Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    134s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    27/04/2024, 16:18

General

  • Target

    WaveTrial/chrome_100_percent.pak

  • Size

    682KB

  • MD5

    d3e06f624bf92e9d8aecb16da9731c52

  • SHA1

    565bdcbfcbfcd206561080c2000d93470417d142

  • SHA256

    4ee67f0b0b9ad2898e0d70ddfad3541fbd37520686f9e827a845d1930a590362

  • SHA512

    497126af59961054155fbb8c3789d6278a1f5426000342f25f54115429ff024e629783f50f0c5350500007854712b07f7d8174ecfe60d59c4fdd5f3d72dac262

  • SSDEEP

    12288:jI3H1fJxjzgsz5B0GDJQrnKs8SNP+QSsSilRBiNz40D+cIXm4pEqoO0TehErw5:83VBx7zEEmPLSOiNz40KcUjpEqoO0TOR

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\WaveTrial\chrome_100_percent.pak
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2336
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\WaveTrial\chrome_100_percent.pak
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2660
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\WaveTrial\chrome_100_percent.pak"
        3⤵
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2604

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    ad0d23fdbaa3452ac987e830f89e70af

    SHA1

    94d85380511d026757a6bfcc35a3f4f888f0dc97

    SHA256

    bba02f26537d1f8ba4cab9f718dd2c2892168d8afdd108b046e1c5d73e6aecbb

    SHA512

    c02ea82c416525ce39dcdc62243bd67c44ebe2a8fbc10b38ed165a2e618d8983a6e23934ce83b3fd2293222b55f5f8537bd7fa90242aaa0c924f75f5b5bfd3cf