Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

3

Static

static

1

Roblox Player.lnk

windows7-x64

3

Roblox Player.lnk

windows10-2004-x64

3

Analysis

  • max time kernel
    136s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    24/02/2024, 00:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Roblox Player.lnk

  • Size

    1KB

  • MD5

    fde4e79f610460a10de3be3c221fbadb

  • SHA1

    9b4f2ca5d8319f65c2ffae8f0017cc96c3727fd0

  • SHA256

    1a9b22442ac88a280251dd30bc3143ed16d3685b4a457d4f604b530bc6a963e0

  • SHA512

    b441e3df1ce82924ac4af8e25e064032334fa53c180a17ac65ecef10884d1e0110d54afeef1a1561e791480336463b7e94a695c873f38bdccf64bee9dfd2ffe4

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Control Panel 64 IoCs
    evasion
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\Roblox Player.lnk"
    1⤵
      PID:2244
    • C:\Windows\system32\SndVol.exe
      SndVol.exe -f 45417622 23650
      1⤵
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2616
    • C:\Windows\SysWOW64\DllHost.exe
      C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
      1⤵
        PID:1816
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" shell32.dll,Control_RunDLL desk.cpl,Advanced,@Advanced
        1⤵
        • Modifies Control Panel
        PID:1372
      • C:\Windows\SysWOW64\DllHost.exe
        C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
        1⤵
          PID:2560
        • C:\Windows\SysWOW64\DllHost.exe
          C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
          1⤵
            PID:2868
          • C:\Program Files\Windows Mail\wab.exe
            "C:\Program Files\Windows Mail\wab.exe" /contact "C:\Users\Admin\Desktop\WaitWrite.contact"
            1⤵
              PID:1184
            • C:\Windows\SysWOW64\DllHost.exe
              C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
              1⤵
                PID:2320

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • memory/2616-29-0x0000000000080000-0x0000000000081000-memory.dmp

                Filesize

                4KB

                Download