Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    17/08/2024, 13:48

General

  • Target

    release8-16.rar

  • Size

    8.1MB

  • MD5

    7b8a172974a32f9d1c093d1c35e8f1a1

  • SHA1

    9110827d5a5a39306ee26e3e8b763abf22ae555e

  • SHA256

    ecab58d9e2edf6539e3cca667a72cb0ced2567bf30073f9f216af4a872c5beaf

  • SHA512

    458f52e0cba4801acce10f062207939f7749365dcfad4a2473e96ccfd91213d0a91b15d07f40b5588e1ebacbbdd5852711dd81252772cc0b9c3232b174a32850

  • SSDEEP

    196608:DyPpgjLDA8M2X5et5MNhJNlixAvGUFi0gpuKLoqizxw1wK:Bj/A8MHHMDXAA+UA0gxLonzM

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 10 IoCs
  • Suspicious use of SendNotifyMessage 9 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\release8-16.rar
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2540
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\release8-16.rar
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2744
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\release8-16.rar
        3⤵
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:2748
        • C:\Program Files\VideoLAN\VLC\vlc.exe
          "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\release8-16.rar"
          4⤵
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:2940

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2940-30-0x000007FEFB2E0000-0x000007FEFB314000-memory.dmp

    Filesize

    208KB

  • memory/2940-29-0x000000013F7D0000-0x000000013F8C8000-memory.dmp

    Filesize

    992KB

  • memory/2940-34-0x000007FEFB280000-0x000007FEFB291000-memory.dmp

    Filesize

    68KB

  • memory/2940-38-0x000007FEF7EC0000-0x000007FEF7ED1000-memory.dmp

    Filesize

    68KB

  • memory/2940-37-0x000007FEF7EE0000-0x000007FEF7EFD000-memory.dmp

    Filesize

    116KB

  • memory/2940-36-0x000007FEF8180000-0x000007FEF8191000-memory.dmp

    Filesize

    68KB

  • memory/2940-35-0x000007FEFB260000-0x000007FEFB277000-memory.dmp

    Filesize

    92KB

  • memory/2940-31-0x000007FEF66D0000-0x000007FEF6986000-memory.dmp

    Filesize

    2.7MB

  • memory/2940-33-0x000007FEFB2A0000-0x000007FEFB2B7000-memory.dmp

    Filesize

    92KB

  • memory/2940-32-0x000007FEFB2C0000-0x000007FEFB2D8000-memory.dmp

    Filesize

    96KB

  • memory/2940-40-0x000007FEF64C0000-0x000007FEF66CB000-memory.dmp

    Filesize

    2.0MB

  • memory/2940-69-0x000007FEEF750000-0x000007FEEF7BD000-memory.dmp

    Filesize

    436KB

  • memory/2940-68-0x000007FEEFB20000-0x000007FEEFB82000-memory.dmp

    Filesize

    392KB

  • memory/2940-67-0x000007FEEFB90000-0x000007FEEFBD2000-memory.dmp

    Filesize

    264KB

  • memory/2940-66-0x000007FEF1D30000-0x000007FEF1DF5000-memory.dmp

    Filesize

    788KB

  • memory/2940-65-0x000007FEF1E00000-0x000007FEF1E16000-memory.dmp

    Filesize

    88KB

  • memory/2940-64-0x000007FEF2220000-0x000007FEF2231000-memory.dmp

    Filesize

    68KB

  • memory/2940-63-0x000007FEF1E20000-0x000007FEF1E4F000-memory.dmp

    Filesize

    188KB

  • memory/2940-62-0x000007FEFB250000-0x000007FEFB260000-memory.dmp

    Filesize

    64KB

  • memory/2940-61-0x000007FEF74B0000-0x000007FEF74C7000-memory.dmp

    Filesize

    92KB

  • memory/2940-60-0x000007FEF6250000-0x000007FEF6262000-memory.dmp

    Filesize

    72KB

  • memory/2940-59-0x000007FEF6270000-0x000007FEF6281000-memory.dmp

    Filesize

    68KB

  • memory/2940-58-0x000007FEF6290000-0x000007FEF62B3000-memory.dmp

    Filesize

    140KB

  • memory/2940-57-0x000007FEF62C0000-0x000007FEF62D8000-memory.dmp

    Filesize

    96KB

  • memory/2940-56-0x000007FEF62E0000-0x000007FEF6304000-memory.dmp

    Filesize

    144KB

  • memory/2940-55-0x000007FEF6310000-0x000007FEF6338000-memory.dmp

    Filesize

    160KB

  • memory/2940-54-0x000007FEF6340000-0x000007FEF6397000-memory.dmp

    Filesize

    348KB

  • memory/2940-53-0x000007FEF6D00000-0x000007FEF6D11000-memory.dmp

    Filesize

    68KB

  • memory/2940-52-0x000007FEF63A0000-0x000007FEF641C000-memory.dmp

    Filesize

    496KB

  • memory/2940-51-0x000007FEF6420000-0x000007FEF6487000-memory.dmp

    Filesize

    412KB

  • memory/2940-50-0x000007FEF6490000-0x000007FEF64C0000-memory.dmp

    Filesize

    192KB

  • memory/2940-49-0x000007FEF6D20000-0x000007FEF6D38000-memory.dmp

    Filesize

    96KB

  • memory/2940-48-0x000007FEF6D40000-0x000007FEF6D51000-memory.dmp

    Filesize

    68KB

  • memory/2940-47-0x000007FEF6D60000-0x000007FEF6D7B000-memory.dmp

    Filesize

    108KB

  • memory/2940-46-0x000007FEF7320000-0x000007FEF7331000-memory.dmp

    Filesize

    68KB

  • memory/2940-45-0x000007FEF7340000-0x000007FEF7351000-memory.dmp

    Filesize

    68KB

  • memory/2940-44-0x000007FEF7360000-0x000007FEF7371000-memory.dmp

    Filesize

    68KB

  • memory/2940-43-0x000007FEF7EA0000-0x000007FEF7EB8000-memory.dmp

    Filesize

    96KB

  • memory/2940-42-0x000007FEF7380000-0x000007FEF73A1000-memory.dmp

    Filesize

    132KB

  • memory/2940-41-0x000007FEF73B0000-0x000007FEF73F1000-memory.dmp

    Filesize

    260KB

  • memory/2940-39-0x000007FEF4B10000-0x000007FEF5BC0000-memory.dmp

    Filesize

    16.7MB