Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

3

Static

static

1

certified.pcapng

windows7-x64

3

certified.pcapng

windows10-2004-x64

3

Analysis

  • max time kernel
    209s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    08/06/2024, 21:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    certified.pcapng

  • Size

    11KB

  • MD5

    37fce3477ec63c8af02b8e1e26c6c598

  • SHA1

    56af653a104d871f5c41fd3c1b3983aa01959de8

  • SHA256

    05e5a9a06f36aa144661c7294a1fe37c47980802e397d94ea475251fdcba4916

  • SHA512

    1f8864aff4100113fa7ba3bbf85b7ac5167602c555a95ee962c49f5dc03055a23d7c93a7ab1436f7465cbec7ebe3461e5bf18595f492d64301023a9c954a082a

  • SSDEEP

    192:3rdRxB7I7WzVPWjI1Rcf+JnatUhBdcDiwNXglz8lJBSxn9RfF2sA5z6JSk8M:3rfv7I7WQjI1RC+kmpsdIz8luX3Z9

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\certified.pcapng
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1704
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\certified.pcapng
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2732
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\certified.pcapng"
        3⤵
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2664
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
    1⤵
      PID:592
    • C:\Windows\SysWOW64\DllHost.exe
      C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
      1⤵
        PID:376

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
        Filesize

        3KB

        MD5

        1ac52f1717d4ee7dd20f6ff9d23ea0e4

        SHA1

        144ccb011c83262f21d484f41e22bea69a991c22

        SHA256

        5c1ffd7d4d60e3ea18401476a587a90b0e41f869ae283f74bdd154d8db6902d5

        SHA512

        3321edec0627233bda9a1d81f9ea83b1a584ddc9a726a1d5fe9d521742670706c30a57e914197b6327243d5cb53a7607454cc50388ced502fd6b35961cf83dbe

        Download Submit

      • memory/2664-41-0x0000000000C40000-0x0000000000C42000-memory.dmp

        Filesize

        8KB

        Download