Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10Jules (2).zip
windows7-x64
1Jules (2).zip
windows10-2004-x64
1Jules/Mona...ng.css
windows7-x64
3Jules/Mona...ng.css
windows10-2004-x64
7Jules/Mona...et.css
windows7-x64
3Jules/Mona...et.css
windows10-2004-x64
7Jules/Mona...on.css
windows7-x64
3Jules/Mona...on.css
windows10-2004-x64
7Jules/Mona...et.css
windows7-x64
3Jules/Mona...et.css
windows10-2004-x64
7Jules/Mona...ks.css
windows7-x64
3Jules/Mona...ks.css
windows10-2004-x64
7Jules/Mona...er.css
windows7-x64
3Jules/Mona...er.css
windows10-2004-x64
7Jules/Mona...ts.css
windows7-x64
3Jules/Mona...ts.css
windows10-2004-x64
7Jules/Mona...et.css
windows7-x64
3Jules/Mona...et.css
windows10-2004-x64
7Jules/Mona...ld.css
windows7-x64
3Jules/Mona...ld.css
windows10-2004-x64
7Jules/Mona...on.css
windows7-x64
3Jules/Mona...on.css
windows10-2004-x64
7Jules/Mona...st.css
windows7-x64
3Jules/Mona...st.css
windows10-2004-x64
7Jules/Mona...et.css
windows7-x64
3Jules/Mona...et.css
windows10-2004-x64
7Jules/Mona...i.d.ts
windows7-x64
1Jules/Mona...i.d.ts
windows10-2004-x64
6Jules/Mona...lp.css
windows7-x64
3Jules/Mona...lp.css
windows10-2004-x64
7Jules/Mona...rd.css
windows7-x64
3Jules/Mona...rd.css
windows10-2004-x64
7Analysis
-
max time kernel
131s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
11/09/2024, 18:22
Behavioral task
behavioral1
Sample
Jules (2).zip
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Jules (2).zip
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Jules/Monaco/package/esm/vs/editor/contrib/folding/folding.css
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Jules/Monaco/package/esm/vs/editor/contrib/folding/folding.css
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
Jules/Monaco/package/esm/vs/editor/contrib/gotoError/media/gotoErrorWidget.css
Resource
win7-20240729-en
Behavioral task
behavioral6
Sample
Jules/Monaco/package/esm/vs/editor/contrib/gotoError/media/gotoErrorWidget.css
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
Jules/Monaco/package/esm/vs/editor/contrib/gotoSymbol/link/goToDefinitionAtPosition.css
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
Jules/Monaco/package/esm/vs/editor/contrib/gotoSymbol/link/goToDefinitionAtPosition.css
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
Jules/Monaco/package/esm/vs/editor/contrib/gotoSymbol/peek/referencesWidget.css
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
Jules/Monaco/package/esm/vs/editor/contrib/gotoSymbol/peek/referencesWidget.css
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
Jules/Monaco/package/esm/vs/editor/contrib/links/links.css
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
Jules/Monaco/package/esm/vs/editor/contrib/links/links.css
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
Jules/Monaco/package/esm/vs/editor/contrib/message/messageController.css
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
Jules/Monaco/package/esm/vs/editor/contrib/message/messageController.css
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
Jules/Monaco/package/esm/vs/editor/contrib/parameterHints/parameterHints.css
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
Jules/Monaco/package/esm/vs/editor/contrib/parameterHints/parameterHints.css
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
Jules/Monaco/package/esm/vs/editor/contrib/peekView/media/peekViewWidget.css
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
Jules/Monaco/package/esm/vs/editor/contrib/peekView/media/peekViewWidget.css
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
Jules/Monaco/package/esm/vs/editor/contrib/rename/renameInputField.css
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
Jules/Monaco/package/esm/vs/editor/contrib/rename/renameInputField.css
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
Jules/Monaco/package/esm/vs/editor/contrib/snippet/snippetSession.css
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
Jules/Monaco/package/esm/vs/editor/contrib/snippet/snippetSession.css
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
Jules/Monaco/package/esm/vs/editor/contrib/suggest/media/suggest.css
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
Jules/Monaco/package/esm/vs/editor/contrib/suggest/media/suggest.css
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
Jules/Monaco/package/esm/vs/editor/contrib/zoneWidget/zoneWidget.css
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
Jules/Monaco/package/esm/vs/editor/contrib/zoneWidget/zoneWidget.css
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
Jules/Monaco/package/esm/vs/editor/editor.api.d.ts
Resource
win7-20240704-en
Behavioral task
behavioral28
Sample
Jules/Monaco/package/esm/vs/editor/editor.api.d.ts
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
Jules/Monaco/package/esm/vs/editor/standalone/browser/accessibilityHelp/accessibilityHelp.css
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
Jules/Monaco/package/esm/vs/editor/standalone/browser/accessibilityHelp/accessibilityHelp.css
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
Jules/Monaco/package/esm/vs/editor/standalone/browser/iPadShowKeyboard/iPadShowKeyboard.css
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
Jules/Monaco/package/esm/vs/editor/standalone/browser/iPadShowKeyboard/iPadShowKeyboard.css
Resource
win10v2004-20240802-en
General
-
Target
Jules/Monaco/package/esm/vs/editor/contrib/gotoSymbol/link/goToDefinitionAtPosition.css
-
Size
448B
-
MD5
4acd1d71543b14c3f0df0088bce0ff79
-
SHA1
23c9c52525a1a9c96e07025b7f4afd018d49a5d4
-
SHA256
4c8328ea1e5e344a1b5b0caeb89a5b1652eef6493dac5edf37b2f40e3752630d
-
SHA512
87aec2095a982dd8eb94515f5434b9610b1bec2456b70cdfff57a666802beeb8618c5e557b9a19d1d7a1cec8ceae5a6d9b735602f9908a4e10286fa4601f68f7
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings cmd.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 4728 NOTEPAD.EXE -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 796 wrote to memory of 4728 796 cmd.exe 87 PID 796 wrote to memory of 4728 796 cmd.exe 87
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Jules\Monaco\package\esm\vs\editor\contrib\gotoSymbol\link\goToDefinitionAtPosition.css1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Jules\Monaco\package\esm\vs\editor\contrib\gotoSymbol\link\goToDefinitionAtPosition.css2⤵
- Opens file in notepad (likely ransom note)
PID:4728
-