Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
08/07/2024, 11:05
240708-m639fsyaph 408/07/2024, 11:00
240708-m359msxhrf 308/07/2024, 10:54
240708-mzmm5avgrj 308/07/2024, 10:49
240708-mw431axfra 708/07/2024, 10:46
240708-mtxwxaxfjc 308/07/2024, 10:42
240708-mrn6zsxekb 7Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
08/07/2024, 10:54
Static task
static1
Behavioral task
behavioral1
Sample
AntivirusDefender8.0-main.zip
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
AntivirusDefender8.0-main/.gitattributes
Resource
win7-20240704-en
Behavioral task
behavioral3
Sample
AntivirusDefender8.0-main/AntivirusDefender8.0.lnk
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
AntivirusDefender8.0-main/LICENSE
Resource
win7-20240705-en
Behavioral task
behavioral5
Sample
AntivirusDefender8.0-main/README.md
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
AntivirusDefender8.0-main/RUNTHISFIRST.exe
Resource
win7-20240705-en
Behavioral task
behavioral7
Sample
AntivirusDefender8.0-main/bootmgfw.dll
Resource
win7-20240221-en
General
-
Target
AntivirusDefender8.0-main/.gitattributes
-
Size
66B
-
MD5
05bdb783ee6514c8c072e47680af8ff7
-
SHA1
ba3dfe345280bdcc5e817bb02cf49b8b8d8e1c4c
-
SHA256
1a1dbe176bc233b499d35a57db7513f2941c99ab9759f177830c9149be99005b
-
SHA512
9e820d6126d62c0b89e380c69685f6668b2f131283f57e524f59492fa6df22844dda1b90d244d4a1f8aea78a84e65d47b1a878168c4e41001459a947ef275ffe
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_Classes\Local Settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\gitattributes_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\.gitattributes rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\.gitattributes\ = "gitattributes_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\gitattributes_auto_file\shell\Read\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\gitattributes_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\gitattributes_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\gitattributes_auto_file\shell rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\gitattributes_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2768 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2768 AcroRd32.exe 2768 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1316 wrote to memory of 2180 1316 cmd.exe 32 PID 1316 wrote to memory of 2180 1316 cmd.exe 32 PID 1316 wrote to memory of 2180 1316 cmd.exe 32 PID 2180 wrote to memory of 2768 2180 rundll32.exe 33 PID 2180 wrote to memory of 2768 2180 rundll32.exe 33 PID 2180 wrote to memory of 2768 2180 rundll32.exe 33 PID 2180 wrote to memory of 2768 2180 rundll32.exe 33
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\AntivirusDefender8.0-main\.gitattributes1⤵
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\AntivirusDefender8.0-main\.gitattributes2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\AntivirusDefender8.0-main\.gitattributes"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2768
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD52596a671829ea92b4cf60d0e3d23afd3
SHA1dd71e89164969e1818540845ada7403ae7c22b41
SHA256bf50699ed67059f16000209d21a8910afeee584061274444128585423590d284
SHA5123cf9643adba43ed5d524908479d18d22bd803d918a75eb0fc0276c7fd6f46ffa59c50801f90ccefad98289f8910ac5c457a3d562257dcb50a9fe28660741ed49