Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    02/08/2024, 17:36

General

  • Target

    savedgames.rar

  • Size

    20KB

  • MD5

    d36f61fcd95093280c288c1a10b62350

  • SHA1

    1717433426b9ffb3402aec0cc0903a4e56e54fd3

  • SHA256

    666a9baf3d576af52dd63cc3c7ea506234f8b2554d0792eeb03b98282b6bc70c

  • SHA512

    415c0a3a99b2dfb289a62f00585f2b08b76e3c4ba7a626160247ca80a8d23f6aa7dcbb62aadea64828984fd944a22ef275cacedf30b0cdc781c33b29e5fd785e

  • SSDEEP

    384:0r6GqrEPE9WXaNEA/QLiHnP8TPXc2BrmeZjVKUBxdH1LpnC3Rg/NwN5tfkrbt3dO:glqN9WKNEaQLenPjErLxKOxzLpC3Rg/U

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\savedgames.rar
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2016
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\savedgames.rar
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1436
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\savedgames.rar
        3⤵
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:2160
        • C:\Program Files\VideoLAN\VLC\vlc.exe
          "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\savedgames.rar"
          4⤵
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:2352

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2352-30-0x000007FEFB550000-0x000007FEFB584000-memory.dmp

    Filesize

    208KB

  • memory/2352-29-0x000000013FD60000-0x000000013FE58000-memory.dmp

    Filesize

    992KB

  • memory/2352-32-0x000007FEFB1E0000-0x000007FEFB1F8000-memory.dmp

    Filesize

    96KB

  • memory/2352-38-0x000007FEF7E60000-0x000007FEF7E71000-memory.dmp

    Filesize

    68KB

  • memory/2352-37-0x000007FEF7E80000-0x000007FEF7E9D000-memory.dmp

    Filesize

    116KB

  • memory/2352-36-0x000007FEF8110000-0x000007FEF8121000-memory.dmp

    Filesize

    68KB

  • memory/2352-35-0x000007FEFB180000-0x000007FEFB197000-memory.dmp

    Filesize

    92KB

  • memory/2352-34-0x000007FEFB1A0000-0x000007FEFB1B1000-memory.dmp

    Filesize

    68KB

  • memory/2352-33-0x000007FEFB1C0000-0x000007FEFB1D7000-memory.dmp

    Filesize

    92KB

  • memory/2352-31-0x000007FEF6970000-0x000007FEF6C26000-memory.dmp

    Filesize

    2.7MB

  • memory/2352-39-0x000007FEF6630000-0x000007FEF683B000-memory.dmp

    Filesize

    2.0MB

  • memory/2352-43-0x000007FEF72F0000-0x000007FEF7308000-memory.dmp

    Filesize

    96KB

  • memory/2352-51-0x000007FEF6510000-0x000007FEF6577000-memory.dmp

    Filesize

    412KB

  • memory/2352-60-0x000007FEF6320000-0x000007FEF6332000-memory.dmp

    Filesize

    72KB

  • memory/2352-62-0x000007FEF2610000-0x000007FEF2627000-memory.dmp

    Filesize

    92KB

  • memory/2352-61-0x000007FEF2630000-0x000007FEF27B0000-memory.dmp

    Filesize

    1.5MB

  • memory/2352-59-0x000007FEF6340000-0x000007FEF6351000-memory.dmp

    Filesize

    68KB

  • memory/2352-58-0x000007FEF6360000-0x000007FEF6383000-memory.dmp

    Filesize

    140KB

  • memory/2352-56-0x000007FEF63B0000-0x000007FEF63D4000-memory.dmp

    Filesize

    144KB

  • memory/2352-54-0x000007FEF6410000-0x000007FEF6467000-memory.dmp

    Filesize

    348KB

  • memory/2352-57-0x000007FEF6390000-0x000007FEF63A8000-memory.dmp

    Filesize

    96KB

  • memory/2352-55-0x000007FEF63E0000-0x000007FEF6408000-memory.dmp

    Filesize

    160KB

  • memory/2352-53-0x000007FEF6470000-0x000007FEF6481000-memory.dmp

    Filesize

    68KB

  • memory/2352-52-0x000007FEF6490000-0x000007FEF650C000-memory.dmp

    Filesize

    496KB

  • memory/2352-50-0x000007FEF6580000-0x000007FEF65B0000-memory.dmp

    Filesize

    192KB

  • memory/2352-49-0x000007FEF65B0000-0x000007FEF65C8000-memory.dmp

    Filesize

    96KB

  • memory/2352-48-0x000007FEF65D0000-0x000007FEF65E1000-memory.dmp

    Filesize

    68KB

  • memory/2352-47-0x000007FEF65F0000-0x000007FEF660B000-memory.dmp

    Filesize

    108KB

  • memory/2352-46-0x000007FEF6610000-0x000007FEF6621000-memory.dmp

    Filesize

    68KB

  • memory/2352-45-0x000007FEF72B0000-0x000007FEF72C1000-memory.dmp

    Filesize

    68KB

  • memory/2352-44-0x000007FEF72D0000-0x000007FEF72E1000-memory.dmp

    Filesize

    68KB

  • memory/2352-40-0x000007FEF4C20000-0x000007FEF5CD0000-memory.dmp

    Filesize

    16.7MB

  • memory/2352-42-0x000007FEF7310000-0x000007FEF7331000-memory.dmp

    Filesize

    132KB

  • memory/2352-41-0x000007FEF7340000-0x000007FEF7381000-memory.dmp

    Filesize

    260KB