Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
429s -
max time network
1148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
01/10/2024, 13:00
General
-
Target
OLOLOOL.rar
-
Size
5.7MB
-
MD5
1460cab7bc62c6488d353c616281c0c8
-
SHA1
57ba4969d7c901e311ba1b4435fc3404d68e6973
-
SHA256
3d9ad6869f983f2e75b52b0f12a9dfc6edaf1599929456c6a81d169c65d705fd
-
SHA512
ac34e7e3594827b374a3c0a68346126496bb15e9d0f301f22a36a937d0d1c350461025db6d3384ff240afe3d4c1a85cb67b09cc2a1ac072cb0d307cfd81c5d9d
-
SSDEEP
98304:utjv4BoEtg2DCepI+7lId2dOtbjSF+WVguPVtppHTdZMi0FBOsPGS1Xiq3I5I:utr4BoEtDDppIMIjSIWuudLSiDsu6iy/
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 31 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\OLOLOOL.rar1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\OLOLOOL.rar2⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken