Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    25/08/2024, 00:04 UTC

General

  • Target

    scph39001.bin

  • Size

    4.0MB

  • MD5

    d5ce2c7d119f563ce04bc04dbc3a323e

  • SHA1

    f9a5d629a036b99128f7cb530c6e3ca016e9c8b7

  • SHA256

    f4c948e61a291d4b3f92a141e550cf8357204287a31ff784caccbedaef910c9d

  • SHA512

    9c1bacb8996a084f91124ea4e36cea7ed303ae90ede320ca79f070a2f5ee51c5e4b6297c9e3e20d88391e3a7ba78eca61a55f4aabc4fac2b944c3458cad845f6

  • SSDEEP

    49152:3l4rLTETm8tXP/D4qvBG92oqcwsU38MHlvG135t20Eh:3l4LxIBqD6VMCG1pY0

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\scph39001.bin
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2252
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\scph39001.bin
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2844
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\scph39001.bin"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2500

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    e5506a1e0154f84f12e8b9a5070f991a

    SHA1

    6c13cd65be71c6acf3912d787b5b3c7181bc94c1

    SHA256

    8e3248a62a5274457414c92de72f00f6504026734183f54cb1f950eaa5a8cee2

    SHA512

    3bcc0f5fa4fa81985e499d1739cde906ea851eddfd671644bc905cdcbea5b48a7721a782b5790de7b58fff46d51aa754cf15e15dccfd3cd9e783aa3343749626

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.