Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
10/01/2024, 04:07
Static task
static1
Behavioral task
behavioral1
Sample
4f8953fcd9ac4d05228c2955b5a449c9.jad
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4f8953fcd9ac4d05228c2955b5a449c9.jad
Resource
win10v2004-20231215-en
General
-
Target
4f8953fcd9ac4d05228c2955b5a449c9.jad
-
Size
68KB
-
MD5
4f8953fcd9ac4d05228c2955b5a449c9
-
SHA1
3dbc69f81cbe8de7e928daacd9c27a004114962b
-
SHA256
50b8a9dd6f6ca0434f8f6e94ec187fe96c0e0d9085d8aed428f0668e4c012b8a
-
SHA512
c9924bce0ed543140745eaa1e062e416e490db813560f20e8651162a096e7fde9a19e61e333fd402124580141a737e786181ae7708952255717d67a9ffc7aba8
-
SSDEEP
1536:EjUcFC+MEcHwy7GtW2insgvrGoZNGtW2insgvrGoZm:EjUcto57ZsArG8ZsArGJ
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\jad_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\jad_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\jad_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\jad_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\jad_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\.jad rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\.jad\ = "jad_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\jad_auto_file\shell rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2860 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2860 AcroRd32.exe 2860 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1768 wrote to memory of 2736 1768 cmd.exe 29 PID 1768 wrote to memory of 2736 1768 cmd.exe 29 PID 1768 wrote to memory of 2736 1768 cmd.exe 29 PID 2736 wrote to memory of 2860 2736 rundll32.exe 30 PID 2736 wrote to memory of 2860 2736 rundll32.exe 30 PID 2736 wrote to memory of 2860 2736 rundll32.exe 30 PID 2736 wrote to memory of 2860 2736 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\4f8953fcd9ac4d05228c2955b5a449c9.jad1⤵
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\4f8953fcd9ac4d05228c2955b5a449c9.jad2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\4f8953fcd9ac4d05228c2955b5a449c9.jad"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2860
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5215a32d3aa2728fe7b51377ff005ea9b
SHA1fec92bea34d32a458152c953a84daee4b23b6e0d
SHA256282b4705e6273ec5a8d3cb42a842d03697f201ff11fbd5f909d11e83ecc5ee15
SHA512f7366e46f9e2f9aff71d2fb917e8d19afd76c68750a14e84faa1b978656da95452c35ff2f43b0b6f41631883cfc963b6eb03460abf341643e935ec2601e99444