Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    29/06/2024, 15:49

General

  • Target

    SCPH-70004_BIOS_V12_PAL_200.erom

  • Size

    3.0MB

  • MD5

    9feb1fdeadd6232a13b95e60b34ccef9

  • SHA1

    ec0121bb8e2a209044309780d2efc2559c9a0ef1

  • SHA256

    e5bcd5925c1f22de48d49c3895dd421d167faddc033aac628f5facfba90ceef3

  • SHA512

    fa80cf49166165bc016f53da894dc62c2c9362cbeeb08b1b8546f1f49a9d207beb04cb8ec711be9191b11b563ca963f357e36792edd9a767aabf7418e9e07ea4

  • SSDEEP

    49152:pdAqdAivUd7r3JgqK3m1R+DXNotHFTuMvFgwLcgSGouxwKSXaDZ3PFu:g5MkLJgroohotHFTTrcgSGUXstg

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\SCPH-70004_BIOS_V12_PAL_200.erom
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2084
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\SCPH-70004_BIOS_V12_PAL_200.erom
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2644
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\SCPH-70004_BIOS_V12_PAL_200.erom"
        3⤵
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2672

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    530a668a0128056ee639838a62353386

    SHA1

    6d9f607f284baa3dd9d14e75398318fa4e0c4155

    SHA256

    ab07a251150e7eb9a9bf82b9ef6367ae8d792849e9f57297a053a719d21a0692

    SHA512

    fad87c5e65f56edeebc593479b2b8c5aac574fb5f2d7a60b8a07da6f96f23f1a6d3a1dfd2fe6269d398a74adc7f9eb0f11e5f32eb9b7f10eb08f3f53e98cad6b