Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

02/08/2024, 18:55

240802-xkzn9a1bkg 3

Analysis

  • max time kernel
    127s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    02/08/2024, 18:55

General

  • Target

    Bootsrapper (2).rar

  • Size

    715KB

  • MD5

    4697a477cc3a00ec9976f18e03b84a26

  • SHA1

    43ee4ac8e9b96a1b7469b5c479836c8245b7354d

  • SHA256

    170740ce72172c7d607b46f58d391bff57ac1cb7090625fa53e73b2798437466

  • SHA512

    8e33a2d710812656e3b5bf012155b9f063299dbcbc17e9c8f25b9d8ff8eb9d9a807bb602e14cc076133988fecc54eab1151abbd216e7ca67bc60e3b057910083

  • SSDEEP

    12288:PzK/DP6aCDusJuKBle0ckNGox2cyIjhGrYXOMRtRsi7l/00oTk/Luin/c3ylqe:PzjPXJJG0cXcyIjHO6750/SLjncI

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\Bootsrapper (2).rar"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2372
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Bootsrapper (2).rar
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2832
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Bootsrapper (2).rar
        3⤵
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:2684
        • C:\Program Files\VideoLAN\VLC\vlc.exe
          "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Bootsrapper (2).rar"
          4⤵
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:1388

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1388-24-0x000000013F790000-0x000000013F888000-memory.dmp

    Filesize

    992KB

  • memory/1388-25-0x000007FEFA900000-0x000007FEFA934000-memory.dmp

    Filesize

    208KB

  • memory/1388-27-0x000007FEFAA80000-0x000007FEFAA98000-memory.dmp

    Filesize

    96KB

  • memory/1388-32-0x000007FEFA590000-0x000007FEFA5AD000-memory.dmp

    Filesize

    116KB

  • memory/1388-30-0x000007FEFA5D0000-0x000007FEFA5E7000-memory.dmp

    Filesize

    92KB

  • memory/1388-29-0x000007FEFA5F0000-0x000007FEFA601000-memory.dmp

    Filesize

    68KB

  • memory/1388-28-0x000007FEFA610000-0x000007FEFA627000-memory.dmp

    Filesize

    92KB

  • memory/1388-26-0x000007FEF5F80000-0x000007FEF6236000-memory.dmp

    Filesize

    2.7MB

  • memory/1388-37-0x000007FEF66F0000-0x000007FEF6708000-memory.dmp

    Filesize

    96KB

  • memory/1388-36-0x000007FEF7250000-0x000007FEF7271000-memory.dmp

    Filesize

    132KB

  • memory/1388-33-0x000007FEF5C40000-0x000007FEF5E4B000-memory.dmp

    Filesize

    2.0MB

  • memory/1388-35-0x000007FEF7280000-0x000007FEF72C1000-memory.dmp

    Filesize

    260KB

  • memory/1388-39-0x000007FEF66B0000-0x000007FEF66C1000-memory.dmp

    Filesize

    68KB

  • memory/1388-38-0x000007FEF66D0000-0x000007FEF66E1000-memory.dmp

    Filesize

    68KB

  • memory/1388-34-0x000007FEF72D0000-0x000007FEF72E1000-memory.dmp

    Filesize

    68KB

  • memory/1388-31-0x000007FEFA5B0000-0x000007FEFA5C1000-memory.dmp

    Filesize

    68KB

  • memory/1388-41-0x000007FEF6690000-0x000007FEF66A1000-memory.dmp

    Filesize

    68KB

  • memory/1388-45-0x000007FEF5C10000-0x000007FEF5C40000-memory.dmp

    Filesize

    192KB

  • memory/1388-44-0x000007FEF6630000-0x000007FEF6648000-memory.dmp

    Filesize

    96KB

  • memory/1388-43-0x000007FEF6650000-0x000007FEF6661000-memory.dmp

    Filesize

    68KB

  • memory/1388-55-0x000007FEF59D0000-0x000007FEF59E2000-memory.dmp

    Filesize

    72KB

  • memory/1388-54-0x000007FEF59F0000-0x000007FEF5A01000-memory.dmp

    Filesize

    68KB

  • memory/1388-53-0x000007FEF5A10000-0x000007FEF5A33000-memory.dmp

    Filesize

    140KB

  • memory/1388-52-0x000007FEF5A40000-0x000007FEF5A58000-memory.dmp

    Filesize

    96KB

  • memory/1388-51-0x000007FEF5A60000-0x000007FEF5A84000-memory.dmp

    Filesize

    144KB

  • memory/1388-50-0x000007FEF5A90000-0x000007FEF5AB8000-memory.dmp

    Filesize

    160KB

  • memory/1388-49-0x000007FEF5AC0000-0x000007FEF5B17000-memory.dmp

    Filesize

    348KB

  • memory/1388-48-0x000007FEF6280000-0x000007FEF6291000-memory.dmp

    Filesize

    68KB

  • memory/1388-47-0x000007FEF5B20000-0x000007FEF5B9C000-memory.dmp

    Filesize

    496KB

  • memory/1388-40-0x000007FEF4850000-0x000007FEF5900000-memory.dmp

    Filesize

    16.7MB

  • memory/1388-46-0x000007FEF5BA0000-0x000007FEF5C07000-memory.dmp

    Filesize

    412KB

  • memory/1388-42-0x000007FEF6670000-0x000007FEF668B000-memory.dmp

    Filesize

    108KB