Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28/05/2024, 08:29
Static task
static1
Behavioral task
behavioral1
Sample
中体彩2024年度员工晋升材料/中体彩2024年度员工晋升材料报名表.pdf.lnk
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
中体彩2024年度员工晋升材料/中体彩2024年度员工晋升材料报名表.pdf.lnk
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
中体彩2024年度员工晋升材料/其他信息/.__MACOS__/.__MACOS__/._MACOSX_/PROPSYS.dll
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
中体彩2024年度员工晋升材料/其他信息/.__MACOS__/.__MACOS__/._MACOSX_/PROPSYS.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
中体彩2024年度员工晋升材料/其他信息/.__MACOS__/.__MACOS__/._MACOSX_/osd.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
中体彩2024年度员工晋升材料/其他信息/.__MACOS__/.__MACOS__/._MACOSX_/osd.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
中体彩2024年度员工晋升材料/其他信息/中体彩2024年度员工晋升材料报名表.pdf.lnk
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
中体彩2024年度员工晋升材料/其他信息/中体彩2024年度员工晋升材料报名表.pdf.lnk
Resource
win10v2004-20240426-en
General
-
Target
中体彩2024年度员工晋升材料/其他信息/.__MACOS__/.__MACOS__/._MACOSX_/osd.exe
-
Size
245KB
-
MD5
4acc218e13667ca101cab9db29e44a77
-
SHA1
a84bcee7738b86ae41baee4e73d0a8c2a735e0fe
-
SHA256
1ab5183a4d362a358b27a66b3013fcb17486e3d44b018fc1fa2cc2c7ba3f963e
-
SHA512
361eaad250755271d5158c30393e28cdceed54d8756c13a22dde303147ae9a4530c3f9758628d69e43240bc5582056eabf3df6d3672f1dd3f51c109566aec89a
-
SSDEEP
6144:KpfXnqiLZ32RnqlPy0GrN5HTohi9qQuFnwOEm:KpfXnzGRnRrzoY9zOEm
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2924 set thread context of 3632 2924 osd.exe 99 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2924 wrote to memory of 3632 2924 osd.exe 99 PID 2924 wrote to memory of 3632 2924 osd.exe 99 PID 2924 wrote to memory of 3632 2924 osd.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\中体彩2024年度员工晋升材料\其他信息\.__MACOS__\.__MACOS__\._MACOSX_\osd.exe"C:\Users\Admin\AppData\Local\Temp\中体彩2024年度员工晋升材料\其他信息\.__MACOS__\.__MACOS__\._MACOSX_\osd.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\system32\runonce.exeC:\Windows\system32\runonce.exe2⤵PID:3632
-