Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

1

Oh.rar

windows11-21h2-x64

7

Analysis

  • max time kernel
    53s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    19/08/2024, 09:18 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Oh.rar

  • Size

    9.7MB

  • MD5

    3d3bb9b240284128b59e185530458d42

  • SHA1

    49f9735a89ef431e60067bbc06bc4ff88bf4eb5a

  • SHA256

    dbe94d2f0d72c7fa31bffbb3b59bcbf6a605040b59a417d38b4802208be4ee1d

  • SHA512

    a778a419c2680cddfb45a62a55501870bec0079daab2139440ce05781d630964a72a1a61082be6617a1c87dfbb66e608735d6a40caa0c2756ea275d22d30fed9

  • SSDEEP

    196608:loZKP2s5tcYorXRC8S4boCU4BX4QbSFG1uR1/nQhlHDCCvEQxtKpQdmFwDphgZRO:vXoNCibor4pDbSsuR1QhlxiQdmFOgW

Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Oh.rar
    1⤵
    • Modifies registry class
    PID:236
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2068
    • C:\Program Files\7-Zip\7zFM.exe
      "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Oh.rar"
      2⤵
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:2060
  • C:\Users\Admin\Desktop\mta_is_fun.exe
    "C:\Users\Admin\Desktop\mta_is_fun.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3920
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c pause
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3484

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\Desktop\mta_is_fun.exe
    Filesize

    10.0MB

    MD5

    a78c8df9d3371931980a66100aaae6c4

    SHA1

    bb0254b25f06908b78aa718cc3fe5bbca3324570

    SHA256

    7864fee647473d8b526f1a76dcfb76acfec2dc105aab11a19251c557bf0ecac6

    SHA512

    2df3e1b60389128aa42f86b7268b41bf45c4d435686ef29ffe7116cd3c8798f6b32f706432fa899cb1f71521ea1331dda70bf456f5fbd1bc1c3142af1d9cd5ec

    Download Submit

  • memory/3920-10-0x00000000020F0000-0x00000000020F1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3920-11-0x0000000000B90000-0x0000000001B3F000-memory.dmp

    Filesize

    15.7MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.