Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
14/09/2024, 11:46
Static task
static1
Behavioral task
behavioral1
Sample
wordbomb-cheat-main.zip
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
wordbomb-cheat-main.zip
Resource
win10v2004-20240910-en
Behavioral task
behavioral3
Sample
wordbomb-cheat-main/README.md
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
wordbomb-cheat-main/README.md
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
wordbomb-cheat-main/script.lua
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
wordbomb-cheat-main/script.lua
Resource
win10v2004-20240910-en
General
-
Target
wordbomb-cheat-main/README.md
-
Size
277B
-
MD5
297466e784da46d97f68bf8c66a5d291
-
SHA1
781a394cf129821fc774267e44deff85d4ac84d4
-
SHA256
f70686573794512d12a1bce8bf6fbc9482ebaf772326a25154b7b51a90b884bb
-
SHA512
19bf85706c4f96771ccfd9ab4a36c1bbde0915c876a1ff97b3f95f842e50d208088961c6ac5046e9ad56cd0fc4a6a699c3b6e93429f6ac754fb2d803e488cd40
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\.md rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\.md\ = "md_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\md_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\md_auto_file\shell rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\md_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\md_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\md_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\md_auto_file\shell\Read\command rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2060 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2060 AcroRd32.exe 2060 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2872 wrote to memory of 3044 2872 cmd.exe 29 PID 2872 wrote to memory of 3044 2872 cmd.exe 29 PID 2872 wrote to memory of 3044 2872 cmd.exe 29 PID 3044 wrote to memory of 2060 3044 rundll32.exe 30 PID 3044 wrote to memory of 2060 3044 rundll32.exe 30 PID 3044 wrote to memory of 2060 3044 rundll32.exe 30 PID 3044 wrote to memory of 2060 3044 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\wordbomb-cheat-main\README.md1⤵
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\wordbomb-cheat-main\README.md2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\wordbomb-cheat-main\README.md"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2060
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5a3a4f2dfc902c6ded83a2e5bea61e379
SHA145a588abc1831ca3f54c89f079817afe0933a0b1
SHA2567a9dd09f170c50306576c69e96edeaa1a6a8d03106e3d61033199a9caa58d7d5
SHA5125ccdb85f09917afcf579f953feb1907fc5b00080c4b9985749899c0ce6bb31970b9578081d6e57eee280d0743f09c3952b9b721f8243d8a718af35da82cec87b