Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    22/05/2024, 11:43

General

  • Target

    download.sh

  • Size

    640B

  • MD5

    3da8fa21cc5561c07a651653d926601b

  • SHA1

    763d24b7b2d8fb30f377275c172916f0ea3d6af7

  • SHA256

    3d0914e9be762d7244f539dee6007fc05e437f3e8957a7b54d584c323786de0f

  • SHA512

    d4765e43efa8c0bdb2e7f6b9b1165b22793e7e1e0c30f8a5be83d0e9c3bc52d9b7db614886a1a1f835a3da3300c7e55b687c7a9febec24e790c378f1bcdaf8cb

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\download.sh
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1544
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\download.sh
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2564
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\download.sh"
        3⤵
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2576

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    cd5590751535a23eb5f9cd473c647508

    SHA1

    5a4ac4c38f73c82e5b982b1bf4d74e0863500458

    SHA256

    3a5151ee233b82a9f36fe73e1d5f9faefa9e997144bfcc5b74f7e416c843eca3

    SHA512

    e0ae82a1c5e238933c8eaa96a64a9437677f75c08c1592cbeea419887beebdfa3434cd2c30cfd5a7f5f0553f304bdf712a4271010502779dc9a05f4ac3e9594c