Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    06/09/2024, 07:24

General

  • Target

    New folder (5).rar

  • Size

    11.9MB

  • MD5

    4a0dd87c4fb8026a8784e923241d6f68

  • SHA1

    3917c019bbf82012168e25991cc49d69ea6a0f9f

  • SHA256

    03c83b3f458226a90a644b6894608c3d46c59cda2e62fd8654a7bfb1af241d36

  • SHA512

    bb868b1657d492f032e19a5596e9277900ae494561652697581e88db6344f8a6e6b0344b8acb3bf47e78b4bce2536f508989a9cec1510920143e1fc692feef85

  • SSDEEP

    196608:bUgWXJKju18YRhUm5mFKaREp8tpDJrQN1Pm55P8VhLtD5XZQqtk4JieCY:bUg8KKuHEDKFW1+antk4JSY

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\New folder (5).rar"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3044
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\New folder (5).rar
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1968
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\New folder (5).rar
        3⤵
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:2764
        • C:\Program Files\VideoLAN\VLC\vlc.exe
          "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\New folder (5).rar"
          4⤵
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:2248

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2248-29-0x000000013F170000-0x000000013F268000-memory.dmp

    Filesize

    992KB

  • memory/2248-30-0x000007FEFAD50000-0x000007FEFAD84000-memory.dmp

    Filesize

    208KB

  • memory/2248-32-0x000007FEFAD30000-0x000007FEFAD48000-memory.dmp

    Filesize

    96KB

  • memory/2248-33-0x000007FEFAD10000-0x000007FEFAD27000-memory.dmp

    Filesize

    92KB

  • memory/2248-35-0x000007FEFACD0000-0x000007FEFACE7000-memory.dmp

    Filesize

    92KB

  • memory/2248-34-0x000007FEFACF0000-0x000007FEFAD01000-memory.dmp

    Filesize

    68KB

  • memory/2248-31-0x000007FEF5FE0000-0x000007FEF6296000-memory.dmp

    Filesize

    2.7MB

  • memory/2248-36-0x000007FEFA960000-0x000007FEFA971000-memory.dmp

    Filesize

    68KB

  • memory/2248-37-0x000007FEF7A90000-0x000007FEF7AAD000-memory.dmp

    Filesize

    116KB

  • memory/2248-38-0x000007FEF77F0000-0x000007FEF7801000-memory.dmp

    Filesize

    68KB

  • memory/2248-39-0x000007FEF5CA0000-0x000007FEF5EAB000-memory.dmp

    Filesize

    2.0MB

  • memory/2248-45-0x000007FEF6C60000-0x000007FEF6C71000-memory.dmp

    Filesize

    68KB

  • memory/2248-44-0x000007FEF6C80000-0x000007FEF6C91000-memory.dmp

    Filesize

    68KB

  • memory/2248-43-0x000007FEF6CA0000-0x000007FEF6CB8000-memory.dmp

    Filesize

    96KB

  • memory/2248-42-0x000007FEF77C0000-0x000007FEF77E1000-memory.dmp

    Filesize

    132KB

  • memory/2248-41-0x000007FEF6CC0000-0x000007FEF6D01000-memory.dmp

    Filesize

    260KB

  • memory/2248-48-0x000007FEF6660000-0x000007FEF6671000-memory.dmp

    Filesize

    68KB

  • memory/2248-52-0x000007FEF4AD0000-0x000007FEF4B4C000-memory.dmp

    Filesize

    496KB

  • memory/2248-62-0x000007FEF3CA0000-0x000007FEF3CB8000-memory.dmp

    Filesize

    96KB

  • memory/2248-61-0x000007FEF3D20000-0x000007FEF3D31000-memory.dmp

    Filesize

    68KB

  • memory/2248-60-0x000007FEF4960000-0x000007FEF4972000-memory.dmp

    Filesize

    72KB

  • memory/2248-59-0x000007FEF4980000-0x000007FEF4991000-memory.dmp

    Filesize

    68KB

  • memory/2248-58-0x000007FEF49A0000-0x000007FEF49C3000-memory.dmp

    Filesize

    140KB

  • memory/2248-57-0x000007FEF49D0000-0x000007FEF49E8000-memory.dmp

    Filesize

    96KB

  • memory/2248-56-0x000007FEF49F0000-0x000007FEF4A14000-memory.dmp

    Filesize

    144KB

  • memory/2248-55-0x000007FEF4A20000-0x000007FEF4A48000-memory.dmp

    Filesize

    160KB

  • memory/2248-53-0x000007FEF4AB0000-0x000007FEF4AC1000-memory.dmp

    Filesize

    68KB

  • memory/2248-51-0x000007FEF4B50000-0x000007FEF4BB7000-memory.dmp

    Filesize

    412KB

  • memory/2248-50-0x000007FEF4BC0000-0x000007FEF4BF0000-memory.dmp

    Filesize

    192KB

  • memory/2248-49-0x000007FEF6640000-0x000007FEF6658000-memory.dmp

    Filesize

    96KB

  • memory/2248-40-0x000007FEF4BF0000-0x000007FEF5CA0000-memory.dmp

    Filesize

    16.7MB

  • memory/2248-54-0x000007FEF4A50000-0x000007FEF4AA7000-memory.dmp

    Filesize

    348KB

  • memory/2248-47-0x000007FEF6C20000-0x000007FEF6C3B000-memory.dmp

    Filesize

    108KB

  • memory/2248-46-0x000007FEF6C40000-0x000007FEF6C51000-memory.dmp

    Filesize

    68KB