Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
1CMPack_app.jar
windows7-x64
1CMPack_app.jar
windows10-2004-x64
1A.class
windows7-x64
3A.class
windows10-2004-x64
3AA.class
windows7-x64
3AA.class
windows10-2004-x64
3AB.class
windows7-x64
3AB.class
windows10-2004-x64
3AC.class
windows7-x64
3AC.class
windows10-2004-x64
3AD.class
windows7-x64
3AD.class
windows10-2004-x64
3AE.class
windows7-x64
3AE.class
windows10-2004-x64
3AF.class
windows7-x64
3AF.class
windows10-2004-x64
3AG.class
windows7-x64
3AG.class
windows10-2004-x64
3AH.class
windows7-x64
3AH.class
windows10-2004-x64
3AI.class
windows7-x64
3AI.class
windows10-2004-x64
3AJ.class
windows7-x64
3AJ.class
windows10-2004-x64
3AK.class
windows7-x64
3AK.class
windows10-2004-x64
3AL.class
windows7-x64
3AL.class
windows10-2004-x64
3AM.class
windows7-x64
3AM.class
windows10-2004-x64
3AN.class
windows7-x64
3AN.class
windows10-2004-x64
3Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
13/07/2024, 17:49
Static task
static1
Behavioral task
behavioral1
Sample
CMPack_app.jar
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
CMPack_app.jar
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
A.class
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
A.class
Resource
win10v2004-20240704-en
Behavioral task
behavioral5
Sample
AA.class
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
AA.class
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
AB.class
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
AB.class
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
AC.class
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
AC.class
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
AD.class
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
AD.class
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
AE.class
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
AE.class
Resource
win10v2004-20240709-en
Behavioral task
behavioral15
Sample
AF.class
Resource
win7-20240705-en
Behavioral task
behavioral16
Sample
AF.class
Resource
win10v2004-20240709-en
Behavioral task
behavioral17
Sample
AG.class
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
AG.class
Resource
win10v2004-20240709-en
Behavioral task
behavioral19
Sample
AH.class
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
AH.class
Resource
win10v2004-20240709-en
Behavioral task
behavioral21
Sample
AI.class
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
AI.class
Resource
win10v2004-20240709-en
Behavioral task
behavioral23
Sample
AJ.class
Resource
win7-20240704-en
Behavioral task
behavioral24
Sample
AJ.class
Resource
win10v2004-20240709-en
Behavioral task
behavioral25
Sample
AK.class
Resource
win7-20240704-en
Behavioral task
behavioral26
Sample
AK.class
Resource
win10v2004-20240709-en
Behavioral task
behavioral27
Sample
AL.class
Resource
win7-20240708-en
Behavioral task
behavioral28
Sample
AL.class
Resource
win10v2004-20240709-en
Behavioral task
behavioral29
Sample
AM.class
Resource
win7-20240705-en
Behavioral task
behavioral30
Sample
AM.class
Resource
win10v2004-20240709-en
Behavioral task
behavioral31
Sample
AN.class
Resource
win7-20240704-en
Behavioral task
behavioral32
Sample
AN.class
Resource
win10v2004-20240709-en
General
-
Target
A.class
-
Size
666B
-
MD5
db316111c39d37b02f2f45adfda3568b
-
SHA1
ea7c91ba6ae51d0363755bdab7979f9b9c7605bf
-
SHA256
7ec2b85b6d0a9d03942b72933584ef4f3eb1048ea06d8f8edf8c9feda8e0bc0b
-
SHA512
fa8676b0515d71af52b6a2e96fec1337a8e71b63a983395c619f66f32e609af99e661a998d213b8be86af2857713a835ed137aba4db24bc0dc042ddf57ec9772
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\class_auto_file\ rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\.class\ = "class_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\class_auto_file\shell rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\class_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\class_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\.class rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\class_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\class_auto_file\shell\Read\command rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3020 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3020 AcroRd32.exe 3020 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2384 wrote to memory of 2280 2384 cmd.exe 31 PID 2384 wrote to memory of 2280 2384 cmd.exe 31 PID 2384 wrote to memory of 2280 2384 cmd.exe 31 PID 2280 wrote to memory of 3020 2280 rundll32.exe 33 PID 2280 wrote to memory of 3020 2280 rundll32.exe 33 PID 2280 wrote to memory of 3020 2280 rundll32.exe 33 PID 2280 wrote to memory of 3020 2280 rundll32.exe 33
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\A.class1⤵
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\A.class2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\A.class"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3020
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5ee5f36686956739eb0301912d72761fd
SHA11cd64104e1826c90fdf49991aaa06a28e1d37f6f
SHA2562462a5cfe90d290fb64c997de3282d38d83c3127f6bc808048709f31ed8017d9
SHA512c35918dfb78f3fd6b1e93c297660f98901b1044d53675f477d637c3c134f0050f501e949bfa9e492e48a15a46acce7c035cab2f1d46c0211d9fd65bd36b30dd7