Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
08/07/2024, 11:05
240708-m639fsyaph 408/07/2024, 11:00
240708-m359msxhrf 308/07/2024, 10:54
240708-mzmm5avgrj 308/07/2024, 10:49
240708-mw431axfra 708/07/2024, 10:46
240708-mtxwxaxfjc 308/07/2024, 10:42
240708-mrn6zsxekb 7Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
08/07/2024, 10:54
Static task
static1
Behavioral task
behavioral1
Sample
AntivirusDefender8.0-main.zip
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
AntivirusDefender8.0-main/.gitattributes
Resource
win7-20240704-en
Behavioral task
behavioral3
Sample
AntivirusDefender8.0-main/AntivirusDefender8.0.lnk
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
AntivirusDefender8.0-main/LICENSE
Resource
win7-20240705-en
Behavioral task
behavioral5
Sample
AntivirusDefender8.0-main/README.md
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
AntivirusDefender8.0-main/RUNTHISFIRST.exe
Resource
win7-20240705-en
Behavioral task
behavioral7
Sample
AntivirusDefender8.0-main/bootmgfw.dll
Resource
win7-20240221-en
General
-
Target
AntivirusDefender8.0-main/README.md
-
Size
75B
-
MD5
1ef2449c0655d9c8f7335d5f4e18a1f0
-
SHA1
be20ac57040d58c08125f5268286af8cc031f30e
-
SHA256
64565cbcfba9ae621d79b758bc2b6bb737a000cdb8d36aaa716d6b24c6b4e1e9
-
SHA512
ad4b7fa705d3dbefee5a5ab004eeb172b2248290d6a6cd06443ebe9536cbb6d51d3eb6955edb81f04f8aa96f2c252a3626e555c860f9edaa85c1f72916096ad0
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\md_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\.md rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\md_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\md_auto_file\shell rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\md_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\md_auto_file\ rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\.md\ = "md_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\md_auto_file\shell\Read\command rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2640 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2640 AcroRd32.exe 2640 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2244 wrote to memory of 2624 2244 cmd.exe 29 PID 2244 wrote to memory of 2624 2244 cmd.exe 29 PID 2244 wrote to memory of 2624 2244 cmd.exe 29 PID 2624 wrote to memory of 2640 2624 rundll32.exe 30 PID 2624 wrote to memory of 2640 2624 rundll32.exe 30 PID 2624 wrote to memory of 2640 2624 rundll32.exe 30 PID 2624 wrote to memory of 2640 2624 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\AntivirusDefender8.0-main\README.md1⤵
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\AntivirusDefender8.0-main\README.md2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\AntivirusDefender8.0-main\README.md"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2640
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD57d0c8d3f56b9df7cbb9cd556ce422a68
SHA12916e4164bf6388c453f73a00f7e4fd1ff4490fc
SHA25685ed70864ae9b380d2ba972ea2e0cf1383365b4a0ad30156ce7bda9967a71f75
SHA512b17532108bfd17121162d584ef1bccbe4ef3e5bed3c29cc2252cff47f9eee2ed5a4332f29b87dfd0131631aa2ec2242d4a859f940ed0a32c034ee66551070e13