Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
322s -
max time network
331s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
17/02/2024, 20:20
General
-
Target
$PLUGINSDIR/app-64.7z
-
Size
80.0MB
-
MD5
3ee37c0a040d01b12c017d5910d9d2a0
-
SHA1
4722278c4de0742dcbaf92bbc73a1b0ecb44ab4a
-
SHA256
0b749b5d1a9c699ddb5fec5ffd600ba7ca15f410e54bc6bc5f2f834f69a46cb4
-
SHA512
6ad9ce42b0f0f0d2740b7899aaf776214f0ead4f649957e457150db38442f9a03d44ad74d7e60c59c4d38de57442cde360d3ce15bb05fee5d9fad87ab59f4ab5
-
SSDEEP
1572864:ab+n6npC5ZhWkKV0mxFee1STuEWSzPGZq5xGGmG6qcK2V78QrOptItrjYpT:aSn6npCokE0O1STuEWSCZqfGGdTtQrOR
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app-64.7z1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app-64.7z"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵