Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
28/05/2024, 08:29
Static task
static1
Behavioral task
behavioral1
Sample
中体彩2024年度员工晋升材料/中体彩2024年度员工晋升材料报名表.pdf.lnk
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
中体彩2024年度员工晋升材料/中体彩2024年度员工晋升材料报名表.pdf.lnk
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
中体彩2024年度员工晋升材料/其他信息/.__MACOS__/.__MACOS__/._MACOSX_/PROPSYS.dll
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
中体彩2024年度员工晋升材料/其他信息/.__MACOS__/.__MACOS__/._MACOSX_/PROPSYS.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
中体彩2024年度员工晋升材料/其他信息/.__MACOS__/.__MACOS__/._MACOSX_/osd.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
中体彩2024年度员工晋升材料/其他信息/.__MACOS__/.__MACOS__/._MACOSX_/osd.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
中体彩2024年度员工晋升材料/其他信息/中体彩2024年度员工晋升材料报名表.pdf.lnk
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
中体彩2024年度员工晋升材料/其他信息/中体彩2024年度员工晋升材料报名表.pdf.lnk
Resource
win10v2004-20240426-en
General
-
Target
中体彩2024年度员工晋升材料/中体彩2024年度员工晋升材料报名表.pdf.lnk
-
Size
727B
-
MD5
c02c168c1c97d6f113b88cb8c1ddedf9
-
SHA1
ee235ca5916d3003eab418dd9a3e2e0286bc3852
-
SHA256
cd029ad0d35e589c6340a33b094a3ae866648e4b93926ad7b3278d1531b583f3
-
SHA512
857ca5cacd21d194288a82a60a0cab439cde23beef5ebb4f83a4cb0a60694ff32c83682e4414355e26a59d4c73c29c2cac538107ee5cb95bf001b66582d6f569
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2860 wrote to memory of 2524 2860 cmd.exe 29 PID 2860 wrote to memory of 2524 2860 cmd.exe 29 PID 2860 wrote to memory of 2524 2860 cmd.exe 29 PID 2684 wrote to memory of 2588 2684 explorer.exe 31 PID 2684 wrote to memory of 2588 2684 explorer.exe 31 PID 2684 wrote to memory of 2588 2684 explorer.exe 31
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\中体彩2024年度员工晋升材料\中体彩2024年度员工晋升材料报名表.pdf.lnk1⤵
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\explorer.exe"C:\Windows\explorer.exe" ".\其他信息\.__MACOS__\.__MACOS__\._MACOSX_\osd.com"2⤵PID:2524
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\中体彩2024年度员工晋升材料\其他信息\.__MACOS__\.__MACOS__\._MACOSX_\osd.com"C:\Users\Admin\AppData\Local\Temp\中体彩2024年度员工晋升材料\其他信息\.__MACOS__\.__MACOS__\._MACOSX_\osd.com"2⤵PID:2588
-