Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

21/09/2024, 13:26

240921-qpjehathrc 3

21/09/2024, 13:03

240921-qaeg1atell 3

Analysis

  • max time kernel
    143s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    21/09/2024, 13:03

General

  • Target

    S.tup-1ucnh3r.rar

  • Size

    20.4MB

  • MD5

    3de951d84fc054adba8ad6a9de01283c

  • SHA1

    8b35da11fafd3fda2b48680063d0bd7fbd6203be

  • SHA256

    545db3182e129e42cae3c7c99b0700faaef01f806113d533d8ede8fc85dea916

  • SHA512

    f9ab4d23521afc2318e95aebe541d4877693ee88cc371790550f2d1e0fffe3cb6e358458a8f5b95434556210a56b0e630339d056e5915a4dabc3fcef5b2a7aac

  • SSDEEP

    393216:juPoaJAQiuLSwS/NZ4gyThsJNKtnZyHDGmUDNClCAw+PlssJYuL2DIjzaD43vbQB:COCfS/NZJyTh8NK9ZyypDNCl4+hYuL2B

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 9 IoCs
  • Suspicious use of SendNotifyMessage 8 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\S.tup-1ucnh3r.rar
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2312
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\S.tup-1ucnh3r.rar
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2888
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\S.tup-1ucnh3r.rar
        3⤵
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:3060
        • C:\Program Files\VideoLAN\VLC\vlc.exe
          "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\S.tup-1ucnh3r.rar"
          4⤵
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:2260

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2260-30-0x000007FEFB4F0000-0x000007FEFB524000-memory.dmp

    Filesize

    208KB

  • memory/2260-29-0x000000013F910000-0x000000013FA08000-memory.dmp

    Filesize

    992KB

  • memory/2260-32-0x000007FEFB560000-0x000007FEFB578000-memory.dmp

    Filesize

    96KB

  • memory/2260-33-0x000007FEFB2E0000-0x000007FEFB2F7000-memory.dmp

    Filesize

    92KB

  • memory/2260-35-0x000007FEFB2A0000-0x000007FEFB2B7000-memory.dmp

    Filesize

    92KB

  • memory/2260-34-0x000007FEFB2C0000-0x000007FEFB2D1000-memory.dmp

    Filesize

    68KB

  • memory/2260-36-0x000007FEFB280000-0x000007FEFB291000-memory.dmp

    Filesize

    68KB

  • memory/2260-37-0x000007FEFB260000-0x000007FEFB27D000-memory.dmp

    Filesize

    116KB

  • memory/2260-38-0x000007FEF7C80000-0x000007FEF7C91000-memory.dmp

    Filesize

    68KB

  • memory/2260-31-0x000007FEF6830000-0x000007FEF6AE6000-memory.dmp

    Filesize

    2.7MB

  • memory/2260-42-0x000007FEF7B40000-0x000007FEF7B61000-memory.dmp

    Filesize

    132KB

  • memory/2260-44-0x000007FEF7B00000-0x000007FEF7B11000-memory.dmp

    Filesize

    68KB

  • memory/2260-49-0x000007FEF6490000-0x000007FEF64A8000-memory.dmp

    Filesize

    96KB

  • memory/2260-40-0x000007FEF64F0000-0x000007FEF66FB000-memory.dmp

    Filesize

    2.0MB

  • memory/2260-41-0x000007FEF7C30000-0x000007FEF7C71000-memory.dmp

    Filesize

    260KB

  • memory/2260-47-0x000007FEF64D0000-0x000007FEF64EB000-memory.dmp

    Filesize

    108KB

  • memory/2260-48-0x000007FEF64B0000-0x000007FEF64C1000-memory.dmp

    Filesize

    68KB

  • memory/2260-52-0x000007FEF6370000-0x000007FEF63EC000-memory.dmp

    Filesize

    496KB

  • memory/2260-67-0x000007FEF2C20000-0x000007FEF2C4F000-memory.dmp

    Filesize

    188KB

  • memory/2260-69-0x000007FEF2BE0000-0x000007FEF2BF6000-memory.dmp

    Filesize

    88KB

  • memory/2260-68-0x000007FEF2C00000-0x000007FEF2C11000-memory.dmp

    Filesize

    68KB

  • memory/2260-66-0x000007FEFB5C0000-0x000007FEFB5D0000-memory.dmp

    Filesize

    64KB

  • memory/2260-65-0x000007FEF2CC0000-0x000007FEF2CD7000-memory.dmp

    Filesize

    92KB

  • memory/2260-64-0x000007FEF2CE0000-0x000007FEF2CF1000-memory.dmp

    Filesize

    68KB

  • memory/2260-63-0x000007FEFAE90000-0x000007FEFAEB1000-memory.dmp

    Filesize

    132KB

  • memory/2260-62-0x000007FEF47B0000-0x000007FEF47C1000-memory.dmp

    Filesize

    68KB

  • memory/2260-61-0x000007FEF48D0000-0x000007FEF48E1000-memory.dmp

    Filesize

    68KB

  • memory/2260-60-0x000007FEF61B0000-0x000007FEF61C2000-memory.dmp

    Filesize

    72KB

  • memory/2260-59-0x000007FEF6220000-0x000007FEF6231000-memory.dmp

    Filesize

    68KB

  • memory/2260-70-0x000007FEF2B10000-0x000007FEF2BD5000-memory.dmp

    Filesize

    788KB

  • memory/2260-58-0x000007FEF6240000-0x000007FEF6263000-memory.dmp

    Filesize

    140KB

  • memory/2260-57-0x000007FEF6270000-0x000007FEF6288000-memory.dmp

    Filesize

    96KB

  • memory/2260-74-0x000007FEF2860000-0x000007FEF29E0000-memory.dmp

    Filesize

    1.5MB

  • memory/2260-73-0x000007FEF29E0000-0x000007FEF2A4D000-memory.dmp

    Filesize

    436KB

  • memory/2260-72-0x000007FEF2A50000-0x000007FEF2AB2000-memory.dmp

    Filesize

    392KB

  • memory/2260-71-0x000007FEF2AC0000-0x000007FEF2B02000-memory.dmp

    Filesize

    264KB

  • memory/2260-56-0x000007FEF6290000-0x000007FEF62B4000-memory.dmp

    Filesize

    144KB

  • memory/2260-55-0x000007FEF62C0000-0x000007FEF62E8000-memory.dmp

    Filesize

    160KB

  • memory/2260-54-0x000007FEF62F0000-0x000007FEF6347000-memory.dmp

    Filesize

    348KB

  • memory/2260-53-0x000007FEF6350000-0x000007FEF6361000-memory.dmp

    Filesize

    68KB

  • memory/2260-51-0x000007FEF63F0000-0x000007FEF6457000-memory.dmp

    Filesize

    412KB

  • memory/2260-50-0x000007FEF6460000-0x000007FEF6490000-memory.dmp

    Filesize

    192KB

  • memory/2260-46-0x000007FEF6F60000-0x000007FEF6F71000-memory.dmp

    Filesize

    68KB

  • memory/2260-45-0x000007FEF7510000-0x000007FEF7521000-memory.dmp

    Filesize

    68KB

  • memory/2260-43-0x000007FEF7B20000-0x000007FEF7B38000-memory.dmp

    Filesize

    96KB

  • memory/2260-39-0x000007FEF50A0000-0x000007FEF6150000-memory.dmp

    Filesize

    16.7MB