Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    3s
  • max time network
    6s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    20/07/2024, 09:25

General

  • Target

    Frozen Throne.exe

  • Size

    268KB

  • MD5

    04c8c103335f0078444f806632a2c4df

  • SHA1

    1d3482c28b4961c076afd74f26685bd3c9e09e21

  • SHA256

    8660d16d6ae68968058ce8497d66b06e6c81b9d18cdb19fb58f2d293306177e6

  • SHA512

    e2b9539637eee172e750b7f4deb0fab3fe32be8e73d659b6dd39a8710e788c63483c1f44ae6668f668de7b9f8141481598c4312de9c743f56b9986831abef388

  • SSDEEP

    3072:mudeSdA/Snmk8cDdOjO5OKUw7V89wmnfLSUkYhk9s42TqbVKuh+DEOXpq0q3/5ZV:rdeSdYSR3UzRnfLSokPvVADEO8TB

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 3 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Frozen Throne.exe
    "C:\Users\Admin\AppData\Local\Temp\Frozen Throne.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1676
    • C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\system32\rundll32.exe C:\Windows\system32\gameux.dll,GameUXShim {63dc63d0-97d3-4590-9ed7-3a682fc118df};C:\Users\Admin\AppData\Local\Temp\Frozen Throne.exe;1676
      2⤵
      • Blocklisted process makes network request
      • Modifies registry class
      PID:2136

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads