Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
6Static
static
1sample.tar
windows7-x64
3sample.tar
windows10-2004-x64
3.system2/autorun
ubuntu-18.04-amd64
6.system2/autorun
debian-9-armhf
6.system2/autorun
debian-9-mips
6.system2/autorun
debian-9-mipsel
6.system2/bash
ubuntu-18.04-amd64
1.system2/bash
debian-9-armhf
1.system2/bash
debian-9-mips
1.system2/bash
debian-9-mipsel
1.system2/m.vbs
windows7-x64
1.system2/m.vbs
windows10-2004-x64
1.system2/pp3-login
ubuntu-24.04-amd64
.system2/start
ubuntu-18.04-amd64
1.system2/start
debian-9-armhf
1.system2/start
debian-9-mips
1.system2/start
debian-9-mipsel
1.system2/y2kupdate
ubuntu-18.04-amd64
1.system2/y2kupdate
debian-9-armhf
1.system2/y2kupdate
debian-9-mips
1.system2/y2kupdate
debian-9-mipsel
1Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01/07/2024, 07:44
Static task
static1
Behavioral task
behavioral1
Sample
sample.tar
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
sample.tar
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
.system2/autorun
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral4
Sample
.system2/autorun
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral5
Sample
.system2/autorun
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral6
Sample
.system2/autorun
Resource
debian9-mipsel-20240418-en
Behavioral task
behavioral7
Sample
.system2/bash
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral8
Sample
.system2/bash
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral9
Sample
.system2/bash
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral10
Sample
.system2/bash
Resource
debian9-mipsel-20240418-en
Behavioral task
behavioral11
Sample
.system2/m.vbs
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
.system2/m.vbs
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
.system2/pp3-login
Resource
ubuntu2404-amd64-20240523-en
Behavioral task
behavioral14
Sample
.system2/start
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral15
Sample
.system2/start
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral16
Sample
.system2/start
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral17
Sample
.system2/start
Resource
debian9-mipsel-20240611-en
Behavioral task
behavioral18
Sample
.system2/y2kupdate
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral19
Sample
.system2/y2kupdate
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral20
Sample
.system2/y2kupdate
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral21
Sample
.system2/y2kupdate
Resource
debian9-mipsel-20240226-en
General
-
Target
sample.tar
-
Size
660KB
-
MD5
9e0d54812937ab3b2e476dceed1335ab
-
SHA1
b62640370d83967a1336ce5826f51f85bc9bc785
-
SHA256
c5f652cc2be0a1083d4289fd6d010054cc940f0b36e6ccab668577292b18f9c8
-
SHA512
071f6d5d362d28775a86f9879a2cd132ac67e2bee3d4d730ee335014f0dbddf8a106da0793ebec96f236b13005d3e24d294694b3f53d5d975d05ad7a4ed6cf45
-
SSDEEP
12288:Bm+XrvUbW4UHTBwLPQ5CNMhRJiSAtkCSAtki:BTXrMbWhTBwLPQjhRJiSAtkCSAtki
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2596 7zFM.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 2596 7zFM.exe Token: 35 2596 7zFM.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2596 7zFM.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2916 wrote to memory of 2596 2916 cmd.exe 29 PID 2916 wrote to memory of 2596 2916 cmd.exe 29 PID 2916 wrote to memory of 2596 2916 cmd.exe 29
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\sample.tar1⤵
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\sample.tar"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2596
-