Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

03/02/2024, 06:55

240203-hp5czabeg7 7

03/02/2024, 06:52

240203-hnee6adhdp 7

03/02/2024, 06:46

240203-hjl97sbdh3 7

03/02/2024, 06:41

240203-hfs9cadfhl 3

03/02/2024, 06:38

240203-hebb5sdffl 3

03/02/2024, 05:47

240203-gg3nqsaee9 8

03/02/2024, 05:22

240203-f2tqwscdcm 7

Analysis

  • max time kernel
    119s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    03/02/2024, 06:46

General

  • Target

    RAM_Data/globalgamemanagers.assets.ress

  • Size

    2.7MB

  • MD5

    7423e95b309c209a70c3b8112f61d473

  • SHA1

    8c8d65e4df4f89c0fa77b5ba6a8ec737113ef592

  • SHA256

    39dd38fcd8dd95d41d6d55fe16a448d29fe2c31d9a162c825c24c6d99a893d7a

  • SHA512

    617856a9aff5b357085a59ffc6bfd8a107a48ee22849ee190bdc1e81e1bdf9d9be9fb1fdaa5edd89b65ce1fc63a5525731f6526b14379b72c5396fd202d772aa

  • SSDEEP

    1536:8nCugW37Qc/WRI5YYt3I/cTj3PzZxwWDPoAw5LoWi:4UW3stRLuxv3PQQQAJ

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\RAM_Data\globalgamemanagers.assets.ress
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2508
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\RAM_Data\globalgamemanagers.assets.ress
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2784
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\RAM_Data\globalgamemanagers.assets.ress"
        3⤵
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:1376

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    04a69df663848943f5defdafddcd2fed

    SHA1

    6a571c235cb3de89a5e48fa0c095882d05cef680

    SHA256

    645d6a7551fa0f4ec7c7f49d815e2565b73e9fb51a046ec6a8d54c74b413f9d4

    SHA512

    052d716a80b627eccc24e29f7961a5b15ee4b788ac93739b44ac6d6f9e09208f8f570debb1958529373a3464f9f6ce72f28db75d4279d4cd32596b46d0ee1cd4