Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10logitechs.rar
windows7-x64
3logitechs.rar
windows10-2004-x64
7Guna.UI2.dll
windows7-x64
1Guna.UI2.dll
windows10-2004-x64
1niggerspoofa.exe
windows7-x64
10niggerspoofa.exe
windows10-2004-x64
10niggerspoo...config
windows7-x64
3niggerspoo...config
windows10-2004-x64
3niggerspoofa.pdb
windows7-x64
3niggerspoofa.pdb
windows10-2004-x64
3Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10/03/2024, 16:47
Behavioral task
behavioral1
Sample
logitechs.rar
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
logitechs.rar
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
Guna.UI2.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Guna.UI2.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
niggerspoofa.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
niggerspoofa.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
niggerspoofa.exe.config
Resource
win7-20240215-en
Behavioral task
behavioral8
Sample
niggerspoofa.exe.config
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
niggerspoofa.pdb
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
niggerspoofa.pdb
Resource
win10v2004-20240226-en
General
-
Target
logitechs.rar
-
Size
831KB
-
MD5
be8d71d85dad972f20fef61e6dbd0852
-
SHA1
57c9cf48f04395bd4d6cc4587bd8bc050f582626
-
SHA256
761cc48d25bd9921b8d978fd254d2795f665c7e0a8eb2e9210f4fedef15a4906
-
SHA512
29528e75cd9c719a4fab84b59d9f264cb53a9ca52b97363f4f33b938d55cd7c45891dd0a5e0fedb747dfe90ea37d13c5af53f8fe2e6c3c28141bbc2a2993d6d2
-
SSDEEP
24576:3qrATxdDgfzEJXGTGkW1kSg7r3ZliJ9wtD:36odDgfzq2CkuGH3GJ9wl
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3044 7zFM.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 3044 7zFM.exe Token: 35 3044 7zFM.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3044 7zFM.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2732 wrote to memory of 3044 2732 cmd.exe 29 PID 2732 wrote to memory of 3044 2732 cmd.exe 29 PID 2732 wrote to memory of 3044 2732 cmd.exe 29
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\logitechs.rar1⤵
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\logitechs.rar"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3044
-