Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
16/07/2024, 08:17
General
-
Target
0pen___files/!ŞetUp_42716--#PaSꞨKḙy#$$.rar
-
Size
2.4MB
-
MD5
a1a5d1c60cdd1b89a92400babbc3c2b3
-
SHA1
656eab017cdb623387d2c01b5c6457eca811a2dc
-
SHA256
37d371f1d3d4ae1b4d9bb02bc69b1b45ffb73ce51b9fb6effee6b48d1495bf47
-
SHA512
632f138abf42422b76097758561f82d70e3a69f7e3ab57453f39c4225e6383fa4133e3448a7d6b4ad384a56307390ebfa7014bb1a5ebe2127642136ea5a8c8c8
-
SSDEEP
49152:0RZ9GxmJyIkm2X/m5vxEOBoi5Ov7v6ZbSJUYor9:0R2xy0LX/a4io7vmbSJUYop
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of FindShellTrayWindow 9 IoCs
-
Suspicious use of SendNotifyMessage 8 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\0pen___files\!ŞetUp_42716--#PaSꞨKḙy#$$.rar1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\0pen___files\!ŞetUp_42716--#PaSꞨKḙy#$$.rar2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\0pen___files\!ŞetUp_42716--#PaSꞨKḙy#$$.rar3⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\0pen___files\!ŞetUp_42716--#PaSꞨKḙy#$$.rar"4⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
208KB
-
Filesize
992KB
-
Filesize
68KB
-
Filesize
92KB
-
Filesize
96KB
-
Filesize
2.7MB
-
Filesize
68KB
-
Filesize
92KB
-
Filesize
116KB
-
Filesize
68KB
-
Filesize
96KB
-
Filesize
192KB
-
Filesize
68KB
-
Filesize
108KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
96KB
-
Filesize
132KB
-
Filesize
2.0MB
-
Filesize
260KB
-
Filesize
412KB
-
Filesize
188KB
-
Filesize
88KB
-
Filesize
68KB
-
Filesize
64KB
-
Filesize
92KB
-
Filesize
68KB
-
Filesize
132KB
-
Filesize
76KB
-
Filesize
132KB
-
Filesize
72KB
-
Filesize
68KB
-
Filesize
140KB
-
Filesize
96KB
-
Filesize
144KB
-
Filesize
160KB
-
Filesize
348KB
-
Filesize
68KB
-
Filesize
496KB
-
Filesize
788KB
-
Filesize
264KB
-
Filesize
436KB
-
Filesize
16.7MB
-
Filesize
392KB
-
Filesize
1.5MB