Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    103s
  • max time network
    20s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    20/08/2024, 00:37

General

  • Target

    F1 2022 (Mobile) RP/animations/car.animation.json

  • Size

    832B

  • MD5

    005cf5b041d10f88a35b9d07b0359218

  • SHA1

    25f96c2b1bebedc3385d096c5c71a5ce63864205

  • SHA256

    ac972162bd7ea1963fe7790bf5b80e9dbfec59a654e78b224269f0641a9271b6

  • SHA512

    8395f468b949aedf3f421eef94faa70eecaf5f4b06169cebd1e927b96b6d7590ce7a8e94f71be9a015f0887f528ed54ce6db95d13a8238ce5befeec68aec1cb7

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\F1 2022 (Mobile) RP\animations\car.animation.json"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1668
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\F1 2022 (Mobile) RP\animations\car.animation.json
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2788
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\F1 2022 (Mobile) RP\animations\car.animation.json"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2772

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    f80beb058e83722705659ab4b48c516e

    SHA1

    053454a1026709305ed3ff6e2dff135f15ab1c7c

    SHA256

    8006c2025d3738c97dfa9d114cd46fc4faf9c9a47add5984db9efdf0dba5a89b

    SHA512

    47e1069e243e602beebd4f9762a4a36b179febe8eb9c38bc9709a19f0d290deb1d06694762396cce297c812295254def93e7206c6514207f38f5d3a3bfe8ad56