Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    33s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    12/07/2024, 15:05

General

  • Target

    MonoExploits.rar

  • Size

    3.5MB

  • MD5

    4c79075828659d435ff39f5fab8650f2

  • SHA1

    180533fec18abc14d511c29e18e0a01b9edada8d

  • SHA256

    c963cb5adb198fbdaebb940f816d135596264d03de0be61de00d0bd1cb204c93

  • SHA512

    b4276cc021652506684666fb722863decdc63384b10a47b14548d6c23ca4d41aa32684213cf40df80d05c1a8b314f2bb0ae27bd95a334571ccafb95012b567ff

  • SSDEEP

    49152:62REXJ0rh+eGIAcCoo5Lky/4obUVBrGuGkz5vZUCovWmNspylEt5JBATqfq/MXGL:HRgJg+eGcgYzVz5h3sNVmnATSq/MXW

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 9 IoCs
  • Suspicious use of SendNotifyMessage 8 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\MonoExploits.rar
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2492
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\MonoExploits.rar
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2284
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\MonoExploits.rar
        3⤵
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:2716
        • C:\Program Files\VideoLAN\VLC\vlc.exe
          "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\MonoExploits.rar"
          4⤵
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:2632

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2632-30-0x000007FEF7020000-0x000007FEF7054000-memory.dmp

    Filesize

    208KB

  • memory/2632-29-0x000000013F9E0000-0x000000013FAD8000-memory.dmp

    Filesize

    992KB

  • memory/2632-32-0x000007FEF74E0000-0x000007FEF74F8000-memory.dmp

    Filesize

    96KB

  • memory/2632-34-0x000007FEF6FC0000-0x000007FEF6FD1000-memory.dmp

    Filesize

    68KB

  • memory/2632-33-0x000007FEF7000000-0x000007FEF7017000-memory.dmp

    Filesize

    92KB

  • memory/2632-35-0x000007FEF6AA0000-0x000007FEF6AB7000-memory.dmp

    Filesize

    92KB

  • memory/2632-36-0x000007FEF6A80000-0x000007FEF6A91000-memory.dmp

    Filesize

    68KB

  • memory/2632-37-0x000007FEF6A60000-0x000007FEF6A7D000-memory.dmp

    Filesize

    116KB

  • memory/2632-38-0x000007FEF6A40000-0x000007FEF6A51000-memory.dmp

    Filesize

    68KB

  • memory/2632-31-0x000007FEF5D90000-0x000007FEF6046000-memory.dmp

    Filesize

    2.7MB

  • memory/2632-39-0x000007FEF5960000-0x000007FEF5B6B000-memory.dmp

    Filesize

    2.0MB

  • memory/2632-42-0x000007FEF6400000-0x000007FEF6421000-memory.dmp

    Filesize

    132KB

  • memory/2632-43-0x000007FEF69D0000-0x000007FEF69E8000-memory.dmp

    Filesize

    96KB

  • memory/2632-44-0x000007FEF63E0000-0x000007FEF63F1000-memory.dmp

    Filesize

    68KB

  • memory/2632-45-0x000007FEF63C0000-0x000007FEF63D1000-memory.dmp

    Filesize

    68KB

  • memory/2632-41-0x000007FEF69F0000-0x000007FEF6A31000-memory.dmp

    Filesize

    260KB

  • memory/2632-46-0x000007FEF5940000-0x000007FEF5951000-memory.dmp

    Filesize

    68KB

  • memory/2632-47-0x000007FEF5920000-0x000007FEF593B000-memory.dmp

    Filesize

    108KB

  • memory/2632-48-0x000007FEF5900000-0x000007FEF5911000-memory.dmp

    Filesize

    68KB

  • memory/2632-49-0x000007FEF58E0000-0x000007FEF58F8000-memory.dmp

    Filesize

    96KB

  • memory/2632-51-0x000007FEF5840000-0x000007FEF58A7000-memory.dmp

    Filesize

    412KB

  • memory/2632-53-0x000007FEF57A0000-0x000007FEF57B1000-memory.dmp

    Filesize

    68KB

  • memory/2632-57-0x000007FEF56C0000-0x000007FEF56D8000-memory.dmp

    Filesize

    96KB

  • memory/2632-56-0x000007FEF56E0000-0x000007FEF5704000-memory.dmp

    Filesize

    144KB

  • memory/2632-58-0x000007FEF5690000-0x000007FEF56B3000-memory.dmp

    Filesize

    140KB

  • memory/2632-55-0x000007FEF5710000-0x000007FEF5738000-memory.dmp

    Filesize

    160KB

  • memory/2632-59-0x000007FEF5670000-0x000007FEF5681000-memory.dmp

    Filesize

    68KB

  • memory/2632-54-0x000007FEF5740000-0x000007FEF5797000-memory.dmp

    Filesize

    348KB

  • memory/2632-60-0x000007FEF5650000-0x000007FEF5662000-memory.dmp

    Filesize

    72KB

  • memory/2632-52-0x000007FEF57C0000-0x000007FEF583C000-memory.dmp

    Filesize

    496KB

  • memory/2632-50-0x000007FEF58B0000-0x000007FEF58E0000-memory.dmp

    Filesize

    192KB

  • memory/2632-62-0x000007FEF6B70000-0x000007FEF6B87000-memory.dmp

    Filesize

    92KB

  • memory/2632-61-0x000007FEF1BB0000-0x000007FEF1D30000-memory.dmp

    Filesize

    1.5MB

  • memory/2632-40-0x000007FEF41A0000-0x000007FEF5250000-memory.dmp

    Filesize

    16.7MB

  • memory/2632-77-0x000007FEF5D90000-0x000007FEF6046000-memory.dmp

    Filesize

    2.7MB

  • memory/2632-76-0x000007FEF7020000-0x000007FEF7054000-memory.dmp

    Filesize

    208KB

  • memory/2632-75-0x000000013F9E0000-0x000000013FAD8000-memory.dmp

    Filesize

    992KB

  • memory/2632-78-0x000007FEF41A0000-0x000007FEF5250000-memory.dmp

    Filesize

    16.7MB