Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

02/08/2024, 15:24

240802-ss5g9azarq 1

02/08/2024, 15:20

240802-sq7vlazakn 4

02/08/2024, 15:19

240802-sp5nvatglh 1

Analysis

  • max time kernel
    120s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    02/08/2024, 15:20

General

  • Target

    shaderFile_2/shaderFile_R.placebo

  • Size

    122B

  • MD5

    4cb5baf13b4edeb98fbcb86939b5f6de

  • SHA1

    b5c53ec667e4e4c5ceae3d78b2da97ed3a547884

  • SHA256

    d6a249c4b0aeaed80079877cb6ddc87bba112d6528d84a59504075d59be5a03e

  • SHA512

    27de62cfb15c390d02ef87371c0c5b34b6207923380f558589d0c76d6886adf7cb7c4119617a8c2e710b6b26fbd6b2a048adcddf34cea469db4be576b95a884e

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\shaderFile_2\shaderFile_R.placebo
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3000
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\shaderFile_2\shaderFile_R.placebo
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2700
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\shaderFile_2\shaderFile_R.placebo"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2764

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    1966867cd654f9282b52eae8fb5049d8

    SHA1

    f9ab591081c48e97246e891c4ad54f710afa4f5c

    SHA256

    37c0ccbe88448a56285fb62e6ffb693ba70464bf22e70f2a6e0398d7e98866e0

    SHA512

    3da66c4f822e378f65041769d089fab283f7651f1194afdd7cd30b3b45cf156cc147200f66fc5732d5ee98e2e5b88cc7afbf01055c9f56e2adc478879b14f43e