Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    25/09/2024, 18:12

General

  • Target

    Oblivity.rar

  • Size

    226.3MB

  • MD5

    4e2535ab5686062ebc7feb7efcd6558c

  • SHA1

    fc47e38dd4da5de9d2c6a68a8cf0c45e4beb9a7e

  • SHA256

    2cb8c7061773b62038fc601d72d770c384062963f729ad4ca717ce3ce7c15555

  • SHA512

    2725fc9bb3de396505f1ceea18231e53aa375899368cdbabc2b81114648d53b5c53eafd10635599f527fefe9e60ceb5694b6b4dafffa701a4fd3e777ebdd1115

  • SSDEEP

    6291456:l4a+6GvqXok7j9GvZG6gpRogFLL5aReRVKM+NQ0T/L7KANgR:6a+6GvWosIvYLXLc4H+NtL7KAeR

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 9 IoCs
  • Suspicious use of SendNotifyMessage 8 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Oblivity.rar
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2088
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Oblivity.rar
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2880
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Oblivity.rar
        3⤵
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:2756
        • C:\Program Files\VideoLAN\VLC\vlc.exe
          "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Oblivity.rar"
          4⤵
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:2828

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2828-30-0x000007FEFA9B0000-0x000007FEFA9E4000-memory.dmp

    Filesize

    208KB

  • memory/2828-29-0x000000013F2A0000-0x000000013F398000-memory.dmp

    Filesize

    992KB

  • memory/2828-32-0x000007FEFA990000-0x000007FEFA9A8000-memory.dmp

    Filesize

    96KB

  • memory/2828-38-0x000007FEF7460000-0x000007FEF7471000-memory.dmp

    Filesize

    68KB

  • memory/2828-37-0x000007FEF7480000-0x000007FEF749D000-memory.dmp

    Filesize

    116KB

  • memory/2828-36-0x000007FEFA640000-0x000007FEFA651000-memory.dmp

    Filesize

    68KB

  • memory/2828-35-0x000007FEFA930000-0x000007FEFA947000-memory.dmp

    Filesize

    92KB

  • memory/2828-34-0x000007FEFA950000-0x000007FEFA961000-memory.dmp

    Filesize

    68KB

  • memory/2828-31-0x000007FEF5C50000-0x000007FEF5F06000-memory.dmp

    Filesize

    2.7MB

  • memory/2828-33-0x000007FEFA970000-0x000007FEFA987000-memory.dmp

    Filesize

    92KB

  • memory/2828-39-0x000007FEF5910000-0x000007FEF5B1B000-memory.dmp

    Filesize

    2.0MB

  • memory/2828-45-0x000007FEF6900000-0x000007FEF6911000-memory.dmp

    Filesize

    68KB

  • memory/2828-44-0x000007FEF6E70000-0x000007FEF6E81000-memory.dmp

    Filesize

    68KB

  • memory/2828-43-0x000007FEF7440000-0x000007FEF7458000-memory.dmp

    Filesize

    96KB

  • memory/2828-42-0x000007FEF6920000-0x000007FEF6941000-memory.dmp

    Filesize

    132KB

  • memory/2828-41-0x000007FEF6950000-0x000007FEF6991000-memory.dmp

    Filesize

    260KB

  • memory/2828-46-0x000007FEF68E0000-0x000007FEF68F1000-memory.dmp

    Filesize

    68KB

  • memory/2828-47-0x000007FEF68C0000-0x000007FEF68DB000-memory.dmp

    Filesize

    108KB

  • memory/2828-48-0x000007FEF6470000-0x000007FEF6481000-memory.dmp

    Filesize

    68KB

  • memory/2828-49-0x000007FEF6450000-0x000007FEF6468000-memory.dmp

    Filesize

    96KB

  • memory/2828-50-0x000007FEF58E0000-0x000007FEF5910000-memory.dmp

    Filesize

    192KB

  • memory/2828-55-0x000007FEF5760000-0x000007FEF5788000-memory.dmp

    Filesize

    160KB

  • memory/2828-54-0x000007FEF5790000-0x000007FEF57E7000-memory.dmp

    Filesize

    348KB

  • memory/2828-53-0x000007FEF6280000-0x000007FEF6291000-memory.dmp

    Filesize

    68KB

  • memory/2828-51-0x000007FEF5870000-0x000007FEF58D7000-memory.dmp

    Filesize

    412KB

  • memory/2828-52-0x000007FEF57F0000-0x000007FEF586C000-memory.dmp

    Filesize

    496KB

  • memory/2828-63-0x000007FEEF7A0000-0x000007FEEF90B000-memory.dmp

    Filesize

    1.4MB

  • memory/2828-40-0x000007FEF4240000-0x000007FEF52F0000-memory.dmp

    Filesize

    16.7MB

  • memory/2828-62-0x000007FEF1BE0000-0x000007FEF1C37000-memory.dmp

    Filesize

    348KB

  • memory/2828-61-0x000007FEF1C40000-0x000007FEF1C51000-memory.dmp

    Filesize

    68KB

  • memory/2828-60-0x000007FEF56A0000-0x000007FEF56B2000-memory.dmp

    Filesize

    72KB

  • memory/2828-59-0x000007FEF56C0000-0x000007FEF56D1000-memory.dmp

    Filesize

    68KB

  • memory/2828-58-0x000007FEF56E0000-0x000007FEF5703000-memory.dmp

    Filesize

    140KB

  • memory/2828-57-0x000007FEF5710000-0x000007FEF5728000-memory.dmp

    Filesize

    96KB

  • memory/2828-56-0x000007FEF5730000-0x000007FEF5754000-memory.dmp

    Filesize

    144KB

  • memory/2828-64-0x000007FEEF550000-0x000007FEEF791000-memory.dmp

    Filesize

    2.3MB