Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
15/05/2024, 16:48
Static task
static1
Behavioral task
behavioral1
Sample
GizmoHelper-UE_5.4/Binaries/Win64/UnrealEditor-GizmoHelperTool.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
GizmoHelper-UE_5.4/Binaries/Win64/UnrealEditor-GizmoHelperTool.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
GizmoHelper-UE_5.4/Binaries/Win64/UnrealEditor-GizmoHelperTool.pdb
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
GizmoHelper-UE_5.4/Binaries/Win64/UnrealEditor-GizmoHelperTool.pdb
Resource
win10v2004-20240426-en
General
-
Target
GizmoHelper-UE_5.4/Binaries/Win64/UnrealEditor-GizmoHelperTool.pdb
-
Size
54.5MB
-
MD5
b148ebc60df83ad04c10ba6e4e2b92da
-
SHA1
96379dde5ff67d77e0aa6a9c9adca43b8a6ff6f7
-
SHA256
62bee112e0f6a1223b37544403d183fb9ad6cdb00fb44cbc2b72f828fefc498e
-
SHA512
7d7f25822c02a8005e5c0a5c7972268aa37bfad932fd582b3b4641338077a78fe1df21bb2c944e935ec5082a2a3db9e400f3dda5c8efebf9fb38bc4c8043bc77
-
SSDEEP
196608:fpR7287Ah7yQR1wSE4biC32DZTAHIQqq2qpSCUif:hV28Eh7yQR1wSE4biXQqqR
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\pdb_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.pdb rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\pdb_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\pdb_auto_file\shell\Read\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\pdb_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.pdb\ = "pdb_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\pdb_auto_file\shell\Read rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\pdb_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2588 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2588 AcroRd32.exe 2588 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1620 wrote to memory of 320 1620 cmd.exe 29 PID 1620 wrote to memory of 320 1620 cmd.exe 29 PID 1620 wrote to memory of 320 1620 cmd.exe 29 PID 320 wrote to memory of 2588 320 rundll32.exe 30 PID 320 wrote to memory of 2588 320 rundll32.exe 30 PID 320 wrote to memory of 2588 320 rundll32.exe 30 PID 320 wrote to memory of 2588 320 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\GizmoHelper-UE_5.4\Binaries\Win64\UnrealEditor-GizmoHelperTool.pdb1⤵
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\GizmoHelper-UE_5.4\Binaries\Win64\UnrealEditor-GizmoHelperTool.pdb2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\GizmoHelper-UE_5.4\Binaries\Win64\UnrealEditor-GizmoHelperTool.pdb"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2588
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD50929b67aa8acb15626fbef20481dbd7b
SHA1428aac33d0faf45423d218154740ff21d9a2bd96
SHA256267d402a8d57b760dce7fdbad5995bf2e02f79adbb33e8e49f7873fb8ba604d5
SHA51238adf44f40301e4499d76e6ec2537665d87c2d769ad68f3857434173f51e8635ac237f8f26e096d73c379866620cd03b3dd6340d7e13b2a104de436593e074be