Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

27/05/2024, 22:11 UTC

240527-14ae9ada43 10

27/05/2024, 21:15 UTC

240527-z3zhbabd59 10

13/02/2024, 12:11 UTC

240213-pcwzdshd2w 10

13/02/2024, 12:08 UTC

240213-pa6qtahc7y 10

18/12/2023, 08:13 UTC

231218-j4g2nabaf5 10

05/12/2023, 08:54 UTC

231205-kt32taae27 10

05/12/2023, 07:41 UTC

231205-jjdthahh6w 10

05/12/2023, 07:38 UTC

231205-jgmcvshh5x 10

26/11/2023, 09:39 UTC

231126-lmxf5agd87 10

Analysis

  • max time kernel
    117s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    13/02/2024, 12:08 UTC

General

  • Target

    Malware-database-main/ChilledWindows.exe

  • Size

    4.4MB

  • MD5

    6a4853cd0584dc90067e15afb43c4962

  • SHA1

    ae59bbb123e98dc8379d08887f83d7e52b1b47fc

  • SHA256

    ccb9502bf8ba5becf8b758ca04a5625c30b79e2d10d2677cc43ae4253e1288ec

  • SHA512

    feb223e0de9bd64e32dc4f3227e175b58196b5e614bca8c2df0bbca2442a564e39d66bcd465154149dc7ebbd3e1ca644ed09d9a9174b52236c76e7388cb9d996

  • SSDEEP

    98304:XyDt6K4MJVnjOobt/JN1LA5elHc+S4fRp5UvluKo:XyDtK8bbxn+IHcBEV/F

Score
6/10

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe
    "C:\Users\Admin\AppData\Local\Temp\Malware-database-main\ChilledWindows.exe"
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:616

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Malware-database-main\chilledwindows.mp4

    Filesize

    2.9MB

    MD5

    2c110828dabd0e465b1c9a607f5f7779

    SHA1

    e0c0bf083ea3052ca05bdbdc1f54dd8d743df4aa

    SHA256

    2c9e9e98a6fc689b5930b0dadebe1a614079c1ff61af5671a05fe50e243aee68

    SHA512

    e37a792ff09289808e79f3f8d8777a35cddcec1782a7ef0b1c1c351ae8f3e3a8b8a3dce84e41727db802224aae54b4950146a0ef54f4b2518b7a1030e28f1c45

  • memory/616-35-0x000007FEF5300000-0x000007FEF5CEC000-memory.dmp

    Filesize

    9.9MB

  • memory/616-37-0x000000001B3C0000-0x000000001B440000-memory.dmp

    Filesize

    512KB

  • memory/616-3-0x000000001B3C0000-0x000000001B440000-memory.dmp

    Filesize

    512KB

  • memory/616-5-0x0000000000560000-0x000000000056A000-memory.dmp

    Filesize

    40KB

  • memory/616-4-0x0000000000560000-0x000000000056A000-memory.dmp

    Filesize

    40KB

  • memory/616-1-0x000007FEF5300000-0x000007FEF5CEC000-memory.dmp

    Filesize

    9.9MB

  • memory/616-11-0x000007FEEEC10000-0x000007FEEF001000-memory.dmp

    Filesize

    3.9MB

  • memory/616-15-0x000000001AA90000-0x000000001AA9A000-memory.dmp

    Filesize

    40KB

  • memory/616-12-0x000000001AA90000-0x000000001AA9A000-memory.dmp

    Filesize

    40KB

  • memory/616-16-0x000000001AA90000-0x000000001AA9A000-memory.dmp

    Filesize

    40KB

  • memory/616-38-0x0000000000560000-0x000000000056A000-memory.dmp

    Filesize

    40KB

  • memory/616-30-0x000007FEEE980000-0x000007FEEEAC3000-memory.dmp

    Filesize

    1.3MB

  • memory/616-31-0x000000001AF60000-0x000000001AF6A000-memory.dmp

    Filesize

    40KB

  • memory/616-32-0x000007FE97A30000-0x000007FE97A3A000-memory.dmp

    Filesize

    40KB

  • memory/616-33-0x000000001AA00000-0x000000001AA01000-memory.dmp

    Filesize

    4KB

  • memory/616-0-0x0000000000A40000-0x0000000000EA4000-memory.dmp

    Filesize

    4.4MB

  • memory/616-2-0x000000001B3C0000-0x000000001B440000-memory.dmp

    Filesize

    512KB

  • memory/616-36-0x000000001B3C0000-0x000000001B440000-memory.dmp

    Filesize

    512KB

  • memory/616-18-0x000000001AA90000-0x000000001AA9A000-memory.dmp

    Filesize

    40KB

  • memory/616-39-0x0000000000560000-0x000000000056A000-memory.dmp

    Filesize

    40KB

  • memory/616-40-0x000007FEEEC10000-0x000007FEEF001000-memory.dmp

    Filesize

    3.9MB

  • memory/616-42-0x000000001AA90000-0x000000001AA9A000-memory.dmp

    Filesize

    40KB

  • memory/616-45-0x000000001AA90000-0x000000001AA9A000-memory.dmp

    Filesize

    40KB

  • memory/616-44-0x000000001AA90000-0x000000001AA9A000-memory.dmp

    Filesize

    40KB

  • memory/616-43-0x000000001AA90000-0x000000001AA9A000-memory.dmp

    Filesize

    40KB

  • memory/616-46-0x000000001AA90000-0x000000001AA9A000-memory.dmp

    Filesize

    40KB

  • memory/616-47-0x000000001AF60000-0x000000001AF6A000-memory.dmp

    Filesize

    40KB

  • memory/616-48-0x000007FEEE980000-0x000007FEEEAC3000-memory.dmp

    Filesize

    1.3MB

  • memory/616-49-0x000000001AF60000-0x000000001AF6A000-memory.dmp

    Filesize

    40KB

  • memory/616-50-0x000007FE97A30000-0x000007FE97A3A000-memory.dmp

    Filesize

    40KB

  • memory/616-54-0x000007FEF5300000-0x000007FEF5CEC000-memory.dmp

    Filesize

    9.9MB

  • memory/616-55-0x0000000000560000-0x0000000000562000-memory.dmp

    Filesize

    8KB

  • memory/616-56-0x000007FEEEC10000-0x000007FEEF001000-memory.dmp

    Filesize

    3.9MB

  • memory/616-57-0x000007FEEE980000-0x000007FEEEAC3000-memory.dmp

    Filesize

    1.3MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.