Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
1mirage 1.16 v.0.2.zip
windows7-x64
1mirage 1.16 v.0.2.zip
windows10-2004-x64
1Mirage 1.1...ies.gz
windows7-x64
3Mirage 1.1...ies.gz
windows10-2004-x64
3Mirage 1.1...ids.gz
windows7-x64
3Mirage 1.1...ids.gz
windows10-2004-x64
3Mirage 1.1...her.gz
windows7-x64
3Mirage 1.1...her.gz
windows10-2004-x64
3Mirage 1.1...ks.dat
windows7-x64
3Mirage 1.1...ks.dat
windows10-2004-x64
3Mirage 1.1...ies.gz
windows7-x64
3Mirage 1.1...ies.gz
windows10-2004-x64
7Mirage 1.1...end.gz
windows7-x64
3Mirage 1.1...end.gz
windows10-2004-x64
3Mirage 1.1...end.gz
windows7-x64
3Mirage 1.1...end.gz
windows10-2004-x64
3Mirage 1.1...ks.dat
windows7-x64
3Mirage 1.1...ks.dat
windows10-2004-x64
3Mirage 1.1...0.json
windows7-x64
3Mirage 1.1...0.json
windows10-2004-x64
3Mirage 1.1...0.json
windows7-x64
3Mirage 1.1...0.json
windows10-2004-x64
3Mirage 1.1...ies.gz
windows7-x64
3Mirage 1.1...ies.gz
windows10-2004-x64
3Mirage 1.1...ids.gz
windows7-x64
3Mirage 1.1...ids.gz
windows10-2004-x64
7Mirage 1.1...ges.gz
windows7-x64
3Mirage 1.1...ges.gz
windows10-2004-x64
3Mirage 1.1...ks.dat
windows7-x64
3Mirage 1.1...ks.dat
windows10-2004-x64
3Mirage 1.1...on.png
windows7-x64
1Mirage 1.1...on.png
windows10-2004-x64
3Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
25/05/2024, 17:12
Static task
static1
Behavioral task
behavioral1
Sample
mirage 1.16 v.0.2.zip
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
mirage 1.16 v.0.2.zip
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
Mirage 1.16 v0.2/DIM-1/data/capabilities.gz
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
Mirage 1.16 v0.2/DIM-1/data/capabilities.gz
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
Mirage 1.16 v0.2/DIM-1/data/raids.gz
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
Mirage 1.16 v0.2/DIM-1/data/raids.gz
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
Mirage 1.16 v0.2/DIM-1/data/villages_nether.gz
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
Mirage 1.16 v0.2/DIM-1/data/villages_nether.gz
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
Mirage 1.16 v0.2/DIM-1/forcedchunks.dat
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
Mirage 1.16 v0.2/DIM-1/forcedchunks.dat
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
Mirage 1.16 v0.2/DIM1/data/capabilities.gz
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
Mirage 1.16 v0.2/DIM1/data/capabilities.gz
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
Mirage 1.16 v0.2/DIM1/data/raids_end.gz
Resource
win7-20240419-en
Behavioral task
behavioral14
Sample
Mirage 1.16 v0.2/DIM1/data/raids_end.gz
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
Mirage 1.16 v0.2/DIM1/data/villages_end.gz
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
Mirage 1.16 v0.2/DIM1/data/villages_end.gz
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
Mirage 1.16 v0.2/DIM1/forcedchunks.dat
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
Mirage 1.16 v0.2/DIM1/forcedchunks.dat
Resource
win10v2004-20240426-en
Behavioral task
behavioral19
Sample
Mirage 1.16 v0.2/advancements/00000000-0000-0000-0000-000000000000.json
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
Mirage 1.16 v0.2/advancements/00000000-0000-0000-0000-000000000000.json
Resource
win10v2004-20240426-en
Behavioral task
behavioral21
Sample
Mirage 1.16 v0.2/advancements/c4447e81-96d0-4a3e-8ba0-f49a22115ac0.json
Resource
win7-20240508-en
Behavioral task
behavioral22
Sample
Mirage 1.16 v0.2/advancements/c4447e81-96d0-4a3e-8ba0-f49a22115ac0.json
Resource
win10v2004-20240426-en
Behavioral task
behavioral23
Sample
Mirage 1.16 v0.2/data/capabilities.gz
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
Mirage 1.16 v0.2/data/capabilities.gz
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
Mirage 1.16 v0.2/data/raids.gz
Resource
win7-20240508-en
Behavioral task
behavioral26
Sample
Mirage 1.16 v0.2/data/raids.gz
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
Mirage 1.16 v0.2/data/villages.gz
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
Mirage 1.16 v0.2/data/villages.gz
Resource
win10v2004-20240426-en
Behavioral task
behavioral29
Sample
Mirage 1.16 v0.2/forcedchunks.dat
Resource
win7-20240508-en
Behavioral task
behavioral30
Sample
Mirage 1.16 v0.2/forcedchunks.dat
Resource
win10v2004-20240426-en
Behavioral task
behavioral31
Sample
Mirage 1.16 v0.2/icon.png
Resource
win7-20240419-en
Behavioral task
behavioral32
Sample
Mirage 1.16 v0.2/icon.png
Resource
win10v2004-20240508-en
General
-
Target
Mirage 1.16 v0.2/DIM-1/forcedchunks.dat
-
Size
22B
-
MD5
87e95b37c11f1139dc218d907fbb24de
-
SHA1
32d7225738c6ee6ae6e526f16d695d77ea4278c3
-
SHA256
8a1ff1d28cc89befe2b93aec31a800604d46b8e653e6a106d409a240cda20738
-
SHA512
8fc0c3dbe07eac36330e6a698620deaa7dab18443fe13dacee1cfe7eaa3f18e882aec057f344a50bca5ed5a001541ecab7dd0506206a5d89511c4ee39fce0f14
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.dat\ = "dat_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\dat_auto_file\shell rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\dat_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\dat_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\dat_auto_file\shell\Read\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\dat_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\dat_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.dat rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2612 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2612 AcroRd32.exe 2612 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2440 wrote to memory of 2592 2440 cmd.exe 29 PID 2440 wrote to memory of 2592 2440 cmd.exe 29 PID 2440 wrote to memory of 2592 2440 cmd.exe 29 PID 2592 wrote to memory of 2612 2592 rundll32.exe 30 PID 2592 wrote to memory of 2612 2592 rundll32.exe 30 PID 2592 wrote to memory of 2612 2592 rundll32.exe 30 PID 2592 wrote to memory of 2612 2592 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Mirage 1.16 v0.2\DIM-1\forcedchunks.dat"1⤵
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Mirage 1.16 v0.2\DIM-1\forcedchunks.dat2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Mirage 1.16 v0.2\DIM-1\forcedchunks.dat"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2612
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD547fb1cbd33e4e40f9800cdc82aea28f5
SHA1cfcb9b1fa0c17753d8f56c63aa9f07ca7922b5b0
SHA256e5fe73bee8c0c64efdbc59f426597f7c7ee2b3aa3a7a50cd1f27795843d8bd2b
SHA5128f79d41f817a7b2359e1ff1ee29f759e97daf8b5d62ba5a9711ab3864e6d5c047be4962e9640157decaae16d2ef8e25f34d70a5a872d42a20568d2cd79ba4334