Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

6

Static

static

1

accesibili...bc.png

windows11-21h2-x64

accesibili...bc.png

macos-10.15-amd64

4

accesibili...bc.png

ubuntu-24.04-amd64

Resubmissions

22/07/2024, 19:36

240722-yblayathqf 6

22/07/2024, 19:33

240722-x9gjzatgnd 4

22/07/2024, 19:29

240722-x7n62atfpf 6

Analysis

  • max time kernel
    101s
  • max time network
    123s
  • platform
    macos-10.15_amd64
  • resource
    macos-20240711.1-en
  • resource tags

    arch:amd64arch:i386image:macos-20240711.1-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    22/07/2024, 19:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    accesibility_window_abc.png

  • Size

    457B

  • MD5

    bea6c589482c2d3823e16178a9e3eb64

  • SHA1

    e19805c08e403f06b7579626fcb6e34166dc9d5d

  • SHA256

    6c499a4af1f9348ab6ffdcf49eabb0999f2d60976cca109cb4812747c5b7e1db

  • SHA512

    892fb6079d12a8b86872ffcdb2dc309993400ec82e99eac275e1e1ae1a402bfdfaf39fb171dafcd0d4579d020d55208281392eb186d02d897b73fe5a22182489

Score
4/10
evasion

Malware Config

Signatures

  • Resource Forking 1 TTPs 2 IoCs

    Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

    evasion

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"/Users/run/accesibility_window_abc.png\""
    1⤵
      PID:485
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"/Users/run/accesibility_window_abc.png\""
      1⤵
        PID:485
      • /usr/bin/sudo
        sudo /bin/zsh -c /Users/run/accesibility_window_abc.png
        1⤵
          PID:485
          • /bin/zsh
            /bin/zsh -c /Users/run/accesibility_window_abc.png
            2⤵
              PID:487
            • /Users/run/accesibility_window_abc.png
              /Users/run/accesibility_window_abc.png
              2⤵
                PID:487
            • /System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged
              "/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged"
              1⤵
                PID:471
              • /System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
                /System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
                1⤵
                  PID:473
                • /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater
                  "/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck
                  1⤵
                    PID:476
                  • /usr/libexec/pkreporter
                    /usr/libexec/pkreporter
                    1⤵
                      PID:474
                    • /System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
                      /System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
                      1⤵
                        PID:475

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads