Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

31/05/2024, 21:40

240531-1h99rafc28 8

31/05/2024, 18:30

240531-w5jcbshf38 8

31/05/2024, 18:28

240531-w4vc7she97 3

31/05/2024, 18:26

240531-w3l1fagf5s 8

Analysis

  • max time kernel
    9s
  • max time network
    6s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240508-en
  • resource tags

    arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    31/05/2024, 18:28

General

  • Target

    2-_.rar

  • Size

    36.4MB

  • MD5

    0ee8c85e4c5a457a871b2697b809ccd6

  • SHA1

    011a0af98acc9e6a9de0b1644182b75c242bfd6a

  • SHA256

    eec3a450c88d7aceb20da1ff81630484c81c5ffc025429803f61bcb1ca45a25f

  • SHA512

    2092a22894792090a5106b7e3ef047147c82168b415c6f242d29ea4600614bcfd573de7d9d6c59ece1645a58b37d2b29f6fbb1baf58af9be463b92348a34232b

  • SSDEEP

    786432:qxSCONH0hb3zSPZ7YWM6FX2xTzhlq9Avef5cUjmNZF0vaVs3JFaw83:qxSHJGb3z07+8IzhNnUjmDU7+wa

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 38 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 18 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\2-_.rar
    1⤵
    • Modifies registry class
    PID:4328
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    PID:4224

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

    Filesize

    14KB

    MD5

    2a1905826039858b1039c3453f3cef1e

    SHA1

    ae911618f6bf7e153d3fe84ce85e04a7f846cf31

    SHA256

    8414d04b5b1778e199ef04d5a6e64c13c6831fecc925b3f23399a7fe3bda9a17

    SHA512

    11eb1e22df0093d19d506adea2e5bc47e0a552cf532acd0e83d5a4d9ac6002c524609e1043ce67443d24387c976bf8c6c372bbedc4d7d14a357b048d806c312e