Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
32s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
30/06/2024, 03:40
Static task
static1
Behavioral task
behavioral1
Sample
happy_tree_friends_spin_fun.jad
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
happy_tree_friends_spin_fun.jad
Resource
win10v2004-20240226-en
General
-
Target
happy_tree_friends_spin_fun.jad
-
Size
152KB
-
MD5
95dc1bc04d5311e9ba573ffc01cdd82a
-
SHA1
79c1a77b99ae13a6a1bd6b9dfa9a3b298b0a7874
-
SHA256
b519d36d08b5ab87eb48132039fbc08f18a2f778e893b1b995fa971ce8e18556
-
SHA512
63f21f09a3d44c868c0d286ac1f322258f72016946686facca0d08c26d77e501939fff5fb353df89df91d0e06ab69148ee23a2fc96d1153e31b0e6dab2758bc2
-
SSDEEP
3072:69XYhvkvuw1C2SPaR6VxsWon6cQYCcN0ckJ9rO7:HhvQuAuaRifon69ONkr4
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2648 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2248 wrote to memory of 2648 2248 cmd.exe 29 PID 2248 wrote to memory of 2648 2248 cmd.exe 29 PID 2248 wrote to memory of 2648 2248 cmd.exe 29
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\happy_tree_friends_spin_fun.jad1⤵
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\happy_tree_friends_spin_fun.jad2⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:2648
-