Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    133s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    15/04/2024, 10:31

General

  • Target

    oofile_1.47/oofile.exe

  • Size

    256KB

  • MD5

    c914296daf71a04ef114271500d8315b

  • SHA1

    5046cddbd10683d478b70721ee472cc9ee70066a

  • SHA256

    530075b0aa1716c3782b26ebaeb5d45735c6e7e97931a44a798510a5c47e0221

  • SHA512

    7f9cf37deb570eb839c2d81a32828762e4884f6dd2d783582e82ef62dda9688ead765918fdae725a5b63dc1c0dc0072b37b4ed393a451248ecf1231aeaf6e3d5

  • SSDEEP

    3072:cRCTg1Y3ZaYhuXAmgRp9ZFd5d2YGdpxHdXSKJLUQNLdZXARuLlnrzlLiVl:oqZ5ufcFFd5d2FIU5WuZnli

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\oofile_1.47\oofile.exe
    "C:\Users\Admin\AppData\Local\Temp\oofile_1.47\oofile.exe"
    1⤵
    • Adds Run key to start application
    • Writes to the Master Boot Record (MBR)
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:1948

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\oofile_1.47\data\config.ini

    Filesize

    370B

    MD5

    0f5712d99f428e49ede8f5278be4f1d0

    SHA1

    7b9bae009c897a5a6e8f0c16b038b5c2b0cf8b14

    SHA256

    f6fb283e4dcedd30579edf37cb241498186d79131e37a1919f0dcd3216c1bcb2

    SHA512

    2793f5cf7512ed690f7d5456b40e5bbe727c0c23590b6e05ac00df9991980e62e29d71073b9398578fb310e7f276ae4ceec6a2688f26997895c5f7c6bab7df01

  • memory/1948-0-0x0000000000270000-0x0000000000271000-memory.dmp

    Filesize

    4KB

  • memory/1948-1-0x0000000001F90000-0x0000000001FE5000-memory.dmp

    Filesize

    340KB

  • memory/1948-172-0x0000000000270000-0x0000000000271000-memory.dmp

    Filesize

    4KB