Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
6Static
static
3ChessBot_demo.zip
windows7-x64
1ChessBot_demo.zip
windows10-2004-x64
1ChessBotX ...c.book
windows7-x64
3ChessBotX ...c.book
windows10-2004-x64
3ChessBotX ...M.book
windows7-x64
3ChessBotX ...M.book
windows10-2004-x64
3ChessBotX ...ot.exe
windows7-x64
5ChessBotX ...ot.exe
windows10-2004-x64
5ChessBotX ...+0.cfg
windows7-x64
3ChessBotX ...+0.cfg
windows10-2004-x64
3ChessBotX ...y).cfg
windows7-x64
3ChessBotX ...y).cfg
windows10-2004-x64
3ChessBotX ...em.cfg
windows7-x64
3ChessBotX ...em.cfg
windows10-2004-x64
3ChessBotX ...st.ini
windows7-x64
1ChessBotX ...st.ini
windows10-2004-x64
1ChessBotX ...sh.cfg
windows7-x64
3ChessBotX ...sh.cfg
windows10-2004-x64
3ChessBotX ...32.cfg
windows7-x64
3ChessBotX ...32.cfg
windows10-2004-x64
3ChessBotX ...gs.ini
windows7-x64
1ChessBotX ...gs.ini
windows10-2004-x64
1ChessBotX ...ys.cfg
windows7-x64
3ChessBotX ...ys.cfg
windows10-2004-x64
3ChessBotX ...ts.cfg
windows7-x64
3ChessBotX ...ts.cfg
windows10-2004-x64
3ChessBotX ...s.dcfg
windows7-x64
3ChessBotX ...s.dcfg
windows10-2004-x64
3ChessBotX ...a1.mp3
windows7-x64
1ChessBotX ...a1.mp3
windows10-2004-x64
6ChessBotX ...a2.mp3
windows7-x64
1ChessBotX ...a2.mp3
windows10-2004-x64
6Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
26/08/2024, 01:18
Static task
static1
Behavioral task
behavioral1
Sample
ChessBot_demo.zip
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
ChessBot_demo.zip
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
ChessBotX Trial/Books/Basic.book
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
ChessBotX Trial/Books/Basic.book
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
ChessBotX Trial/Books/GM.book
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
ChessBotX Trial/Books/GM.book
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
ChessBotX Trial/ChessBot.exe
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
ChessBotX Trial/ChessBot.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
ChessBotX Trial/Config/Delays for bullet 1+0.cfg
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
ChessBotX Trial/Config/Delays for bullet 1+0.cfg
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
ChessBotX Trial/Config/Instant (without delay).cfg
Resource
win7-20240729-en
Behavioral task
behavioral12
Sample
ChessBotX Trial/Config/Instant (without delay).cfg
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
ChessBotX Trial/Config/system.cfg
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
ChessBotX Trial/Config/system.cfg
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
ChessBotX Trial/EngineList.ini
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
ChessBotX Trial/EngineList.ini
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
ChessBotX Trial/Engines Settings/stockfish.cfg
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
ChessBotX Trial/Engines Settings/stockfish.cfg
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
ChessBotX Trial/Engines Settings/stockfish_10_x32.cfg
Resource
win7-20240705-en
Behavioral task
behavioral20
Sample
ChessBotX Trial/Engines Settings/stockfish_10_x32.cfg
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
ChessBotX Trial/Settings.ini
Resource
win7-20240704-en
Behavioral task
behavioral22
Sample
ChessBotX Trial/Settings.ini
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
ChessBotX Trial/System/SystemDelays.cfg
Resource
win7-20240704-en
Behavioral task
behavioral24
Sample
ChessBotX Trial/System/SystemDelays.cfg
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
ChessBotX Trial/System/defaults.cfg
Resource
win7-20240708-en
Behavioral task
behavioral26
Sample
ChessBotX Trial/System/defaults.cfg
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
ChessBotX Trial/System/sys.dcfg
Resource
win7-20240704-en
Behavioral task
behavioral28
Sample
ChessBotX Trial/System/sys.dcfg
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
ChessBotX Trial/voiceover/a1.mp3
Resource
win7-20240704-en
Behavioral task
behavioral30
Sample
ChessBotX Trial/voiceover/a1.mp3
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
ChessBotX Trial/voiceover/a2.mp3
Resource
win7-20240705-en
Behavioral task
behavioral32
Sample
ChessBotX Trial/voiceover/a2.mp3
Resource
win10v2004-20240802-en
General
-
Target
ChessBotX Trial/Books/Basic.book
-
Size
103KB
-
MD5
a1c8e87c5852d13d050d4dbe08b43a94
-
SHA1
c24d3f51aa8e96f310e953cf807f2dd5a6565bce
-
SHA256
6097925ba0dc7280303a1bbad83f31912e6084f2badba859632c6ed2f5ebfa8b
-
SHA512
a6ca0949e6fbfb2964c6d9998eab2cd7c34505acb5e784b2e087fab8de9a96563cbc7d13fb076f8701bdd1724bab1969df9d6d426b8262e3457c3379d65209d0
-
SSDEEP
1536:iFVNWzXUVzoYxpOl5lNNfoHQ5VI6VVV2XUlZX/f5IKZVu2FPffscElnjgUYjQNr7:cWzXUVzoYxpOl5lNNfoHQ5VI6VVV2XJ
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\book_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\.book rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\book_auto_file\shell\Read\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_Classes\Local Settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\.book\ = "book_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\book_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\book_auto_file\shell rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\book_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\book_auto_file rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2864 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2864 AcroRd32.exe 2864 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2120 wrote to memory of 2552 2120 cmd.exe 31 PID 2120 wrote to memory of 2552 2120 cmd.exe 31 PID 2120 wrote to memory of 2552 2120 cmd.exe 31 PID 2552 wrote to memory of 2864 2552 rundll32.exe 33 PID 2552 wrote to memory of 2864 2552 rundll32.exe 33 PID 2552 wrote to memory of 2864 2552 rundll32.exe 33 PID 2552 wrote to memory of 2864 2552 rundll32.exe 33
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ChessBotX Trial\Books\Basic.book"1⤵
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\ChessBotX Trial\Books\Basic.book2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ChessBotX Trial\Books\Basic.book"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2864
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5f938786c539b9f585eb6fcb0437280dc
SHA10d5eaa1fff475ee06944c216ecc2779230cfef91
SHA25622a5c5d33445d12c7d5f0a8d92961ea54b2649c6787a2ebbc1ef505b8b723574
SHA512b6f8f0ca2eadbeeeb62a7ade369c352d960af32863f3bc4bb1031a2230ea4f364b29188fb5de9579f571e28f5f3b187002411ea9b92a2c55fc40a7046eb16204