Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    31/01/2024, 14:39 UTC

General

  • Target

    SCPH-70004_BIOS_V12_PAL_200.erom

  • Size

    3.0MB

  • MD5

    9feb1fdeadd6232a13b95e60b34ccef9

  • SHA1

    ec0121bb8e2a209044309780d2efc2559c9a0ef1

  • SHA256

    e5bcd5925c1f22de48d49c3895dd421d167faddc033aac628f5facfba90ceef3

  • SHA512

    fa80cf49166165bc016f53da894dc62c2c9362cbeeb08b1b8546f1f49a9d207beb04cb8ec711be9191b11b563ca963f357e36792edd9a767aabf7418e9e07ea4

  • SSDEEP

    49152:pdAqdAivUd7r3JgqK3m1R+DXNotHFTuMvFgwLcgSGouxwKSXaDZ3PFu:g5MkLJgroohotHFTTrcgSGUXstg

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\SCPH-70004_BIOS_V12_PAL_200.erom
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2232
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\SCPH-70004_BIOS_V12_PAL_200.erom
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2824
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\SCPH-70004_BIOS_V12_PAL_200.erom"
        3⤵
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2312

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    064a9aa59c1a30bcb638aaf9f7beb612

    SHA1

    854c2981226d8396894c47d54105219aa55f2956

    SHA256

    0ffcf2b47040abdc76bbc1e2541f80006faa46e0854154d0ae43e4d94adea14c

    SHA512

    b13bbc9e27aa1c15c1fe10a825f2ffd07e45ba62f0f1928c53089521ff23eeddc26de78ac0a79c237fdb7ccfcd00d91df89f98cb11cd11a10954951a81518014

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.