Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    25/08/2024, 18:51

General

  • Target

    locales/am.pak

  • Size

    776KB

  • MD5

    92ffe73f193d41c5a90303955b2da67f

  • SHA1

    1d4136d8bb752da2834ebf0f4f62de56efefd78f

  • SHA256

    325dd137903fc0d9e5010a62a314d9c6984ff82afbdff2254f7c48bd03dda06a

  • SHA512

    6c4f0aac10276ab84ec4e63ec9ad0e20a1b3ce9d2368ec966cc6471600c3d28df8f9e501b4843bafa5bcf2aab57242559ba430d58853180ea653afbc8f468e67

  • SSDEEP

    24576:/Ky3ATZg8/xp1GCj+VRRz08519tcV03OzPkS:yy3J54

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\locales\am.pak
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2200
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\locales\am.pak
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1228
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\locales\am.pak"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:1004

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    1d48c69184f188b7d03dfd5b99b148ba

    SHA1

    c1cb30270e655ea8e9b96152a8525dba52856fd9

    SHA256

    d93f0a67b6c96c7e4f257e82ee0675a62b39abf279f5f215be945de6f31cec5d

    SHA512

    4a7ca0239b0add7a97ac604c69dce466900e025c927463ecd54d651fa4e64c683607bed63b0028f628b72020eb22a6308c1ab0cd08186dfc72f154c7663fb768