Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
07/08/2024, 04:25
Static task
static1
Behavioral task
behavioral1
Sample
gitsoft_v1.31.7z
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
gitsoft_v1.31.7z
Resource
win10v2004-20240802-en
General
-
Target
gitsoft_v1.31.7z
-
Size
7.2MB
-
MD5
b00c1d3fd00fa3993bd08299cf29b951
-
SHA1
44b81bca2f28e1b03f1f65d7133e86fa4e913a2c
-
SHA256
07f0f19c2ffaf9d7e56c4de26bcd651d5eb4cae64c452b6ceece3e063da29978
-
SHA512
c072d02b4e4f17b8b29331fd77c4c7136ab4416054da19f92dab3bb9f9bd487f91b12ba54e09f38cccc727030eb59bbe4240da53530bafe9c7a97b8ce08f1f4c
-
SSDEEP
196608:FdHXzXNJ5k8flbvWwAJ40kwe52XQ8U9mGRlqA6bj:vXBJh143e52AbbqJ
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1608 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1608 AcroRd32.exe 1608 AcroRd32.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2204 wrote to memory of 2208 2204 cmd.exe 31 PID 2204 wrote to memory of 2208 2204 cmd.exe 31 PID 2204 wrote to memory of 2208 2204 cmd.exe 31 PID 2208 wrote to memory of 2752 2208 rundll32.exe 32 PID 2208 wrote to memory of 2752 2208 rundll32.exe 32 PID 2208 wrote to memory of 2752 2208 rundll32.exe 32 PID 2752 wrote to memory of 1608 2752 rundll32.exe 34 PID 2752 wrote to memory of 1608 2752 rundll32.exe 34 PID 2752 wrote to memory of 1608 2752 rundll32.exe 34 PID 2752 wrote to memory of 1608 2752 rundll32.exe 34
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\gitsoft_v1.31.7z1⤵
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\gitsoft_v1.31.7z2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\gitsoft_v1.31.7z3⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\gitsoft_v1.31.7z"4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1608
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD53c3d0e169ca9211b5df901759732a430
SHA108ed33bfc828aad39e7ca9b3b39b568383929b5e
SHA256fd9854b8fe09c1cc4a4ed43626f4a5cea642b6aa898c9f19217a4c3be97d8c73
SHA51255fca9c73394fbaa0962f035da72709d86b15f9cc06f0c72fd64e3824dbafe19260171c980562fefa4451e6c3f2323d052556e548d147370cd337fcd60242443