Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    25/02/2024, 10:33 UTC

General

  • Target

    Pal/Saved/SaveGames/0/4DB765FD4B7E500DF91375BA51CE6666/Players/7C12DF1E000000000000000000000000.sav

  • Size

    3KB

  • MD5

    6173e5062ca3a7a97eff281621a76f73

  • SHA1

    76fcb163502b758fac7dc1a5a616cd14f8f571e3

  • SHA256

    9ad061a78b853e2f8e85e8157ee0377f68885c54cad04ef44cec8c784fc8fb3e

  • SHA512

    f36da1cc70f50105a9420e5cdeefc8ddc2e71b959cd02606e132495b99a7335a86bc07638ed4b7fa167223db792516e05ab7efc63ac7ff8eb3d1da910bf31ba2

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Pal\Saved\SaveGames\0\4DB765FD4B7E500DF91375BA51CE6666\Players\7C12DF1E000000000000000000000000.sav
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2924
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Pal\Saved\SaveGames\0\4DB765FD4B7E500DF91375BA51CE6666\Players\7C12DF1E000000000000000000000000.sav
      2⤵
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      PID:2576

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.