Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
100s -
max time network
143s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241211-en -
resource tags
-
submitted
29/12/2024, 14:22
General
-
Target
IMG_9262.jpg
-
Size
230KB
-
MD5
b3335da7a5f01af88272d9d9ef8a38cf
-
SHA1
ee648be33f462b42a4e5161a75005ce94d039ca0
-
SHA256
b623eeafe9742ad0fb9fb33bbe959bbe9c1f4cd3236d3b6c294ebca3a8c56988
-
SHA512
92b62dfba35539fceaf7a19d82f1e5b9c2aa4e02da97abd6670ddc46a52a5c8a1a694637a7a43a840a6ac118bebce500351d98926d4535ea0045bbb7acce352c
-
SSDEEP
6144:eG/u6e1mffqL0dO/IZIJxXN2mNDL0nu971MO/wGDUg2hZum2bS69ITq9bv/GmdOC:eG/up1mHqL0dO/IZILXN2m9L0ni7KO/f
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\IMG_9262.jpg1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\IMG_9262.jpg"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵