Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3attachments.zip
windows7-x64
1attachments.zip
windows10-2004-x64
1226350194-...64.rar
windows7-x64
10226350194-...64.rar
windows10-2004-x64
7226350194-...64.exe
windows7-x64
10226350194-...64.exe
windows10-2004-x64
10Civilhorto...ng.sko
windows7-x64
3Civilhorto...ng.sko
windows10-2004-x64
3Ejerkredse...31.don
windows7-x64
3Ejerkredse...31.don
windows10-2004-x64
3Ejerkredse...ng.ps1
windows7-x64
8Ejerkredse...ng.ps1
windows10-2004-x64
8Sudsers34/...se.ant
windows7-x64
3Sudsers34/...se.ant
windows10-2004-x64
3Sudsers34/...ns.oxo
windows7-x64
3Sudsers34/...ns.oxo
windows10-2004-x64
3Telekablet...st.txt
windows7-x64
1Telekablet...st.txt
windows10-2004-x64
1Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07/03/2024, 13:15
Static task
static1
Behavioral task
behavioral1
Sample
attachments.zip
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
attachments.zip
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
226350194-050944-sanlccjavap0003-11764.rar
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
226350194-050944-sanlccjavap0003-11764.rar
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
226350194-050944-sanlccjavap0003-11764.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
226350194-050944-sanlccjavap0003-11764.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
Civilhortonoms/Dyretmmersken/Mealybug/Laesning.sko
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
Civilhortonoms/Dyretmmersken/Mealybug/Laesning.sko
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
Ejerkredsen/Lulledes/Filateliens31.don
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
Ejerkredsen/Lulledes/Filateliens31.don
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
Ejerkredsen/Lulledes/Preconizing.ps1
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
Ejerkredsen/Lulledes/Preconizing.ps1
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
Sudsers34/Neoterist/Opslagsbindenes/Oplivelse/indsigelse.ant
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
Sudsers34/Neoterist/Opslagsbindenes/Oplivelse/indsigelse.ant
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
Sudsers34/Neoterist/Opslagsbindenes/Oplivelse/smreostens.oxo
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
Sudsers34/Neoterist/Opslagsbindenes/Oplivelse/smreostens.oxo
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
Telekablets/krakileres/miditest/Herpetotomist.txt
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
Telekablets/krakileres/miditest/Herpetotomist.txt
Resource
win10v2004-20240226-en
General
-
Target
Civilhortonoms/Dyretmmersken/Mealybug/Laesning.sko
-
Size
348KB
-
MD5
edac2c2f62e371a80143df8caaec5b24
-
SHA1
0b7e4c090f25b6a0ffdab3e1d4e94ea3a706584b
-
SHA256
ae0652e2eedf1db5506d11bdf75d677c37fb7896c64435f6afdf9161235a9616
-
SHA512
aa37fc1656f385b4a18c2cd8edd4c6befec3b9df14fb656bbc831274c4e1708e292e0e60e26470f3159d2ab1819b39594cc854428b65028bc468c43d3d12e3be
-
SSDEEP
6144:uAnjNQSAw5Htnf4hUAa4bCpMcIZpToALgteXtF0h4cNjo3IWrh9l7LxCgIMtlYk2:Nj0wlWhXaPpMcIZpNgwdF4Njsn7O++
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\sko_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\sko_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\sko_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\sko_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\sko_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\sko_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.sko rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.sko\ = "sko_auto_file" rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2524 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2524 AcroRd32.exe 2524 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1280 wrote to memory of 2556 1280 cmd.exe 29 PID 1280 wrote to memory of 2556 1280 cmd.exe 29 PID 1280 wrote to memory of 2556 1280 cmd.exe 29 PID 2556 wrote to memory of 2524 2556 rundll32.exe 30 PID 2556 wrote to memory of 2524 2556 rundll32.exe 30 PID 2556 wrote to memory of 2524 2556 rundll32.exe 30 PID 2556 wrote to memory of 2524 2556 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Civilhortonoms\Dyretmmersken\Mealybug\Laesning.sko1⤵
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Civilhortonoms\Dyretmmersken\Mealybug\Laesning.sko2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Civilhortonoms\Dyretmmersken\Mealybug\Laesning.sko"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2524
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5ddac41728ffbc7d4513ed0c2fc8a0c6b
SHA10a8efb878191413f4ed74593cf7df68d3804e38b
SHA256b9c06478efbe5c9757bbcd7dc6a169b0f7708c7277d97770d5d442cb459873fa
SHA5124e2dc4ed1a14d5d811ce589cd5cb10c6c6bc89b9ddb17019e76fea85918fb4ec4c2c4e207660caeb19d8b29bae66d726474922f6f09604ac2f173052e6142fa6