Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3New folder (5).rar
windows7-x64
3New folder (5).rar
windows10-2004-x64
3New folder...es.iso
windows7-x64
3New folder...es.iso
windows10-2004-x64
3New folder...ty.iso
windows7-x64
3New folder...ty.iso
windows10-2004-x64
3New folder...FO.txt
windows7-x64
1New folder...FO.txt
windows10-2004-x64
1New folder...s.json
windows7-x64
3New folder...s.json
windows10-2004-x64
3New folder...ect.js
windows7-x64
3New folder...ect.js
windows10-2004-x64
3New folder...DS.cdn
windows7-x64
3New folder...DS.cdn
windows10-2004-x64
3New folder...gR.dll
windows7-x64
1New folder...gR.dll
windows10-2004-x64
1New folder...NT.txt
windows7-x64
1New folder...NT.txt
windows10-2004-x64
1New folder...er.exe
windows7-x64
7New folder...er.exe
windows10-2004-x64
10Stub.pyc
windows7-x64
3Stub.pyc
windows10-2004-x64
3Analysis
-
max time kernel
143s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06/09/2024, 07:24
Behavioral task
behavioral1
Sample
New folder (5).rar
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
New folder (5).rar
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
New folder (5)/GUI/Frames.iso
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
New folder (5)/GUI/Frames.iso
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
New folder (5)/GUI/Quality.iso
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
New folder (5)/GUI/Quality.iso
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
New folder (5)/INFO.txt
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
New folder (5)/INFO.txt
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
New folder (5)/Loader/Frames.json
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
New folder (5)/Loader/Frames.json
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
New folder (5)/Loader/Gui Connect.js
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
New folder (5)/Loader/Gui Connect.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
New folder (5)/Loader/key_format/KeyBINDS.cdn
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
New folder (5)/Loader/key_format/KeyBINDS.cdn
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
New folder (5)/QllzgR.dll
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
New folder (5)/QllzgR.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
New folder (5)/READ ME!!/DEVELOPMENT.txt
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
New folder (5)/READ ME!!/DEVELOPMENT.txt
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
New folder (5)/Skin Changer.exe
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
New folder (5)/Skin Changer.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
Stub.pyc
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
Stub.pyc
Resource
win10v2004-20240802-en
General
-
Target
New folder (5).rar
-
Size
11.9MB
-
MD5
4a0dd87c4fb8026a8784e923241d6f68
-
SHA1
3917c019bbf82012168e25991cc49d69ea6a0f9f
-
SHA256
03c83b3f458226a90a644b6894608c3d46c59cda2e62fd8654a7bfb1af241d36
-
SHA512
bb868b1657d492f032e19a5596e9277900ae494561652697581e88db6344f8a6e6b0344b8acb3bf47e78b4bce2536f508989a9cec1510920143e1fc692feef85
-
SSDEEP
196608:bUgWXJKju18YRhUm5mFKaREp8tpDJrQN1Pm55P8VhLtD5XZQqtk4JieCY:bUg8KKuHEDKFW1+antk4JSY
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2248 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2248 vlc.exe -
Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 2248 vlc.exe 2248 vlc.exe 2248 vlc.exe 2248 vlc.exe 2248 vlc.exe 2248 vlc.exe 2248 vlc.exe 2248 vlc.exe -
Suspicious use of SendNotifyMessage 7 IoCs
pid Process 2248 vlc.exe 2248 vlc.exe 2248 vlc.exe 2248 vlc.exe 2248 vlc.exe 2248 vlc.exe 2248 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2248 vlc.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3044 wrote to memory of 1968 3044 cmd.exe 31 PID 3044 wrote to memory of 1968 3044 cmd.exe 31 PID 3044 wrote to memory of 1968 3044 cmd.exe 31 PID 1968 wrote to memory of 2764 1968 rundll32.exe 32 PID 1968 wrote to memory of 2764 1968 rundll32.exe 32 PID 1968 wrote to memory of 2764 1968 rundll32.exe 32 PID 2764 wrote to memory of 2248 2764 rundll32.exe 35 PID 2764 wrote to memory of 2248 2764 rundll32.exe 35 PID 2764 wrote to memory of 2248 2764 rundll32.exe 35
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\New folder (5).rar"1⤵
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\New folder (5).rar2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\New folder (5).rar3⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\New folder (5).rar"4⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2248
-
-
-