Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
02/05/2024, 22:15
Static task
static1
Behavioral task
behavioral1
Sample
Laun4er!_PSWRD----1889.7z
Resource
win7-20231129-en
4 signatures
150 seconds
General
-
Target
Laun4er!_PSWRD----1889.7z
-
Size
9.0MB
-
MD5
5fa7a701e0a05313ae1b40102ede0389
-
SHA1
2960cba4ef1a0fde8f8dea5b317d35ef1ec63fea
-
SHA256
f1c2c0985ce7dc4ec3e51dc52ca5af913b3177dab18b6a2f9fefb7f1a0a5c7bc
-
SHA512
83a2ed56044f5fb7f1bcbdfb747363455e42aab970f700bdc56e7434cbc5644e14c953ff5b6392d04402f68d22d312729f2fea17d042e8aae46807932c9ab660
-
SSDEEP
196608:0rMa/IGuTieVXUtPs5iO/zMp1WzNDuMYZsNZST:JNXqk53MqzhutZX
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2376 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1988 wrote to memory of 2376 1988 cmd.exe 29 PID 1988 wrote to memory of 2376 1988 cmd.exe 29 PID 1988 wrote to memory of 2376 1988 cmd.exe 29
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Laun4er!_PSWRD----1889.7z1⤵
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Laun4er!_PSWRD----1889.7z2⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:2376
-