Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    130s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    23/02/2024, 14:26

General

  • Target

    OPP/Assets/AssetBundleBuilder.cs

  • Size

    1KB

  • MD5

    1182bd24cd6dfbacf94e4082f4ae49e6

  • SHA1

    6fdd33e395edadaf596b766fc0803707fc9271c1

  • SHA256

    a369374d685d32908ec2e4330cab7d197b133089d17cc5c5a3e714bc6addfa84

  • SHA512

    42bdc284c51a56ddf9649f85b671a4d377344a57b305cb6fa1e8339dc452317fd6bb12d47ab463d2f085823294053956d3e6cf75d472cf1f8af0bd140f65e8a0

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\OPP\Assets\AssetBundleBuilder.cs
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3052
    • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\OPP\Assets\AssetBundleBuilder.cs"
      2⤵
      • Suspicious behavior: CmdExeWriteProcessMemorySpam
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:2524

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    efafabf8a4466ce598d1e720ca7f8624

    SHA1

    4699df3ecd3eccfa7d37a60c803e0328a05ae4f3

    SHA256

    eb314bf2197322bdb3c5000a3e781ff2dd6da4b5354e1397fc84c6e03217656c

    SHA512

    1de95d8f2100f0abb5e0cec7b96575902a876b85c168227771da229e3f89900739aaff3cbbd646717a3347d8a72666d06d9a14668c241ef12d25b2e162c56e94