Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
429s -
max time network
1148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
01/10/2024, 13:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
OLOLOOL.rar
Resource
win10v2004-20240802-en
8 signatures
1200 seconds
General
-
Target
OLOLOOL.rar
-
Size
5.7MB
-
MD5
1460cab7bc62c6488d353c616281c0c8
-
SHA1
57ba4969d7c901e311ba1b4435fc3404d68e6973
-
SHA256
3d9ad6869f983f2e75b52b0f12a9dfc6edaf1599929456c6a81d169c65d705fd
-
SHA512
ac34e7e3594827b374a3c0a68346126496bb15e9d0f301f22a36a937d0d1c350461025db6d3384ff240afe3d4c1a85cb67b09cc2a1ac072cb0d307cfd81c5d9d
-
SSDEEP
98304:utjv4BoEtg2DCepI+7lId2dOtbjSF+WVguPVtppHTdZMi0FBOsPGS1Xiq3I5I:utr4BoEtDDppIMIjSIWuudLSiDsu6iy/
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings OpenWith.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 552 NOTEPAD.EXE -
Suspicious behavior: GetForegroundWindowSpam 3 IoCs
pid Process 4200 OpenWith.exe 3572 7zFM.exe 3400 7zFM.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 3400 7zFM.exe Token: 35 3400 7zFM.exe Token: SeRestorePrivilege 3572 7zFM.exe Token: 35 3572 7zFM.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3400 7zFM.exe -
Suspicious use of SetWindowsHookEx 31 IoCs
pid Process 4200 OpenWith.exe 4200 OpenWith.exe 4200 OpenWith.exe 4200 OpenWith.exe 4200 OpenWith.exe 4200 OpenWith.exe 4200 OpenWith.exe 4200 OpenWith.exe 4200 OpenWith.exe 4200 OpenWith.exe 4200 OpenWith.exe 4200 OpenWith.exe 4200 OpenWith.exe 4200 OpenWith.exe 4200 OpenWith.exe 4200 OpenWith.exe 4200 OpenWith.exe 4200 OpenWith.exe 4200 OpenWith.exe 4200 OpenWith.exe 4200 OpenWith.exe 4200 OpenWith.exe 4200 OpenWith.exe 4200 OpenWith.exe 4200 OpenWith.exe 4200 OpenWith.exe 4200 OpenWith.exe 4200 OpenWith.exe 4200 OpenWith.exe 4200 OpenWith.exe 4200 OpenWith.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4200 wrote to memory of 552 4200 OpenWith.exe 88 PID 4200 wrote to memory of 552 4200 OpenWith.exe 88
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\OLOLOOL.rar1⤵
- Modifies registry class
PID:3772
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\OLOLOOL.rar2⤵
- Opens file in notepad (likely ransom note)
PID:552
-
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3400
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3572