Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3consistluvbug.zip
windows7-x64
1consistluvbug.zip
windows10-2004-x64
1incognito/...st.txt
windows7-x64
1incognito/...st.txt
windows10-2004-x64
1incognito/...s.json
windows7-x64
3incognito/...s.json
windows10-2004-x64
3incognito/...au.dll
windows7-x64
1incognito/...au.dll
windows10-2004-x64
1incognito/...e.json
windows7-x64
3incognito/...e.json
windows10-2004-x64
3incognito/...st.lua
windows7-x64
3incognito/...st.lua
windows10-2004-x64
3incognito/...it.exe
windows7-x64
7incognito/...it.exe
windows10-2004-x64
7incognito/...le.txt
windows7-x64
1incognito/...le.txt
windows10-2004-x64
1incognito/...et.txt
windows7-x64
1incognito/...et.txt
windows10-2004-x64
1incognito/...le.txt
windows7-x64
1incognito/...le.txt
windows10-2004-x64
1incognito/..._1.txt
windows7-x64
1incognito/..._1.txt
windows10-2004-x64
1incognito/..._2.txt
windows7-x64
1incognito/..._2.txt
windows10-2004-x64
1incognito/...le.txt
windows7-x64
1incognito/...le.txt
windows10-2004-x64
1incognito/...le.txt
windows7-x64
1incognito/...le.txt
windows10-2004-x64
1incognito/...tefile
windows7-x64
1incognito/...tefile
windows10-2004-x64
1incognito/...le.txt
windows7-x64
1incognito/...le.txt
windows10-2004-x64
1Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
30/05/2024, 20:04
Static task
static1
Behavioral task
behavioral1
Sample
consistluvbug.zip
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
consistluvbug.zip
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
incognito/autoexecute/test.txt
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
incognito/autoexecute/test.txt
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
incognito/bin/api-docs.json
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
incognito/bin/api-docs.json
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
incognito/bin/incognito-luau.dll
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
incognito/bin/incognito-luau.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
incognito/bin/save.json
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
incognito/bin/save.json
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
incognito/scripts/test.lua
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
incognito/scripts/test.lua
Resource
win10v2004-20240426-en
Behavioral task
behavioral13
Sample
incognito/thegreatestexploit.exe
Resource
win7-20240419-en
Behavioral task
behavioral14
Sample
incognito/thegreatestexploit.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
incognito/workspace/.tests/appendfile.txt
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
incognito/workspace/.tests/appendfile.txt
Resource
win10v2004-20240426-en
Behavioral task
behavioral17
Sample
incognito/workspace/.tests/getcustomasset.txt
Resource
win7-20240220-en
Behavioral task
behavioral18
Sample
incognito/workspace/.tests/getcustomasset.txt
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
incognito/workspace/.tests/isfile.txt
Resource
win7-20240215-en
Behavioral task
behavioral20
Sample
incognito/workspace/.tests/isfile.txt
Resource
win10v2004-20240426-en
Behavioral task
behavioral21
Sample
incognito/workspace/.tests/listfiles/test_1.txt
Resource
win7-20240508-en
Behavioral task
behavioral22
Sample
incognito/workspace/.tests/listfiles/test_1.txt
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
incognito/workspace/.tests/listfiles/test_2.txt
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
incognito/workspace/.tests/listfiles/test_2.txt
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
incognito/workspace/.tests/loadfile.txt
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
incognito/workspace/.tests/loadfile.txt
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
incognito/workspace/.tests/readfile.txt
Resource
win7-20240508-en
Behavioral task
behavioral28
Sample
incognito/workspace/.tests/readfile.txt
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
incognito/workspace/.tests/writefile
Resource
win7-20240215-en
Behavioral task
behavioral30
Sample
incognito/workspace/.tests/writefile
Resource
win10v2004-20240426-en
Behavioral task
behavioral31
Sample
incognito/workspace/.tests/writefile.txt
Resource
win7-20240508-en
Behavioral task
behavioral32
Sample
incognito/workspace/.tests/writefile.txt
Resource
win10v2004-20240426-en
General
-
Target
incognito/bin/api-docs.json
-
Size
5.9MB
-
MD5
19c541f355cad5fb427a38317479b698
-
SHA1
aebc5b3b123ab962606b6072806027d9b6c758e9
-
SHA256
6c003208304e585290c9a655c51e5789c4f3e4241a9abc0139a9dbeb5d2884b1
-
SHA512
78e3cbe554cdf02457a3892033ebd9f74c5b4446e306248594d682918ea5dc6e52cafe72b3bdf59fda1f9f5b3879576ca1ef2d35cebc66f1d55543b618bcf7e5
-
SSDEEP
24576:7ccjk1+ox2ptidmo2KtMTdxsuBqXhGz+rM:hiVuBqXhGz+rM
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\json_auto_file\shell\Read rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\json_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\.json rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\.json\ = "json_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\json_auto_file\shell\Read\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_Classes\Local Settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\json_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\json_auto_file\shell rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2652 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2652 AcroRd32.exe 2652 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2460 wrote to memory of 2660 2460 cmd.exe 29 PID 2460 wrote to memory of 2660 2460 cmd.exe 29 PID 2460 wrote to memory of 2660 2460 cmd.exe 29 PID 2660 wrote to memory of 2652 2660 rundll32.exe 30 PID 2660 wrote to memory of 2652 2660 rundll32.exe 30 PID 2660 wrote to memory of 2652 2660 rundll32.exe 30 PID 2660 wrote to memory of 2652 2660 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\incognito\bin\api-docs.json1⤵
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\incognito\bin\api-docs.json2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\incognito\bin\api-docs.json"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2652
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5033e1a4c393ba175a19ae32c9757eae1
SHA10bedad21cc8898e50592cf24e6a0a929207bec40
SHA256e16e6ca80168a75bbdcec3d25de75c2280f255498e14b873e47bb83092a11431
SHA51271ac81b845679054b89daad159493ee4c781e0f010cc973d8a6ee495a2c0da68d79793cb8dcf430f5dfadf4017a5f0959eb19a4f08e47fdab6384983d97e51cc