Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    02/05/2024, 05:12

General

  • Target

    Innormal_Snipers_Free.rar

  • Size

    5.7MB

  • MD5

    93afb2629de7b113f62fe5f796d671a2

  • SHA1

    a18cca4f700765679f0137d4938ac2c9c9d99b31

  • SHA256

    5dc64c6381b9213f7d158d9c09a5dfa55b74cc9f16c49a4d81484eb7105cf33f

  • SHA512

    45499fefa7322bfd09abb060de533def74f398fcd1e9b51998b5fb06a3ab44794de2cff4eeb5127580b50304f87491218b8482dc54d7b9c9979daaa02330d030

  • SSDEEP

    98304:PRYBbxC+WcPKIY6vtpZfUHd3MtJIwlr/c6pcD1TmxdT9p94YCOX2:wbxC+W+KZ6Z4rDxD10dhp9F2

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 9 IoCs
  • Suspicious use of SendNotifyMessage 8 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Innormal_Snipers_Free.rar
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2412
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Innormal_Snipers_Free.rar
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2260
      • C:\Program Files\VideoLAN\VLC\vlc.exe
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Innormal_Snipers_Free.rar"
        3⤵
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:2676

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2676-30-0x000007FEF72A0000-0x000007FEF72D4000-memory.dmp

    Filesize

    208KB

  • memory/2676-29-0x000000013F2F0000-0x000000013F3E8000-memory.dmp

    Filesize

    992KB

  • memory/2676-32-0x000007FEFBB90000-0x000007FEFBBA8000-memory.dmp

    Filesize

    96KB

  • memory/2676-33-0x000007FEF7150000-0x000007FEF7167000-memory.dmp

    Filesize

    92KB

  • memory/2676-34-0x000007FEF7130000-0x000007FEF7141000-memory.dmp

    Filesize

    68KB

  • memory/2676-35-0x000007FEF6B80000-0x000007FEF6B97000-memory.dmp

    Filesize

    92KB

  • memory/2676-36-0x000007FEF6B60000-0x000007FEF6B71000-memory.dmp

    Filesize

    68KB

  • memory/2676-31-0x000007FEF6500000-0x000007FEF67B4000-memory.dmp

    Filesize

    2.7MB

  • memory/2676-38-0x000007FEF6B20000-0x000007FEF6B31000-memory.dmp

    Filesize

    68KB

  • memory/2676-37-0x000007FEF6B40000-0x000007FEF6B5D000-memory.dmp

    Filesize

    116KB

  • memory/2676-55-0x000007FEF5050000-0x000007FEF5078000-memory.dmp

    Filesize

    160KB

  • memory/2676-60-0x000007FEF4F90000-0x000007FEF4FA2000-memory.dmp

    Filesize

    72KB

  • memory/2676-59-0x000007FEF4FB0000-0x000007FEF4FC1000-memory.dmp

    Filesize

    68KB

  • memory/2676-58-0x000007FEF4FD0000-0x000007FEF4FF3000-memory.dmp

    Filesize

    140KB

  • memory/2676-57-0x000007FEF5000000-0x000007FEF5017000-memory.dmp

    Filesize

    92KB

  • memory/2676-56-0x000007FEF5020000-0x000007FEF5044000-memory.dmp

    Filesize

    144KB

  • memory/2676-54-0x000007FEF5080000-0x000007FEF50D6000-memory.dmp

    Filesize

    344KB

  • memory/2676-53-0x000007FEF50E0000-0x000007FEF50F1000-memory.dmp

    Filesize

    68KB

  • memory/2676-52-0x000007FEF5100000-0x000007FEF516F000-memory.dmp

    Filesize

    444KB

  • memory/2676-51-0x000007FEF5170000-0x000007FEF51D7000-memory.dmp

    Filesize

    412KB

  • memory/2676-61-0x000007FEF2940000-0x000007FEF2AB8000-memory.dmp

    Filesize

    1.5MB

  • memory/2676-50-0x000007FEF51E0000-0x000007FEF5210000-memory.dmp

    Filesize

    192KB

  • memory/2676-49-0x000007FEF5210000-0x000007FEF5228000-memory.dmp

    Filesize

    96KB

  • memory/2676-48-0x000007FEF5230000-0x000007FEF5241000-memory.dmp

    Filesize

    68KB

  • memory/2676-47-0x000007FEF6A10000-0x000007FEF6A2B000-memory.dmp

    Filesize

    108KB

  • memory/2676-46-0x000007FEF6A30000-0x000007FEF6A41000-memory.dmp

    Filesize

    68KB

  • memory/2676-45-0x000007FEF6A50000-0x000007FEF6A61000-memory.dmp

    Filesize

    68KB

  • memory/2676-69-0x000007FEF0270000-0x000007FEF02D2000-memory.dmp

    Filesize

    392KB

  • memory/2676-68-0x000007FEF02E0000-0x000007FEF0355000-memory.dmp

    Filesize

    468KB

  • memory/2676-67-0x000007FEF0360000-0x000007FEF0425000-memory.dmp

    Filesize

    788KB

  • memory/2676-39-0x000007FEF5450000-0x000007FEF64FB000-memory.dmp

    Filesize

    16.7MB

  • memory/2676-70-0x000007FEF0200000-0x000007FEF026D000-memory.dmp

    Filesize

    436KB

  • memory/2676-66-0x000007FEF15E0000-0x000007FEF15F6000-memory.dmp

    Filesize

    88KB

  • memory/2676-65-0x000007FEF1600000-0x000007FEF1611000-memory.dmp

    Filesize

    68KB

  • memory/2676-64-0x000007FEF1C50000-0x000007FEF1C7F000-memory.dmp

    Filesize

    188KB

  • memory/2676-63-0x000007FEF7CB0000-0x000007FEF7CC0000-memory.dmp

    Filesize

    64KB

  • memory/2676-62-0x000007FEF7790000-0x000007FEF77A7000-memory.dmp

    Filesize

    92KB

  • memory/2676-44-0x000007FEF6A70000-0x000007FEF6A81000-memory.dmp

    Filesize

    68KB

  • memory/2676-43-0x000007FEF6A90000-0x000007FEF6AA8000-memory.dmp

    Filesize

    96KB

  • memory/2676-42-0x000007FEF6AB0000-0x000007FEF6AD1000-memory.dmp

    Filesize

    132KB

  • memory/2676-41-0x000007FEF6AE0000-0x000007FEF6B1F000-memory.dmp

    Filesize

    252KB

  • memory/2676-40-0x000007FEF5250000-0x000007FEF5450000-memory.dmp

    Filesize

    2.0MB