Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
1OPP_Beta_Test_26.rar
windows7-x64
3OPP_Beta_Test_26.rar
windows10-2004-x64
7OPP/Assets...der.cs
windows7-x64
3OPP/Assets...der.cs
windows10-2004-x64
3OPP/Assets...shader
windows7-x64
3OPP/Assets...shader
windows10-2004-x64
3OPP/BoneFoot.png
windows7-x64
3OPP/BoneFoot.png
windows10-2004-x64
3OPP/BoneHead.png
windows7-x64
3OPP/BoneHead.png
windows10-2004-x64
3OPP/BoneLower.png
windows7-x64
3OPP/BoneLower.png
windows10-2004-x64
3OPP/BoneLowerArm.png
windows7-x64
3OPP/BoneLowerArm.png
windows10-2004-x64
3OPP/BoneLowerLeg.png
windows7-x64
3OPP/BoneLowerLeg.png
windows10-2004-x64
3OPP/BoneMiddle.png
windows7-x64
3OPP/BoneMiddle.png
windows10-2004-x64
3OPP/BoneUpper.png
windows7-x64
3OPP/BoneUpper.png
windows10-2004-x64
3OPP/BoneUpperArm.png
windows7-x64
3OPP/BoneUpperArm.png
windows10-2004-x64
3OPP/BoneUpperLeg.png
windows7-x64
3OPP/BoneUpperLeg.png
windows10-2004-x64
3OPP/Catego...der.cs
windows7-x64
3OPP/Catego...der.cs
windows10-2004-x64
3OPP/Charac...er.png
windows7-x64
3OPP/Charac...er.png
windows10-2004-x64
3OPP/Charac...rm.png
windows7-x64
3OPP/Charac...rm.png
windows10-2004-x64
3OPP/Charac...-1.png
windows7-x64
3OPP/Charac...-1.png
windows10-2004-x64
3Analysis
-
max time kernel
120s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23/02/2024, 14:26
Static task
static1
Behavioral task
behavioral1
Sample
OPP_Beta_Test_26.rar
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
OPP_Beta_Test_26.rar
Resource
win10v2004-20240221-en
Behavioral task
behavioral3
Sample
OPP/Assets/AssetBundleBuilder.cs
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
OPP/Assets/AssetBundleBuilder.cs
Resource
win10v2004-20240221-en
Behavioral task
behavioral5
Sample
OPP/Assets/Sprites-Outline.shader
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
OPP/Assets/Sprites-Outline.shader
Resource
win10v2004-20240221-en
Behavioral task
behavioral7
Sample
OPP/BoneFoot.png
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
OPP/BoneFoot.png
Resource
win10v2004-20240221-en
Behavioral task
behavioral9
Sample
OPP/BoneHead.png
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
OPP/BoneHead.png
Resource
win10v2004-20240221-en
Behavioral task
behavioral11
Sample
OPP/BoneLower.png
Resource
win7-20240215-en
Behavioral task
behavioral12
Sample
OPP/BoneLower.png
Resource
win10v2004-20240221-en
Behavioral task
behavioral13
Sample
OPP/BoneLowerArm.png
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
OPP/BoneLowerArm.png
Resource
win10v2004-20240221-en
Behavioral task
behavioral15
Sample
OPP/BoneLowerLeg.png
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
OPP/BoneLowerLeg.png
Resource
win10v2004-20240221-en
Behavioral task
behavioral17
Sample
OPP/BoneMiddle.png
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
OPP/BoneMiddle.png
Resource
win10v2004-20240221-en
Behavioral task
behavioral19
Sample
OPP/BoneUpper.png
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
OPP/BoneUpper.png
Resource
win10v2004-20240221-en
Behavioral task
behavioral21
Sample
OPP/BoneUpperArm.png
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
OPP/BoneUpperArm.png
Resource
win10v2004-20240221-en
Behavioral task
behavioral23
Sample
OPP/BoneUpperLeg.png
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
OPP/BoneUpperLeg.png
Resource
win10v2004-20240221-en
Behavioral task
behavioral25
Sample
OPP/CategoryBuilder.cs
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
OPP/CategoryBuilder.cs
Resource
win10v2004-20240221-en
Behavioral task
behavioral27
Sample
OPP/Characters/Kaido/BaseLower.png
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
OPP/Characters/Kaido/BaseLower.png
Resource
win10v2004-20240221-en
Behavioral task
behavioral29
Sample
OPP/Characters/Kaido/BaseLowerArm.png
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
OPP/Characters/Kaido/BaseLowerArm.png
Resource
win10v2004-20240221-en
Behavioral task
behavioral31
Sample
OPP/Characters/Kaido/BaseLowerArm2-1.png
Resource
win7-20240215-en
Behavioral task
behavioral32
Sample
OPP/Characters/Kaido/BaseLowerArm2-1.png
Resource
win10v2004-20240221-en
General
-
Target
OPP/Assets/AssetBundleBuilder.cs
-
Size
1KB
-
MD5
1182bd24cd6dfbacf94e4082f4ae49e6
-
SHA1
6fdd33e395edadaf596b766fc0803707fc9271c1
-
SHA256
a369374d685d32908ec2e4330cab7d197b133089d17cc5c5a3e714bc6addfa84
-
SHA512
42bdc284c51a56ddf9649f85b671a4d377344a57b305cb6fa1e8339dc452317fd6bb12d47ab463d2f085823294053956d3e6cf75d472cf1f8af0bd140f65e8a0
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_Classes\Local Settings cmd.exe -
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
pid Process 2524 AcroRd32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2524 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2524 AcroRd32.exe 2524 AcroRd32.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3052 wrote to memory of 2524 3052 cmd.exe 29 PID 3052 wrote to memory of 2524 3052 cmd.exe 29 PID 3052 wrote to memory of 2524 3052 cmd.exe 29 PID 3052 wrote to memory of 2524 3052 cmd.exe 29
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\OPP\Assets\AssetBundleBuilder.cs1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\OPP\Assets\AssetBundleBuilder.cs"2⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2524
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5efafabf8a4466ce598d1e720ca7f8624
SHA14699df3ecd3eccfa7d37a60c803e0328a05ae4f3
SHA256eb314bf2197322bdb3c5000a3e781ff2dd6da4b5354e1397fc84c6e03217656c
SHA5121de95d8f2100f0abb5e0cec7b96575902a876b85c168227771da229e3f89900739aaff3cbbd646717a3347d8a72666d06d9a14668c241ef12d25b2e162c56e94