Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

26/07/2024, 18:28

240726-w4pgyszeje 7

26/07/2024, 18:14

240726-wvc3kawbml 7

Analysis

  • max time kernel
    147s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/07/2024, 18:28

General

  • Target

    Resource/Font/MyriadPro-Bold.otf

  • Size

    88KB

  • MD5

    e6d1585e6c81e3206948d8548d914fec

  • SHA1

    4bfa4d5ad9995bd89e2d443009e4ffb728a1f74b

  • SHA256

    2d09971801f2c18fc5a825379404113db237866073ab463a9bf0f3da8c62459a

  • SHA512

    058cf93ea2be4e98e752a4090f295e00bad37b7db9d4461cf7484409af5087853653fd82aa7475a85950b48367a1d9168cc8983791b78dabeb8af4f84397a264

  • SSDEEP

    1536:ruMpOn479vZp3MeJymLbVQbZg8Lm52cqU5mJm2Tg9gHsF+JSqyi+GGGCRqBtUwah:CU179vZp3MeJymLbVQbZ3CrqUwJmStEh

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Resource\Font\MyriadPro-Bold.otf
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1708
    • C:\Windows\System32\fontview.exe
      "C:\Windows\System32\fontview.exe" C:\Users\Admin\AppData\Local\Temp\Resource\Font\MyriadPro-Bold.otf
      2⤵
        PID:3152

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads