Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    96s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/04/2024, 12:49

General

  • Target

    D0puslunar12.33-de.rar

  • Size

    65.7MB

  • MD5

    0c4bbf23849fa553ce1dd668dc5d0341

  • SHA1

    3d403740b24da559212928ca77e454ace41039fb

  • SHA256

    8166e9f4dde03649255b9fea4a9920ed2f55e18f05bb8cb68194bb9636e935a4

  • SHA512

    9f77b58afe46bb3565b9279090c6cd7848f2bf54d18c4e47f556b8a0f8bc596ab7d22b2ec4f481bd59ad7beb6838a515024a25397564d5a0280c674909fb416d

  • SSDEEP

    1572864:kXm5hMulWZMvRpggqEfakm2P6mwz4R/RdZVXNwEO+:kXmMC8MpmgqKpWzoRD9LO+

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\D0puslunar12.33-de.rar
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:448
    • C:\Program Files\7-Zip\7zFM.exe
      "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\D0puslunar12.33-de.rar"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:4620

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads