Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
1Roblox Hot....1.rar
windows7-x64
3Roblox Hot....1.rar
windows10-2004-x64
1Counter.js
windows7-x64
3Counter.js
windows10-2004-x64
3index.js
windows7-x64
3index.js
windows10-2004-x64
3install packages.bat
windows7-x64
1install packages.bat
windows10-2004-x64
1package.json
windows7-x64
3package.json
windows10-2004-x64
3run.bat
windows7-x64
1run.bat
windows10-2004-x64
1Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
11/01/2025, 06:51
Static task
static1
Behavioral task
behavioral1
Sample
Roblox Hotmail Checker v1.3.1.rar
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Roblox Hotmail Checker v1.3.1.rar
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Counter.js
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Counter.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
index.js
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
index.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
install packages.bat
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
install packages.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
package.json
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
package.json
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
run.bat
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
run.bat
Resource
win10v2004-20241007-en
General
-
Target
package.json
-
Size
441B
-
MD5
8b51196db01a3f2d2e046878e2b17e0b
-
SHA1
1f778164dfd6c825777864d81cab25ca9819a0ae
-
SHA256
293d46719a8d26e8639a4b0870e587c14bf60c5cc3e8aef04fc06a71424696d1
-
SHA512
23f359d407f3696010150b35023acb7dd4c824d576fb727ba96967f96cd2d9a5d6a23e5a687622044639b448685caeffa6b2c999bd21ea42f1729ccf36f64143
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2172 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2172 AcroRd32.exe 2172 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2168 wrote to memory of 2560 2168 cmd.exe 31 PID 2168 wrote to memory of 2560 2168 cmd.exe 31 PID 2168 wrote to memory of 2560 2168 cmd.exe 31 PID 2560 wrote to memory of 2172 2560 rundll32.exe 32 PID 2560 wrote to memory of 2172 2560 rundll32.exe 32 PID 2560 wrote to memory of 2172 2560 rundll32.exe 32 PID 2560 wrote to memory of 2172 2560 rundll32.exe 32
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\package.json1⤵
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\package.json2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\package.json"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2172
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD52c4ad0e8128c8073fa43ae4f6e675201
SHA13e3aa08698f996465a0eef616b0bd71d15c0fe32
SHA2565a07d846057b22a2e4079703a3cdbad659793fca690b0141611445f2d97d66d0
SHA51294a61fd3f86c43e0a58664a34b73f5bdfe9bdb695eea3a24dc333763942a25effc2e2f7e8b487331c0bb340bb2b455b8175dfb2ccc8679969662b50ebd086d79