f516ab25ca5ccedca8a8d95d7efa6e0984bdf41091a79097668462aee2d5bd9d

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

IM NEVER LEAVING!.zip

windows11-21h2-x64

IM NEVER L..._store

windows11-21h2-x64

IM NEVER L...OS.txt

windows11-21h2-x64

IM NEVER L...0.webp

windows11-21h2-x64

IM NEVER L...0.webp

windows11-21h2-x64

IM NEVER L...1.webp

windows11-21h2-x64

IM NEVER L...0.webp

windows11-21h2-x64

IM NEVER L...0.webp

windows11-21h2-x64

IM NEVER L...0.webp

windows11-21h2-x64

IM NEVER L...0.webp

windows11-21h2-x64

IM NEVER L...0.webp

windows11-21h2-x64

IM NEVER L...0.webp

windows11-21h2-x64

IM NEVER L...0.webp

windows11-21h2-x64

IM NEVER L...0.webp

windows11-21h2-x64

IM NEVER L...0.webp

windows11-21h2-x64

IM NEVER L...1.webp

windows11-21h2-x64

IM NEVER L...0.webp

windows11-21h2-x64

IM NEVER L...0.webp

windows11-21h2-x64

IM NEVER L...0.webp

windows11-21h2-x64

IM NEVER L...0.webp

windows11-21h2-x64

IM NEVER L...0.webp

windows11-21h2-x64

IM NEVER L...0.webp

windows11-21h2-x64

IM NEVER L...0.webp

windows11-21h2-x64

IM NEVER L...0.webp

windows11-21h2-x64

__MACOSX/I..._store

windows11-21h2-x64

__MACOSX/I...OS.txt

windows11-21h2-x64

__MACOSX/I...0.webp

windows11-21h2-x64

__MACOSX/I...0.webp

windows11-21h2-x64

__MACOSX/I...1.webp

windows11-21h2-x64

__MACOSX/I...0.webp

windows11-21h2-x64

__MACOSX/I...0.webp

windows11-21h2-x64

__MACOSX/I...0.webp

windows11-21h2-x64

Analysis

max time kernel
432s
max time network
435s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
12/08/2024, 13:02

Sharing

Copy URL

Twitter E-mail

Static task

static1

Behavioral task

behavioral1

Sample

IM NEVER LEAVING!.zip

Resource

win11-20240802-en

windows11-21h2-x64

0 signatures

600 seconds

Behavioral task

behavioral2

Sample

IM NEVER LEAVING!/.ds_store

Resource

win11-20240802-en

windows11-21h2-x64

3 signatures

600 seconds

Behavioral task

behavioral3

Sample

IM NEVER LEAVING!/ILL ALWAYS BE WITH YOU SOOS.txt

Resource

win11-20240802-en

windows11-21h2-x64

3 signatures

600 seconds

Behavioral task

behavioral4

Sample

IM NEVER LEAVING!/tumblr_8c696247ca8d924d040398c4be61115d_e369e403_400.webp

Resource

win11-20240802-en

discovery

windows11-21h2-x64

12 signatures

600 seconds

Behavioral task

behavioral5

Sample

IM NEVER LEAVING!/tumblr_ndbolzrktU1qhccbco10_250.webp

Resource

win11-20240802-en

discovery

windows11-21h2-x64

12 signatures

600 seconds

Behavioral task

behavioral6

Sample

IM NEVER LEAVING!/tumblr_ndbolzrktU1qhccbco1_250-1.webp

Resource

win11-20240802-en

discovery

windows11-21h2-x64

12 signatures

600 seconds

Behavioral task

behavioral7

Sample

IM NEVER LEAVING!/tumblr_ndbolzrktU1qhccbco1_250.webp

Resource

win11-20240802-en

discovery

windows11-21h2-x64

12 signatures

600 seconds

Behavioral task

behavioral8

Sample

IM NEVER LEAVING!/tumblr_ndbolzrktU1qhccbco2_250.webp

Resource

win11-20240802-en

discovery

windows11-21h2-x64

12 signatures

600 seconds

Behavioral task

behavioral9

Sample

IM NEVER LEAVING!/tumblr_ndbolzrktU1qhccbco3_250.webp

Resource

win11-20240802-en

discovery

windows11-21h2-x64

12 signatures

600 seconds

Behavioral task

behavioral10

Sample

IM NEVER LEAVING!/tumblr_ndbolzrktU1qhccbco4_250.webp

Resource

win11-20240802-en

discovery

windows11-21h2-x64

12 signatures

600 seconds

Behavioral task

behavioral11

Sample

IM NEVER LEAVING!/tumblr_ndbolzrktU1qhccbco6_250.webp

Resource

win11-20240802-en

discovery

windows11-21h2-x64

12 signatures

600 seconds

Behavioral task

behavioral12

Sample

IM NEVER LEAVING!/tumblr_ndbolzrktU1qhccbco7_250.webp

Resource

win11-20240802-en

discovery

windows11-21h2-x64

12 signatures

600 seconds

Behavioral task

behavioral13

Sample

IM NEVER LEAVING!/tumblr_ndbolzrktU1qhccbco8_250.webp

Resource

win11-20240802-en

discovery

windows11-21h2-x64

12 signatures

600 seconds

Behavioral task

behavioral14

Sample

IM NEVER LEAVING!/tumblr_ndbolzrktU1qhccbco9_250.webp

Resource

win11-20240802-en

discovery

windows11-21h2-x64

12 signatures

600 seconds

Behavioral task

behavioral15

Sample

IM NEVER LEAVING!/tumblr_ndbos8REDU1qhccbco10_400.webp

Resource

win11-20240802-en

discovery

windows11-21h2-x64

12 signatures

600 seconds

Behavioral task

behavioral16

Sample

IM NEVER LEAVING!/tumblr_ndbos8REDU1qhccbco3_400-1.webp

Resource

win11-20240802-en

discovery

windows11-21h2-x64

12 signatures

600 seconds

Behavioral task

behavioral17

Sample

IM NEVER LEAVING!/tumblr_ndbos8REDU1qhccbco3_400.webp

Resource

win11-20240802-en

discovery

windows11-21h2-x64

12 signatures

600 seconds

Behavioral task

behavioral18

Sample

IM NEVER LEAVING!/tumblr_ndbos8REDU1qhccbco4_250.webp

Resource

win11-20240802-en

discovery

windows11-21h2-x64

12 signatures

600 seconds

Behavioral task

behavioral19

Sample

IM NEVER LEAVING!/tumblr_ndbos8REDU1qhccbco5_400.webp

Resource

win11-20240802-en

discovery

windows11-21h2-x64

12 signatures

600 seconds

Behavioral task

behavioral20

Sample

IM NEVER LEAVING!/tumblr_ndbos8REDU1qhccbco6_250.webp

Resource

win11-20240802-en

discovery

windows11-21h2-x64

12 signatures

600 seconds

Behavioral task

behavioral21

Sample

IM NEVER LEAVING!/tumblr_ndbos8REDU1qhccbco7_400.webp

Resource

win11-20240802-en

discovery

windows11-21h2-x64

12 signatures

600 seconds

Behavioral task

behavioral22

Sample

IM NEVER LEAVING!/tumblr_ndbos8REDU1qhccbco8_250.webp

Resource

win11-20240802-en

discovery

windows11-21h2-x64

12 signatures

600 seconds

Behavioral task

behavioral23

Sample

IM NEVER LEAVING!/tumblr_ndbos8REDU1qhccbco9_400.webp

Resource

win11-20240802-en

discovery

windows11-21h2-x64

12 signatures

600 seconds

Behavioral task

behavioral24

Sample

IM NEVER LEAVING!/tumblr_ndbp92G3n31qhccbco4_250.webp

Resource

win11-20240802-en

discovery

windows11-21h2-x64

12 signatures

600 seconds

Behavioral task

behavioral25

Sample

__MACOSX/IM NEVER LEAVING!/._.ds_store

Resource

win11-20240802-en

windows11-21h2-x64

3 signatures

600 seconds

Behavioral task

behavioral26

Sample

__MACOSX/IM NEVER LEAVING!/._ILL ALWAYS BE WITH YOU SOOS.txt

Resource

win11-20240802-en

windows11-21h2-x64

3 signatures

600 seconds

Behavioral task

behavioral27

Sample

__MACOSX/IM NEVER LEAVING!/._tumblr_8c696247ca8d924d040398c4be61115d_e369e403_400.webp

Resource

win11-20240802-en

discovery

windows11-21h2-x64

12 signatures

600 seconds

Behavioral task

behavioral28

Sample

__MACOSX/IM NEVER LEAVING!/._tumblr_ndbolzrktU1qhccbco10_250.webp

Resource

win11-20240802-en

discovery

windows11-21h2-x64

12 signatures

600 seconds

Behavioral task

behavioral29

Sample

__MACOSX/IM NEVER LEAVING!/._tumblr_ndbolzrktU1qhccbco1_250-1.webp

Resource

win11-20240802-en

discovery

windows11-21h2-x64

12 signatures

600 seconds

Behavioral task

behavioral30

Sample

__MACOSX/IM NEVER LEAVING!/._tumblr_ndbolzrktU1qhccbco1_250.webp

Resource

win11-20240802-en

discovery

windows11-21h2-x64

12 signatures

600 seconds

Behavioral task

behavioral31

Sample

__MACOSX/IM NEVER LEAVING!/._tumblr_ndbolzrktU1qhccbco2_250.webp

Resource

win11-20240802-en

discovery

windows11-21h2-x64

12 signatures

600 seconds

Behavioral task

behavioral32

Sample

__MACOSX/IM NEVER LEAVING!/._tumblr_ndbolzrktU1qhccbco3_250.webp

Resource

win11-20240802-en

discovery

windows11-21h2-x64

12 signatures

600 seconds

Report Analysis Logs

General

Target

IM NEVER LEAVING!/.ds_store
Size

10KB
MD5

e4474931659a48cec11601e0596ddd84
SHA1

1f2bbbe16830729360c5d240b5ba7f380c8c15d8
SHA256

6cc4cfa54f92a0bb0cca90b6ffdce9e3c98e7e9aa70984e0898aabf5d6f4f207
SHA512

7b186648fa0f1eb9e0d8e4ec5455888a04cc54e796e2bb287a4ccb281ede893be35c2d690b697886d1d77c5c552462a2b5b68f81ef76513ee6c85834e212f858
SSDEEP

12:IGX9EEX/HnXw6XFlshf8XSWKt1Ql16GAgaCaOwXlDk4OmARwOmAhOmAPwOmAEOmy:ISfnVV2hf8vV0WrLDYvl+R75HVjvl+Rf

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4100	OpenWith.exe

Processes

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\IM NEVER LEAVING!\.ds_store"
1⤵
- Modifies registry class
PID:1028

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads