Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
08/09/2024, 17:27
Static task
static1
Behavioral task
behavioral1
Sample
_Getintopc.com_ReFX_Nexus_3.4.4.rar
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
_Getintopc.com_ReFX_Nexus_3.4.4.rar
Resource
win10v2004-20240802-en
General
-
Target
_Getintopc.com_ReFX_Nexus_3.4.4.rar
-
Size
8.6MB
-
MD5
421f5d69db75ebd2280f3af213b39e87
-
SHA1
cc0ed00d01f21ddc21317f04101c26dc9f2ee0f2
-
SHA256
c53183b62670d1d9570207253fcbb96d29b568850fede53a9f27ff0812524d24
-
SHA512
b2d63574cd6eb7097e9e148196e918546401929a01c27c8c34ea5517df12abecba62b59f8da998b67a749fd16245087517f4eb9c50dd20d18a9a664d89033cf4
-
SSDEEP
196608:FZD2sG8I1BgYHX8GqKrmux50puxF7dZFPJqnt3Go8gJKh+tC:D2GgBgY38GqKrmuYpuhZFPJqnx8gpC
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1132 OpenWith.exe 1132 OpenWith.exe 1132 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\_Getintopc.com_ReFX_Nexus_3.4.4.rar1⤵
- Modifies registry class
PID:968
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1132
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:5100