Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

05/04/2024, 21:46

240405-1mqqxaec37 7

05/04/2024, 21:45

240405-1l47xadg2w 3

Analysis

  • max time kernel
    122s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    05/04/2024, 21:46

General

  • Target

    oblivion/x64/Release/ImGui Lo.82212CF7.tlog/CL.read.1.tlog

  • Size

    241KB

  • MD5

    79a6b879f41c7feb89cfe9574d75e886

  • SHA1

    9e8569e3d779d57d0d535813aa3feedb514fe369

  • SHA256

    cd3e5119ec66556cf021440e8d4eb63cc3c203324b69bee6dcefbda73053f579

  • SHA512

    b1c4e44373343a8bd5a98e3f11bfbf5d2440c3ee34dcd2e1c4b55d5951ec65dc7299fc82bf8c2f6cdddf2f761418f94a4468e5bfd5552a2724b788057be33a38

  • SSDEEP

    384:W4vLDRDgPOtycvLDRDgP5BvLDRDgP+dvLDRDgPTj3XvLDRDgPFjtTnCELDRDgPMy:FuPOvuP/uPouPTjHuPFj4RPMj+

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\oblivion\x64\Release\ImGui Lo.82212CF7.tlog\CL.read.1.tlog"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2152
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\oblivion\x64\Release\ImGui Lo.82212CF7.tlog\CL.read.1.tlog
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2148
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\oblivion\x64\Release\ImGui Lo.82212CF7.tlog\CL.read.1.tlog"
        3⤵
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2632

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    74a01668baed5da6966e1803ad638a83

    SHA1

    070cc607dae757ed102ef85d638dd6045c8420f2

    SHA256

    0c10efda28f2894774313a8a76980d952fc397694056fe415c09bbef4989048f

    SHA512

    91a90dbdc47b49e832e21aa2c334191453a1203f0bad096d8a7115f44813acf01a0ba4713ceace498092027d0f0f0a655a6b5c7c1e52fa99d8a76b568c49a135