Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    16s
  • max time network
    22s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    08/08/2024, 23:22

General

  • Target

    acf7fs.7z

  • Size

    7.2MB

  • MD5

    3d82083f0584cfdf9636cd9dbffa3b50

  • SHA1

    dcc5cb5ab5a52f8216bcec2c6ad8e9d08a712724

  • SHA256

    97d7996c657dac39497001683776ea390ba3f3f70f31da017547bbd4590701d7

  • SHA512

    37a2e19f6350fb0bc2c52abdfbdf01c4914f7a1d09a041d50715e109fc4c39b3c68f92ddb0e797939810935d1ec1faffa9cf663e365ef9cc78d90c72308fc895

  • SSDEEP

    196608:ROmEQvI1Ca9aAOEVwOZZQYHRhEA9fdpDW9:ROlQvdAAnwbj5dp6

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\acf7fs.7z
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2080
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\acf7fs.7z
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2956
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\acf7fs.7z
        3⤵
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:2708
        • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
          "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\acf7fs.7z"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:3056
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:2252

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads