6cc58da
-
SHA512
1fbf6a5b6f9bb63e193bc15a758099578b0efcc3c58ae616d1ac6a7d41b2c9b9c6beb574bbec3d2a31b7101415949ca517c13ac4a2245d2c6c4b04b78ef15914
-
SSDEEP
98304:lWAh57+/Wmgo0gUa3b/KDiB3tTM8Waebu0wd+4c07nEhRi5kU7thKTsGkX+0Nhn:3q/BgolUariD6hdWJXwd+AEeth9X+0Hn
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2012 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2860 wrote to memory of 2012 2860 cmd.exe 29 PID 2860 wrote to memory of 2012 2860 cmd.exe 29 PID 2860 wrote to memory of 2012 2860 cmd.exe 29
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\AJAZZ_AK33 RGB_Keyboard Driver.rar"1⤵
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\AJAZZ_AK33 RGB_Keyboard Driver.rar2⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:2012
-