Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
68s -
max time network
93s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
05/09/2024, 12:29
General
-
Target
https://reformedtundra.itch.io/windows-12-exe
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
-
Drops file in Windows directory 55 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks SCSI registry key(s) 3 TTPs 20 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Modifies registry class 64 IoCs
-
NTFS ADS 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 10 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
-
Suspicious use of WriteProcessMemory 21 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\LaunchWinApp.exe"C:\Windows\system32\LaunchWinApp.exe" "https://reformedtundra.itch.io/windows-12-exe"1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
- NTFS ADS
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\PickerHost.exeC:\Windows\System32\PickerHost.exe -Embedding1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" C:\Windows\system32\devmgmt.msc1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD51bfe591a4fe3d91b03cdf26eaacd8f89
SHA1719c37c320f518ac168c86723724891950911cea
SHA2569cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8
SHA51202f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db
-
Filesize
74KB
MD5d4fc49dc14f63895d997fa4940f24378
SHA13efb1437a7c5e46034147cbbc8db017c69d02c31
SHA256853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1
SHA512cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a
-
Filesize
111KB
MD55367c161f00ba356d8b143ede4d78591
SHA19dbfc6218a65e8dbe0be21eb46081d9d8fe02c65
SHA2569da2294cc3da6275d5b88076abb0cb068f9a7b5a18f62a564ecd3a1caba920c1
SHA512eb1e3d4b05105768ea24b13a4fea5ae5baec71b476175ea27f8b139d9858186c0f011989e10f55aeb7cdbdcbe25b85d532f61d49df79a3259fd9dcd4be860eea
-
Filesize
22KB
MD550ae60d621c698f2993752e5525a7791
SHA1579534d05690d381130410e3caafccc1a4569da1
SHA256526a6d6740bf408dce3e6671745b3cfd5a953c8632faf523dabd38d068087360
SHA512f348d52cc85c769dbe943ef7de58513c5082b1d84060ab94b706b78b9f379a56d00f69207414e20ca0f21e405ac5386ad379ea0702894ae0cbe726f9f8191165
-
Filesize
275KB
MD55da73cd27fb5b7f608d9ee21f88cea72
SHA1cb066afbe562a8e024c2f60c2ca77efb3b1107ce
SHA256f682b6b630d27f15c9c16d5539d1c56bd03646b635162f4ee42f90a09884c124
SHA51283f494cae9714c57eaeafcc477ebb2cdb118f6ed9ea9247443ca6d73e3ac9978383e195385587334d5d1a96084ffb302dfd191a53e47525ba206ad4c1ff4ed14
-
Filesize
22KB
MD57fbbfd1610770d594aef639cfefdd0b0
SHA1e8e478141c6bea23ed8f1b52b7062eebbafb29f0
SHA256ead13ccfbdea5462c3af37aa6ae04e64ed65a31c33f76e46da5e86ec85c52064
SHA5120b4a872e56961cdd20208fd631dc45175fb7b0475c2047a9df9297be87dd050cd980fbb170b09a144839c20900456b8837374954cd53efefece7b9fe05b2ddbd
-
Filesize
21KB
MD5f2de2c6ec69b0c11f1bc44c5348c2f35
SHA135380c04729ff2041e192756bea3052e7de2c5d0
SHA256abde463ef27458713d91e9be883fdd389298ef57411b601cab5f66db609c508d
SHA512847a73f219b215d03fac4335720d7be8ed6ec479e4a83d1c2d5e980f3572a54b8d2fff5ff117be6575c3d982c6e20ee01564dfae0290e70576ee0acc2b998259
-
Filesize
543KB
MD535734e32bdc368e334783651eb578de5
SHA11440e6752807f2a1579d66485a90479d704907e6
SHA256b6289cded72f192a300ff93332b5671d754c4bf98aa326e9f180b3f2d2347b88
SHA51227c9514a4c2f5f9f60eb80f79d2aae8137ae7a9d9e65803bc36daed3e4c747d1e53bc4b3f29dbc798044f8572acdb8193724018d6643e4a2bd3f2c17bd458b75
-
Filesize
23KB
MD5b45e52f342dc29c8553f51a99f924871
SHA184ffaa7306ce72dc9dce975454298b91dc4d00be
SHA25688f15027c3aadf50ab39cea089b1f8aa3a18da7c47b30569c1f7489470c05292
SHA512d4eaa02b2b16f047658b14250f1531e1b90f3575bc7a084f06ba772c24e1436be4f223dfe784b0a5956d039ba385f2b7c1697d51c8d3a568d1bc6ebc9c99a726
-
Filesize
22KB
MD5f1a4a058fbba1e35a406188ae7eddaf8
SHA1e5e25503a9a6976e3ac4b1893a767c8a7a72eba0
SHA2561670565574aab8aa0a287a4cd8f49cf0d8b0959ebe344f90ca8af696ede9c23b
SHA512c0f3138f59034f26f89a7bee8a3a0af749c4dd119997ca121121ff19a35e690098ddd6e4d022d86a81783837fea39aa66d47cac1b19127cda5a0b1355714fa75
-
Filesize
124KB
MD5207451926a991de4adc16e6c64aab430
SHA160cb4c06d1714eab643a99a56fbb890a1aba421f
SHA2560451ab174857156c1abb1a91baa9c569591defd2ca5a20fc4f8f78f4f6b1320e
SHA51250f2f4a8d717cd4c13dc88611112d91079cf6b3d59e449bae7bcad0dca019070e1bf6b6849c2de072b9b6db496e0a7c7a43fce2d668d8e36c0bfbb57f0c5d15d
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
2KB
MD59f1421643d651ffbe419cc07534ae63f
SHA151ee1eaa853ee699c0499df5b227b294f46dfd62
SHA2567a71b0515807f3b7f2a7067bbf2e369e61e708257c931f5a17aceaf551be8b8d
SHA512b636516921f72eb5c709f5e20f9f5006927c3cf1b4bd125b8fdad4f7bea43ee7b5c5d4fccc956d403662af10c22b70e9192ac1f9da107a47158f9c5b6f797538
-
Filesize
5KB
MD59a3fe3a8b81bbf459c98753295394945
SHA10549a475c5fce345669877802f80eeffadfa6fff
SHA256f5392ebf26bc5e9599340a9e5cef6644629b2b43bdbeb5c03e8382aaab7ef165
SHA5121e4978397370430859b3c3c8f18015ec040fa8f1e15ea5086ffba069bacd537255c7ec9409117a2a27fd401c6b90a27f586183360680915dbed75cdf57a430ec
-
Filesize
524KB
MD5afae8c18eef5d9a0c49f3bda845575a4
SHA1a3c615b2f57357f45ad141264dd5d0d4278012c6
SHA25682f45f430f9d5d4821c528d51ee45948456e274593747dde2c5af8257dac15c9
SHA512161f8bbbf22b3b382f4d7abf3e1193645875be6652da830853e6cda3f74bb5ddc4d14535771da6523d2d83039e877cc04b7f241c60b16b45a5398a87cf266312
-
Filesize
1024KB
-
Filesize
64KB
-
Filesize
1024KB
-
Filesize
128KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
1024KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
64KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
64KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
1024KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
64KB
