Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
07/09/2024, 13:39
General
-
Target
NanoCore 1.2.2.0_Cracked By Alcatraz3222.rar
-
Size
5.8MB
-
MD5
c75744769bae7a3e7a4a1aec27673851
-
SHA1
56b0aa88b44c532be4975bc096cb8e4b9e7ecb49
-
SHA256
ceb348dfa61b34bebce021fa783b0afdb874ea7205f75e7fb42b01898439be75
-
SHA512
fa0c8d0b3adbb0bf11185b6c85f38c99421ef24ce55d94674e8d999c907f323a3eb0bcf711b60298e31db2958ebfa2dafad9d01cdf1e61251018ebd717934679
-
SSDEEP
98304:5S+zg4KC/4ObL3j/ZV2tKRcHhMBJcPpylijvjTZi1UBCFCX/IxCF+/h0k98nRDdj:51kC/40z3tKMrcByIT1B2zkA/Ck92thv
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\NanoCore 1.2.2.0_Cracked By Alcatraz3222.rar"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\NanoCore 1.2.2.0_Cracked By Alcatraz3222.rar2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\NanoCore 1.2.2.0_Cracked By Alcatraz3222.rar3⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\NanoCore 1.2.2.0_Cracked By Alcatraz3222.rar"4⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
18B
MD535295f3a53b645d1dffaa680645cbe23
SHA1fd5e655e195cd00730f9a4fb0714a5e7a12932fe
SHA256183755c3d85600806e46abcfe7ee824c7adfa2a21a009f02f2016f5fc1c7038d
SHA512f70f6a24c6aaf1912bf8c8e168009aa37a0d529a2da3b6fac06c8083a2546955e20084a3a9ec2c231e581b5ddb7f479fda3aa6cc8f8303438362cd51c5b7b8f1
-
Filesize
208KB
-
Filesize
992KB
-
Filesize
92KB
-
Filesize
96KB
-
Filesize
92KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
116KB
-
Filesize
2.7MB
-
Filesize
2.0MB
-
Filesize
132KB
-
Filesize
96KB
-
Filesize
260KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
108KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
96KB
-
Filesize
192KB
-
Filesize
68KB
-
Filesize
412KB
-
Filesize
96KB
-
Filesize
68KB
-
Filesize
72KB
-
Filesize
68KB
-
Filesize
140KB
-
Filesize
144KB
-
Filesize
160KB
-
Filesize
348KB
-
Filesize
1.5MB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
496KB
-
Filesize
72KB
-
Filesize
96KB
-
Filesize
88KB
-
Filesize
168KB
-
Filesize
72KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
188KB
-
Filesize
348KB
-
Filesize
76KB
-
Filesize
68KB
-
Filesize
788KB
-
Filesize
68KB
-
Filesize
80KB
-
Filesize
72KB
-
Filesize
80KB
-
Filesize
76KB
-
Filesize
120KB
-
Filesize
80KB
-
Filesize
176KB
-
Filesize
76KB
-
Filesize
68KB
-
Filesize
88KB
-
Filesize
64KB
-
Filesize
72KB
-
Filesize
88KB
-
Filesize
196KB
-
Filesize
84KB
-
Filesize
92KB