Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
7Krampus.rar
windows7-x64
3Krampus.rar
windows10-2004-x64
3krampus.exe
windows7-x64
7krampus.exe
windows10-2004-x64
7libcurl.dll
windows7-x64
1libcurl.dll
windows10-2004-x64
1scripts/In...eld.js
windows7-x64
3scripts/In...eld.js
windows10-2004-x64
3scripts/autosaved.lua
windows7-x64
3scripts/autosaved.lua
windows10-2004-x64
3scripts/be...pt.lua
windows7-x64
3scripts/be...pt.lua
windows10-2004-x64
3scripts/dark dex.js
windows7-x64
3scripts/dark dex.js
windows10-2004-x64
3workspace/...le.txt
windows7-x64
1workspace/...le.txt
windows10-2004-x64
1workspace/...le.txt
windows7-x64
1workspace/...le.txt
windows10-2004-x64
1workspace/...le.txt
windows7-x64
1workspace/...le.txt
windows10-2004-x64
1workspace/..._2.txt
windows7-x64
1workspace/..._2.txt
windows10-2004-x64
1workspace/...le.txt
windows7-x64
1workspace/...le.txt
windows10-2004-x64
1workspace/...le.txt
windows7-x64
1workspace/...le.txt
windows10-2004-x64
1workspace/....rbxlx
windows7-x64
3workspace/....rbxlx
windows10-2004-x64
3workspace/...87.txt
windows7-x64
1workspace/...87.txt
windows10-2004-x64
1workspace/....rbxlx
windows7-x64
3workspace/....rbxlx
windows10-2004-x64
3Analysis
-
max time kernel
144s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
07/08/2024, 15:00
Behavioral task
behavioral1
Sample
Krampus.rar
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
Krampus.rar
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
krampus.exe
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
krampus.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
libcurl.dll
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
libcurl.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
scripts/Infinite yield.js
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
scripts/Infinite yield.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
scripts/autosaved.lua
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
scripts/autosaved.lua
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
scripts/betascript.lua
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
scripts/betascript.lua
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
scripts/dark dex.js
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
scripts/dark dex.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
workspace/.tests/appendfile.txt
Resource
win7-20240705-en
Behavioral task
behavioral16
Sample
workspace/.tests/appendfile.txt
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
workspace/.tests/delfile.txt
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
workspace/.tests/delfile.txt
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
workspace/.tests/isfile.txt
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
workspace/.tests/isfile.txt
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
workspace/.tests/listfiles/test_2.txt
Resource
win7-20240705-en
Behavioral task
behavioral22
Sample
workspace/.tests/listfiles/test_2.txt
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
workspace/.tests/readfile.txt
Resource
win7-20240705-en
Behavioral task
behavioral24
Sample
workspace/.tests/readfile.txt
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
workspace/.tests/writefile.txt
Resource
win7-20240708-en
Behavioral task
behavioral26
Sample
workspace/.tests/writefile.txt
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
workspace/4483381587.rbxlx
Resource
win7-20240708-en
Behavioral task
behavioral28
Sample
workspace/4483381587.rbxlx
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
workspace/4483381587.txt
Resource
win7-20240704-en
Behavioral task
behavioral30
Sample
workspace/4483381587.txt
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
workspace/5972698540.rbxlx
Resource
win7-20240704-en
Behavioral task
behavioral32
Sample
workspace/5972698540.rbxlx
Resource
win10v2004-20240802-en
General
-
Target
Krampus.rar
-
Size
5.8MB
-
MD5
5233ef4feae855b4716111f6e1f2347e
-
SHA1
a220baf15d0122821164aaf431601394473da632
-
SHA256
722944284358b6e0b07d91524f7defd19b8cae3246c4e812147575432baf2afc
-
SHA512
76a6faab525a72bb013ff46339cc4bb7154c799bce99379d40b03d77b10b0a6b16426c400e127414a2893aedfcdf7cb41284072b24f956d3f73aabd5b25e5dae
-
SSDEEP
98304:QA/B7+WfLbxoJ0V2FHGrOxczxsEdOa+ZfxOkTL9YcZCbyQ0EuDfLBfawUCy+:QA/ZffRS08mByeObJLv4yQ0PjBBDy+
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2132 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2132 vlc.exe -
Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 2132 vlc.exe 2132 vlc.exe 2132 vlc.exe 2132 vlc.exe 2132 vlc.exe 2132 vlc.exe 2132 vlc.exe 2132 vlc.exe -
Suspicious use of SendNotifyMessage 7 IoCs
pid Process 2132 vlc.exe 2132 vlc.exe 2132 vlc.exe 2132 vlc.exe 2132 vlc.exe 2132 vlc.exe 2132 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2132 vlc.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2024 wrote to memory of 2812 2024 cmd.exe 31 PID 2024 wrote to memory of 2812 2024 cmd.exe 31 PID 2024 wrote to memory of 2812 2024 cmd.exe 31 PID 2812 wrote to memory of 2108 2812 rundll32.exe 32 PID 2812 wrote to memory of 2108 2812 rundll32.exe 32 PID 2812 wrote to memory of 2108 2812 rundll32.exe 32 PID 2108 wrote to memory of 2132 2108 rundll32.exe 34 PID 2108 wrote to memory of 2132 2108 rundll32.exe 34 PID 2108 wrote to memory of 2132 2108 rundll32.exe 34
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Krampus.rar1⤵
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Krampus.rar2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Krampus.rar3⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Krampus.rar"4⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2132
-
-
-