Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
6Static
static
3ChessBot_demo.zip
windows7-x64
1ChessBot_demo.zip
windows10-2004-x64
1ChessBotX ...c.book
windows7-x64
3ChessBotX ...c.book
windows10-2004-x64
3ChessBotX ...M.book
windows7-x64
3ChessBotX ...M.book
windows10-2004-x64
3ChessBotX ...ot.exe
windows7-x64
5ChessBotX ...ot.exe
windows10-2004-x64
5ChessBotX ...+0.cfg
windows7-x64
3ChessBotX ...+0.cfg
windows10-2004-x64
3ChessBotX ...y).cfg
windows7-x64
3ChessBotX ...y).cfg
windows10-2004-x64
3ChessBotX ...em.cfg
windows7-x64
3ChessBotX ...em.cfg
windows10-2004-x64
3ChessBotX ...st.ini
windows7-x64
1ChessBotX ...st.ini
windows10-2004-x64
1ChessBotX ...sh.cfg
windows7-x64
3ChessBotX ...sh.cfg
windows10-2004-x64
3ChessBotX ...32.cfg
windows7-x64
3ChessBotX ...32.cfg
windows10-2004-x64
3ChessBotX ...gs.ini
windows7-x64
1ChessBotX ...gs.ini
windows10-2004-x64
1ChessBotX ...ys.cfg
windows7-x64
3ChessBotX ...ys.cfg
windows10-2004-x64
3ChessBotX ...ts.cfg
windows7-x64
3ChessBotX ...ts.cfg
windows10-2004-x64
3ChessBotX ...s.dcfg
windows7-x64
3ChessBotX ...s.dcfg
windows10-2004-x64
3ChessBotX ...a1.mp3
windows7-x64
1ChessBotX ...a1.mp3
windows10-2004-x64
6ChessBotX ...a2.mp3
windows7-x64
1ChessBotX ...a2.mp3
windows10-2004-x64
6Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
26/08/2024, 01:18
Static task
static1
Behavioral task
behavioral1
Sample
ChessBot_demo.zip
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
ChessBot_demo.zip
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
ChessBotX Trial/Books/Basic.book
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
ChessBotX Trial/Books/Basic.book
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
ChessBotX Trial/Books/GM.book
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
ChessBotX Trial/Books/GM.book
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
ChessBotX Trial/ChessBot.exe
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
ChessBotX Trial/ChessBot.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
ChessBotX Trial/Config/Delays for bullet 1+0.cfg
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
ChessBotX Trial/Config/Delays for bullet 1+0.cfg
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
ChessBotX Trial/Config/Instant (without delay).cfg
Resource
win7-20240729-en
Behavioral task
behavioral12
Sample
ChessBotX Trial/Config/Instant (without delay).cfg
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
ChessBotX Trial/Config/system.cfg
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
ChessBotX Trial/Config/system.cfg
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
ChessBotX Trial/EngineList.ini
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
ChessBotX Trial/EngineList.ini
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
ChessBotX Trial/Engines Settings/stockfish.cfg
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
ChessBotX Trial/Engines Settings/stockfish.cfg
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
ChessBotX Trial/Engines Settings/stockfish_10_x32.cfg
Resource
win7-20240705-en
Behavioral task
behavioral20
Sample
ChessBotX Trial/Engines Settings/stockfish_10_x32.cfg
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
ChessBotX Trial/Settings.ini
Resource
win7-20240704-en
Behavioral task
behavioral22
Sample
ChessBotX Trial/Settings.ini
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
ChessBotX Trial/System/SystemDelays.cfg
Resource
win7-20240704-en
Behavioral task
behavioral24
Sample
ChessBotX Trial/System/SystemDelays.cfg
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
ChessBotX Trial/System/defaults.cfg
Resource
win7-20240708-en
Behavioral task
behavioral26
Sample
ChessBotX Trial/System/defaults.cfg
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
ChessBotX Trial/System/sys.dcfg
Resource
win7-20240704-en
Behavioral task
behavioral28
Sample
ChessBotX Trial/System/sys.dcfg
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
ChessBotX Trial/voiceover/a1.mp3
Resource
win7-20240704-en
Behavioral task
behavioral30
Sample
ChessBotX Trial/voiceover/a1.mp3
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
ChessBotX Trial/voiceover/a2.mp3
Resource
win7-20240705-en
Behavioral task
behavioral32
Sample
ChessBotX Trial/voiceover/a2.mp3
Resource
win10v2004-20240802-en
General
-
Target
ChessBotX Trial/Books/GM.book
-
Size
4.7MB
-
MD5
5ccaa1dbf9174097cc7b77a1b555abe7
-
SHA1
d7e497980d2871457c9b87cc90bbfeee90c6c350
-
SHA256
0133f35e0d1e55c266fb16e68184b5922d148cdab1f038900526362591105c7e
-
SHA512
eeb825256eea48109e6ffcec891d74dd1237f0a6381958b3b615c628d1eb6ca0a0b719b90e4909daa2b81838f4347176bd9b857187746453abc27851b1e997b5
-
SSDEEP
6144:Lp36vRbTjeCHe85MMrtXu6Hu/em+W+vjC8YJPKw7XHPjnRDrVRWD8RQV6YCYVV3h:8x0jRU5kAAoDi8H
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_Classes\Local Settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\book_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\book_auto_file\shell rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\book_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\book_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\.book rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\.book\ = "book_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\book_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\book_auto_file\shell\Read\command rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3020 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3020 AcroRd32.exe 3020 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1628 wrote to memory of 2408 1628 cmd.exe 29 PID 1628 wrote to memory of 2408 1628 cmd.exe 29 PID 1628 wrote to memory of 2408 1628 cmd.exe 29 PID 2408 wrote to memory of 3020 2408 rundll32.exe 30 PID 2408 wrote to memory of 3020 2408 rundll32.exe 30 PID 2408 wrote to memory of 3020 2408 rundll32.exe 30 PID 2408 wrote to memory of 3020 2408 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ChessBotX Trial\Books\GM.book"1⤵
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\ChessBotX Trial\Books\GM.book2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ChessBotX Trial\Books\GM.book"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3020
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5d3331ce6f175b463ad6537a7d5606414
SHA15502d3547cc879015490c518d6ac8c55f1146133
SHA2565a5edd6182c27395930e248440c4632c5b2a2826ccfe01847f291e52ca8866df
SHA512b712e4a814fa070833bdcf617adf46617ce4963f5a4e070fbf80cd5a64b820be7dc706495b594676bd5db1e2ca862f519b0ce1d968c534382ff94b429f90d1f3