Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    357s
  • max time network
    358s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    22/11/2024, 03:20

General

  • Target

    d5f29750a8cb158d9b89a1e02e8addc5e410d1ddc48e660589144ade47f794c5.apk

  • Size

    1.7MB

  • MD5

    187f7d5ae06b386581f5f177340ca2b7

  • SHA1

    0f25cefa85a0822a08ad23caca24a622fbf4aef0

  • SHA256

    d5f29750a8cb158d9b89a1e02e8addc5e410d1ddc48e660589144ade47f794c5

  • SHA512

    682d127bf1ffc42cc475f119a010eeb12460ca2e9a8fbc8a0207e3ee8912ed0c8a0fcea374c83e91f494cba2bc378173f1833b3b4f5913b622279da2c0f62248

  • SSDEEP

    49152:BATnMeAX+Iexb7peltHmeOCbJOIOUCZKw:BeMtU7pMHVZJOzTB

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\d5f29750a8cb158d9b89a1e02e8addc5e410d1ddc48e660589144ade47f794c5.apk
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2604
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\d5f29750a8cb158d9b89a1e02e8addc5e410d1ddc48e660589144ade47f794c5.apk
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2860
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\d5f29750a8cb158d9b89a1e02e8addc5e410d1ddc48e660589144ade47f794c5.apk"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2892

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    d4f9f38d4c30a012e3a9d24957e3a948

    SHA1

    c038f96b9493bbeb43aeffa0bffc462a796725ee

    SHA256

    046fa6be3ee2470c5cdccd94c8a683fa3880212f6b9da077289786d4c474b4d9

    SHA512

    edd6a444db8feed9f3382d9d1d104d0f26d3c3d6e878a1e6e9039a2c25668c92f5f2f33c6182fc79f14701158f5808140152922052f527efc1433941ee619bca