Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22/05/2024, 11:43
Static task
static1
Behavioral task
behavioral1
Sample
download.sh
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
download.sh
Resource
win10v2004-20240508-en
General
-
Target
download.sh
-
Size
640B
-
MD5
3da8fa21cc5561c07a651653d926601b
-
SHA1
763d24b7b2d8fb30f377275c172916f0ea3d6af7
-
SHA256
3d0914e9be762d7244f539dee6007fc05e437f3e8957a7b54d584c323786de0f
-
SHA512
d4765e43efa8c0bdb2e7f6b9b1165b22793e7e1e0c30f8a5be83d0e9c3bc52d9b7db614886a1a1f835a3da3300c7e55b687c7a9febec24e790c378f1bcdaf8cb
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\sh_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\sh_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\sh_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.sh rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.sh\ = "sh_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\sh_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\sh_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\sh_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2576 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2576 AcroRd32.exe 2576 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1544 wrote to memory of 2564 1544 cmd.exe 29 PID 1544 wrote to memory of 2564 1544 cmd.exe 29 PID 1544 wrote to memory of 2564 1544 cmd.exe 29 PID 2564 wrote to memory of 2576 2564 rundll32.exe 30 PID 2564 wrote to memory of 2576 2564 rundll32.exe 30 PID 2564 wrote to memory of 2576 2564 rundll32.exe 30 PID 2564 wrote to memory of 2576 2564 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\download.sh1⤵
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\download.sh2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\download.sh"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2576
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5cd5590751535a23eb5f9cd473c647508
SHA15a4ac4c38f73c82e5b982b1bf4d74e0863500458
SHA2563a5151ee233b82a9f36fe73e1d5f9faefa9e997144bfcc5b74f7e416c843eca3
SHA512e0ae82a1c5e238933c8eaa96a64a9437677f75c08c1592cbeea419887beebdfa3434cd2c30cfd5a7f5f0553f304bdf712a4271010502779dc9a05f4ac3e9594c