Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
255s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-es -
resource tags
arch:x64arch:x86image:win10v2004-20240412-eslocale:es-esos:windows10-2004-x64systemwindows -
submitted
24/04/2024, 04:56
Static task
static1
Behavioral task
behavioral1
Sample
3de2a4392b8715bad070b2ae12243f166ead37830f7c6d24e778985927f9caac.py
Resource
win7-20240221-es
Behavioral task
behavioral2
Sample
3de2a4392b8715bad070b2ae12243f166ead37830f7c6d24e778985927f9caac.py
Resource
win10v2004-20240412-es
General
-
Target
3de2a4392b8715bad070b2ae12243f166ead37830f7c6d24e778985927f9caac.py
-
Size
5KB
-
MD5
0c1554888ce9ed0da1583dbdf7b31651
-
SHA1
988fc0d23e6e30c2c46ccec9bbff50b7453b8ba9
-
SHA256
3de2a4392b8715bad070b2ae12243f166ead37830f7c6d24e778985927f9caac
-
SHA512
51e2c0315df248bfdbad5a4d8c66159fb086e66e929afe317fa2a236658e4212fc5ae22c24bdef155a5e35b8c760e5684de8a8847bb015d63bc77440e06811c2
-
SSDEEP
96:6nGJh/TGjHjsOzwMBbPo23y2CKAvHfApKAHUIAAGHAHQAHCCHATAHAHoHAH3/HAQ:6ah/TkDsOzZPJ3GvoB27g5vgMgIgX/gQ
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000_Classes\Local Settings OpenWith.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 3688 NOTEPAD.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 100 OpenWith.exe -
Suspicious use of SetWindowsHookEx 37 IoCs
pid Process 100 OpenWith.exe 100 OpenWith.exe 100 OpenWith.exe 100 OpenWith.exe 100 OpenWith.exe 100 OpenWith.exe 100 OpenWith.exe 100 OpenWith.exe 100 OpenWith.exe 100 OpenWith.exe 100 OpenWith.exe 100 OpenWith.exe 100 OpenWith.exe 100 OpenWith.exe 100 OpenWith.exe 100 OpenWith.exe 100 OpenWith.exe 100 OpenWith.exe 100 OpenWith.exe 100 OpenWith.exe 100 OpenWith.exe 100 OpenWith.exe 100 OpenWith.exe 100 OpenWith.exe 100 OpenWith.exe 100 OpenWith.exe 100 OpenWith.exe 100 OpenWith.exe 100 OpenWith.exe 100 OpenWith.exe 100 OpenWith.exe 100 OpenWith.exe 100 OpenWith.exe 100 OpenWith.exe 100 OpenWith.exe 100 OpenWith.exe 100 OpenWith.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 100 wrote to memory of 3688 100 OpenWith.exe 103 PID 100 wrote to memory of 3688 100 OpenWith.exe 103
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\3de2a4392b8715bad070b2ae12243f166ead37830f7c6d24e778985927f9caac.py1⤵
- Modifies registry class
PID:4236
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:100 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\3de2a4392b8715bad070b2ae12243f166ead37830f7c6d24e778985927f9caac.py2⤵
- Opens file in notepad (likely ransom note)
PID:3688
-