Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
9Static
static
3New folder (10).rar
windows7-x64
3New folder (10).rar
windows10-2004-x64
3New folder...ic.exe
windows7-x64
3New folder...ic.exe
windows10-2004-x64
3New folder...lo.lua
windows7-x64
3New folder...lo.lua
windows10-2004-x64
3New folder...ec.lnk
windows7-x64
3New folder...ec.lnk
windows10-2004-x64
3New folder...ce.lnk
windows7-x64
3New folder...ce.lnk
windows10-2004-x64
3New folder...LL.dll
windows7-x64
9New folder...LL.dll
windows10-2004-x64
9New folder...ic.xml
windows7-x64
1New folder...ic.xml
windows10-2004-x64
1New folder...er.txt
windows7-x64
1New folder...er.txt
windows10-2004-x64
1Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
24/06/2024, 20:50
Static task
static1
Behavioral task
behavioral1
Sample
New folder (10).rar
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
New folder (10).rar
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
New folder (10)/Artic.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
New folder (10)/Artic.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
New folder (10)/Scripts/Hello.lua
Resource
win7-20240611-en
Behavioral task
behavioral6
Sample
New folder (10)/Scripts/Hello.lua
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
New folder (10)/autoexec.lnk
Resource
win7-20240611-en
Behavioral task
behavioral8
Sample
New folder (10)/autoexec.lnk
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
New folder (10)/aworkspace.lnk
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
New folder (10)/aworkspace.lnk
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
New folder (10)/bin/ArticDLL.dll
Resource
win7-20240419-en
Behavioral task
behavioral12
Sample
New folder (10)/bin/ArticDLL.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
New folder (10)/bin/artic.xml
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
New folder (10)/bin/artic.xml
Resource
win10v2004-20240611-en
Behavioral task
behavioral15
Sample
New folder (10)/bin/ver.txt
Resource
win7-20231129-en
Behavioral task
behavioral16
Sample
New folder (10)/bin/ver.txt
Resource
win10v2004-20240508-en
General
-
Target
New folder (10).rar
-
Size
17.3MB
-
MD5
872c9174dabf3112a401d0f5aaf9f5d4
-
SHA1
de00d1c13085fdb50626324e28787695c13e196b
-
SHA256
141607cb1599b9798567420990f586708ea2a3b12ebf5c3de43ae088fbbec870
-
SHA512
8999b5f50d0539c574fbd5ae8d7c9a517e05d6cc748cef17e10c7f081303266fc958a6327d81db7d870847d1ca8ce6d26f8fa36552fac7d6ffaadbe749dbc1bb
-
SSDEEP
393216:ZiZdHPjZoBiNZJD0bH6ZlVD4zV+/56aR+aR:ZiZdvjCBQZJDPN4zVmRR
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2676 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2676 vlc.exe -
Suspicious use of FindShellTrayWindow 9 IoCs
pid Process 2676 vlc.exe 2676 vlc.exe 2676 vlc.exe 2676 vlc.exe 2676 vlc.exe 2676 vlc.exe 2676 vlc.exe 2676 vlc.exe 2676 vlc.exe -
Suspicious use of SendNotifyMessage 8 IoCs
pid Process 2676 vlc.exe 2676 vlc.exe 2676 vlc.exe 2676 vlc.exe 2676 vlc.exe 2676 vlc.exe 2676 vlc.exe 2676 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2676 vlc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2220 wrote to memory of 2320 2220 cmd.exe 29 PID 2220 wrote to memory of 2320 2220 cmd.exe 29 PID 2220 wrote to memory of 2320 2220 cmd.exe 29 PID 2320 wrote to memory of 2676 2320 rundll32.exe 30 PID 2320 wrote to memory of 2676 2320 rundll32.exe 30 PID 2320 wrote to memory of 2676 2320 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\New folder (10).rar"1⤵
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\New folder (10).rar2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\New folder (10).rar"3⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2676
-
-