Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
1RoPro.rar
windows7-x64
3RoPro.rar
windows10-2004-x64
3RoPro/_loc...s.json
windows7-x64
3RoPro/_loc...s.json
windows10-2004-x64
3RoPro/_loc...s.json
windows7-x64
3RoPro/_loc...s.json
windows10-2004-x64
3RoPro/_loc...s.json
windows7-x64
3RoPro/_loc...s.json
windows10-2004-x64
3RoPro/_loc...s.json
windows7-x64
3RoPro/_loc...s.json
windows10-2004-x64
3RoPro/_loc...s.json
windows7-x64
3RoPro/_loc...s.json
windows10-2004-x64
3RoPro/_loc...s.json
windows7-x64
3RoPro/_loc...s.json
windows10-2004-x64
3RoPro/_loc...s.json
windows7-x64
3RoPro/_loc...s.json
windows10-2004-x64
3RoPro/_loc...s.json
windows7-x64
3RoPro/_loc...s.json
windows10-2004-x64
3RoPro/_loc...s.json
windows7-x64
3RoPro/_loc...s.json
windows10-2004-x64
3RoPro/_loc...s.json
windows7-x64
3RoPro/_loc...s.json
windows10-2004-x64
3RoPro/_loc...s.json
windows7-x64
3RoPro/_loc...s.json
windows10-2004-x64
3RoPro/_loc...s.json
windows7-x64
3RoPro/_loc...s.json
windows10-2004-x64
3RoPro/_loc...s.json
windows7-x64
3RoPro/_loc...s.json
windows10-2004-x64
3RoPro/_loc...s.json
windows7-x64
3RoPro/_loc...s.json
windows10-2004-x64
3RoPro/_loc...s.json
windows7-x64
3RoPro/_loc...s.json
windows10-2004-x64
3Analysis
-
max time kernel
18s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
18/08/2024, 15:19
Static task
static1
Behavioral task
behavioral1
Sample
RoPro.rar
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
RoPro.rar
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
RoPro/_locales/am/messages.json
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
RoPro/_locales/am/messages.json
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
RoPro/_locales/ar/messages.json
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
RoPro/_locales/ar/messages.json
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
RoPro/_locales/ar_EG/messages.json
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
RoPro/_locales/ar_EG/messages.json
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
RoPro/_locales/be/messages.json
Resource
win7-20240729-en
Behavioral task
behavioral10
Sample
RoPro/_locales/be/messages.json
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
RoPro/_locales/bg/messages.json
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
RoPro/_locales/bg/messages.json
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
RoPro/_locales/bn/messages.json
Resource
win7-20240729-en
Behavioral task
behavioral14
Sample
RoPro/_locales/bn/messages.json
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
RoPro/_locales/ca/messages.json
Resource
win7-20240705-en
Behavioral task
behavioral16
Sample
RoPro/_locales/ca/messages.json
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
RoPro/_locales/cs/messages.json
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
RoPro/_locales/cs/messages.json
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
RoPro/_locales/da/messages.json
Resource
win7-20240729-en
Behavioral task
behavioral20
Sample
RoPro/_locales/da/messages.json
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
RoPro/_locales/de/messages.json
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
RoPro/_locales/de/messages.json
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
RoPro/_locales/de_CH/messages.json
Resource
win7-20240705-en
Behavioral task
behavioral24
Sample
RoPro/_locales/de_CH/messages.json
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
RoPro/_locales/el/messages.json
Resource
win7-20240729-en
Behavioral task
behavioral26
Sample
RoPro/_locales/el/messages.json
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
RoPro/_locales/en/messages.json
Resource
win7-20240704-en
Behavioral task
behavioral28
Sample
RoPro/_locales/en/messages.json
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
RoPro/_locales/en_GB/messages.json
Resource
win7-20240704-en
Behavioral task
behavioral30
Sample
RoPro/_locales/en_GB/messages.json
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
RoPro/_locales/en_PH/messages.json
Resource
win7-20240708-en
Behavioral task
behavioral32
Sample
RoPro/_locales/en_PH/messages.json
Resource
win10v2004-20240802-en
General
-
Target
RoPro.rar
-
Size
3.2MB
-
MD5
e87146d96ec227fb83a650ca9a32a3a6
-
SHA1
c22088e094c80ec33a4d4c836727e174ae2efb66
-
SHA256
35b25eed9892d97ec680f80bd0c4d8c7099664ea5cd3949cb6b214b7f15b75d5
-
SHA512
a119ff621047f1b09ec6ae30da91f86c865af8ab8c6d936c0140e7d100291bfc03c8b4d408bd6a6756fba92bc19922724cc1b243381c67ea6bd28a585a601123
-
SSDEEP
98304:TgwqvBteriJo8DXSk0QK3RQDye/YQXo/BBgz+JOBuFR:G50Ov0QkWo/Qz+Acv
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2496 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2496 vlc.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe 2496 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2496 vlc.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1532 wrote to memory of 2404 1532 cmd.exe 29 PID 1532 wrote to memory of 2404 1532 cmd.exe 29 PID 1532 wrote to memory of 2404 1532 cmd.exe 29 PID 2404 wrote to memory of 2900 2404 rundll32.exe 30 PID 2404 wrote to memory of 2900 2404 rundll32.exe 30 PID 2404 wrote to memory of 2900 2404 rundll32.exe 30 PID 2900 wrote to memory of 2496 2900 rundll32.exe 32 PID 2900 wrote to memory of 2496 2900 rundll32.exe 32 PID 2900 wrote to memory of 2496 2900 rundll32.exe 32
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\RoPro.rar1⤵
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\RoPro.rar2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\RoPro.rar3⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\RoPro.rar"4⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2496
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5713dd794c2ff381fbe318e18113d4182
SHA18a933919e2079ef1aef3d90beb463fbb03640e8d
SHA256c694a029eb9871daf6ba6a922878300813a97361bf14133f30744fa86d950817
SHA512e8e6c9ba38bf657d6b2666226d28f2adc5d42abef7cc443b4412946aa121d2697c46014bb922b454b12ecff57ba8706d56c73cac142ad59a32bfd15a641998e9
-
Filesize
2KB
MD5ad0d9b463d26cf9e2b617885b0be3ef5
SHA17b3c25e93175aa3dd32f71367adf9ddd0ee448fd
SHA256270706747447e8ce9f1f566d37e4544d18623bdb819ef4d2d24fcb4efc38e9f6
SHA512c107b25082969ab0003201298dde94951e70afbcedff4342a22ce248572fd5acccb9c1dbccb0fe24b11a16b995d6c81832b5a67f157cb9d76a21aa7e5c82ab4b
-
Filesize
18B
MD54660293760e0121154888ed8b95e4498
SHA11f328d23c3dbc9d7e1ea4ae7c10911262a074283
SHA256152a7b936a81d30ec29e2ccbcf12654171b294198ceea6a07c1b10bccb980aff
SHA5128bc44fa45a0a7f7307c4ca50f307be049c157cd5929bde6aa6ee62d3771b4f4393079cbe64097cb9cce2c03702370062af0f1eab6703bcdfc2e7fc721b2c4e83