Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    19/02/2024, 20:04

General

  • Target

    locales/ar.pak

  • Size

    624KB

  • MD5

    6352905a290802a05dd3a64d22216f6e

  • SHA1

    11adb10f0678079c8f73779bb039e12329bcaac7

  • SHA256

    00861d9fa5763cc5c3152edb4a5c956c6bc4f56311ce2ed9e6b496181624ab5e

  • SHA512

    0b0dbad8201ebd1a7dc2cfb11325c509efbcced3ac3d337915cf2972defe2304ea9f8af91d9362cb51333459900a80b714e7302a6483ad58fd64404f8410b6ea

  • SSDEEP

    12288:Z/yZHOg8tqI45/XvYUtOkjbkqBJ51NbW+eTtvZEMgSENOM:4ZHOgUYRF75S+3

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\locales\ar.pak
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2100
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\locales\ar.pak
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2896
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\locales\ar.pak"
        3⤵
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2748

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    215942a8e1c66ff0cef6ed2a8abbec9c

    SHA1

    1f23f7c167a447fba777251935a6bdc41efe6123

    SHA256

    f0fcadae9731f4dce97158936ff1dceeb12f947b7b88c9ae152962f0b6635482

    SHA512

    eb84ff6a6a232506711aa18ed1c05b6ef7545f1b338cf1815f23adafd70ae3022409197ed78e6aa6fe340fc56c019766e9c9f57ca1ad757b4917b69465a5ede5