Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
1CMPack_app.jar
windows7-x64
1CMPack_app.jar
windows10-2004-x64
1A.class
windows7-x64
3A.class
windows10-2004-x64
3AA.class
windows7-x64
3AA.class
windows10-2004-x64
3AB.class
windows7-x64
3AB.class
windows10-2004-x64
3AC.class
windows7-x64
3AC.class
windows10-2004-x64
3AD.class
windows7-x64
3AD.class
windows10-2004-x64
3AE.class
windows7-x64
3AE.class
windows10-2004-x64
3AF.class
windows7-x64
3AF.class
windows10-2004-x64
3AG.class
windows7-x64
3AG.class
windows10-2004-x64
3AH.class
windows7-x64
3AH.class
windows10-2004-x64
3AI.class
windows7-x64
3AI.class
windows10-2004-x64
3AJ.class
windows7-x64
3AJ.class
windows10-2004-x64
3AK.class
windows7-x64
3AK.class
windows10-2004-x64
3AL.class
windows7-x64
3AL.class
windows10-2004-x64
3AM.class
windows7-x64
3AM.class
windows10-2004-x64
3AN.class
windows7-x64
3AN.class
windows10-2004-x64
3Analysis
-
max time kernel
102s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
13/07/2024, 17:49
Static task
static1
Behavioral task
behavioral1
Sample
CMPack_app.jar
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
CMPack_app.jar
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
A.class
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
A.class
Resource
win10v2004-20240704-en
Behavioral task
behavioral5
Sample
AA.class
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
AA.class
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
AB.class
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
AB.class
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
AC.class
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
AC.class
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
AD.class
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
AD.class
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
AE.class
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
AE.class
Resource
win10v2004-20240709-en
Behavioral task
behavioral15
Sample
AF.class
Resource
win7-20240705-en
Behavioral task
behavioral16
Sample
AF.class
Resource
win10v2004-20240709-en
Behavioral task
behavioral17
Sample
AG.class
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
AG.class
Resource
win10v2004-20240709-en
Behavioral task
behavioral19
Sample
AH.class
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
AH.class
Resource
win10v2004-20240709-en
Behavioral task
behavioral21
Sample
AI.class
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
AI.class
Resource
win10v2004-20240709-en
Behavioral task
behavioral23
Sample
AJ.class
Resource
win7-20240704-en
Behavioral task
behavioral24
Sample
AJ.class
Resource
win10v2004-20240709-en
Behavioral task
behavioral25
Sample
AK.class
Resource
win7-20240704-en
Behavioral task
behavioral26
Sample
AK.class
Resource
win10v2004-20240709-en
Behavioral task
behavioral27
Sample
AL.class
Resource
win7-20240708-en
Behavioral task
behavioral28
Sample
AL.class
Resource
win10v2004-20240709-en
Behavioral task
behavioral29
Sample
AM.class
Resource
win7-20240705-en
Behavioral task
behavioral30
Sample
AM.class
Resource
win10v2004-20240709-en
Behavioral task
behavioral31
Sample
AN.class
Resource
win7-20240704-en
Behavioral task
behavioral32
Sample
AN.class
Resource
win10v2004-20240709-en
General
-
Target
AA.class
-
Size
2KB
-
MD5
1fbf18be86e21ff3f0512ce306d582c4
-
SHA1
a7be573abe48068d7d8e1b00f2d4a9414b7949d4
-
SHA256
8a362eb0e640142626968e0b52c4a72e2d362197ee8a32e3e85db0d9f9ff9c13
-
SHA512
f131e24d333acabea8539a650a3981766eac56891cf0114c87b81c508541f653f8509877e018ad436e46897acb401c5395a6fdc4725c77e79fc91736cba3d8a3
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000_CLASSES\class_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000_CLASSES\class_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000_CLASSES\class_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000_CLASSES\class_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000_CLASSES\class_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000_CLASSES\class_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000_CLASSES\.class rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000_CLASSES\.class\ = "class_auto_file" rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3000 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3000 AcroRd32.exe 3000 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3068 wrote to memory of 2848 3068 cmd.exe 30 PID 3068 wrote to memory of 2848 3068 cmd.exe 30 PID 3068 wrote to memory of 2848 3068 cmd.exe 30 PID 2848 wrote to memory of 3000 2848 rundll32.exe 31 PID 2848 wrote to memory of 3000 2848 rundll32.exe 31 PID 2848 wrote to memory of 3000 2848 rundll32.exe 31 PID 2848 wrote to memory of 3000 2848 rundll32.exe 31
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\AA.class1⤵
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\AA.class2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\AA.class"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3000
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD52b8c5607bb38ed6673ae0c2f771abed3
SHA10116a9a062d66d7e582e798e0ff148131d9c15fc
SHA2569085c210df4a6b69a291a063a71e855fecdb51abacd05289adf35c6074de5721
SHA512094777ff846324b52c4fde92f062521dd1fb504f9f5a03d44e5d26a29febeffa20d60840c11b8307279150c4866b4e8ba51742dda936a5e8bea5242ce0761af1