Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    06/08/2024, 14:26

General

  • Target

    FeatherRelease.rar

  • Size

    31.6MB

  • MD5

    e6cde71e013fbcd24098be47ce1b02ef

  • SHA1

    04fc1aedbfa583a3d7796c0b20b13a1a432eba36

  • SHA256

    46a8ce6edaccc04c1c1123ad08eb7168a931b8b161dacdd8e7a7faa3c0ad6c24

  • SHA512

    2ffdc74ed77932ffc7feccc9018f55442beb9b6b45b6be300f0dd445aecc9dfd6c0fb9b1208efeb913e465e5eac3243cdc1f008f256c40e26c338362a783f140

  • SSDEEP

    786432:rEkHm/NnO7fSi9DvKniX2N4BuJevEjnfF6pqXJsBTIqSjKs9sCTRO/:pm1O76i9DvKiXXuJuEjdoqmTI7jK2sC+

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 9 IoCs
  • Suspicious use of SendNotifyMessage 8 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\FeatherRelease.rar
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2540
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\FeatherRelease.rar
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2760
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\FeatherRelease.rar
        3⤵
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:2248
        • C:\Program Files\VideoLAN\VLC\vlc.exe
          "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\FeatherRelease.rar"
          4⤵
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:2940

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2940-30-0x000007FEFB2E0000-0x000007FEFB314000-memory.dmp

    Filesize

    208KB

  • memory/2940-29-0x000000013FA30000-0x000000013FB28000-memory.dmp

    Filesize

    992KB

  • memory/2940-34-0x000007FEFB280000-0x000007FEFB291000-memory.dmp

    Filesize

    68KB

  • memory/2940-38-0x000007FEF7EC0000-0x000007FEF7ED1000-memory.dmp

    Filesize

    68KB

  • memory/2940-37-0x000007FEF7EE0000-0x000007FEF7EFD000-memory.dmp

    Filesize

    116KB

  • memory/2940-36-0x000007FEF8180000-0x000007FEF8191000-memory.dmp

    Filesize

    68KB

  • memory/2940-35-0x000007FEFB260000-0x000007FEFB277000-memory.dmp

    Filesize

    92KB

  • memory/2940-31-0x000007FEF66D0000-0x000007FEF6986000-memory.dmp

    Filesize

    2.7MB

  • memory/2940-33-0x000007FEFB2A0000-0x000007FEFB2B7000-memory.dmp

    Filesize

    92KB

  • memory/2940-32-0x000007FEFB2C0000-0x000007FEFB2D8000-memory.dmp

    Filesize

    96KB

  • memory/2940-52-0x000007FEF63A0000-0x000007FEF641C000-memory.dmp

    Filesize

    496KB

  • memory/2940-68-0x000007FEEF750000-0x000007FEEF7BD000-memory.dmp

    Filesize

    436KB

  • memory/2940-67-0x000007FEEFB20000-0x000007FEEFB82000-memory.dmp

    Filesize

    392KB

  • memory/2940-66-0x000007FEEFB90000-0x000007FEEFBD2000-memory.dmp

    Filesize

    264KB

  • memory/2940-65-0x000007FEF1D30000-0x000007FEF1DF5000-memory.dmp

    Filesize

    788KB

  • memory/2940-64-0x000007FEF1E00000-0x000007FEF1E16000-memory.dmp

    Filesize

    88KB

  • memory/2940-63-0x000007FEF2220000-0x000007FEF2231000-memory.dmp

    Filesize

    68KB

  • memory/2940-62-0x000007FEF1E20000-0x000007FEF1E4F000-memory.dmp

    Filesize

    188KB

  • memory/2940-61-0x000007FEFB250000-0x000007FEFB260000-memory.dmp

    Filesize

    64KB

  • memory/2940-60-0x000007FEF6250000-0x000007FEF6262000-memory.dmp

    Filesize

    72KB

  • memory/2940-59-0x000007FEF6270000-0x000007FEF6281000-memory.dmp

    Filesize

    68KB

  • memory/2940-58-0x000007FEF6290000-0x000007FEF62B3000-memory.dmp

    Filesize

    140KB

  • memory/2940-57-0x000007FEF62C0000-0x000007FEF62D8000-memory.dmp

    Filesize

    96KB

  • memory/2940-56-0x000007FEF62E0000-0x000007FEF6304000-memory.dmp

    Filesize

    144KB

  • memory/2940-55-0x000007FEF6310000-0x000007FEF6338000-memory.dmp

    Filesize

    160KB

  • memory/2940-54-0x000007FEF6340000-0x000007FEF6397000-memory.dmp

    Filesize

    348KB

  • memory/2940-53-0x000007FEF6D00000-0x000007FEF6D11000-memory.dmp

    Filesize

    68KB

  • memory/2940-51-0x000007FEF6420000-0x000007FEF6487000-memory.dmp

    Filesize

    412KB

  • memory/2940-50-0x000007FEF6490000-0x000007FEF64C0000-memory.dmp

    Filesize

    192KB

  • memory/2940-49-0x000007FEF6D20000-0x000007FEF6D38000-memory.dmp

    Filesize

    96KB

  • memory/2940-48-0x000007FEF6D40000-0x000007FEF6D51000-memory.dmp

    Filesize

    68KB

  • memory/2940-47-0x000007FEF6D60000-0x000007FEF6D7B000-memory.dmp

    Filesize

    108KB

  • memory/2940-46-0x000007FEF7320000-0x000007FEF7331000-memory.dmp

    Filesize

    68KB

  • memory/2940-45-0x000007FEF7340000-0x000007FEF7351000-memory.dmp

    Filesize

    68KB

  • memory/2940-44-0x000007FEF7360000-0x000007FEF7371000-memory.dmp

    Filesize

    68KB

  • memory/2940-42-0x000007FEF7380000-0x000007FEF73A1000-memory.dmp

    Filesize

    132KB

  • memory/2940-39-0x000007FEF4B10000-0x000007FEF5BC0000-memory.dmp

    Filesize

    16.7MB

  • memory/2940-43-0x000007FEF7EA0000-0x000007FEF7EB8000-memory.dmp

    Filesize

    96KB

  • memory/2940-41-0x000007FEF73B0000-0x000007FEF73F1000-memory.dmp

    Filesize

    260KB

  • memory/2940-40-0x000007FEF64C0000-0x000007FEF66CB000-memory.dmp

    Filesize

    2.0MB