Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    29/06/2024, 15:49 UTC

General

  • Target

    scph39001.nvm

  • Size

    1024B

  • MD5

    0639a9ff5f5f3fd7833b924b9d97a8ae

  • SHA1

    219647cab29e4f702c36ec08d183404161c26265

  • SHA256

    20ea5a0b33828c8312034e1436e4e3d6d5635866feeadabc742cab512aeba5dc

  • SHA512

    7dc886ba5362dab044c682712414058f195847ed87ed1ed61387f98c65758f36e6a043f9de1a73c19f5ac197b821684a88dafdcfbc9ec491179efa8f0e9213ac

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\scph39001.nvm
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1992
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\scph39001.nvm
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1640
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\scph39001.nvm"
        3⤵
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2656

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    f737d4ea538770c93fdab5d4b6bd84b9

    SHA1

    e9ed1a7b6c696f39782f32c26a23515faa6fc347

    SHA256

    bac98964722c79d94d2c8d2886e4a7e33ba645687214add17c56d7206013a619

    SHA512

    24472f087d842743adad5d05289ff910593fb423d383a36c59fa309b3dcb30b5dbacd37f0919088fbc971471272e24e8aee48a824e69e30c0f5bdb0ed2d61a98

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.