Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    13/01/2025, 08:25

General

  • Target

    translations/qtbase_gd.qm

  • Size

    185KB

  • MD5

    eb1fb93b0be51c2ad78fc7ba2f8b9f42

  • SHA1

    24f7ff809e2f11c579cd388fea5a4c552ff8d4d0

  • SHA256

    63b439dd44139aa3aed54c2ebe03fa9bc77f22c14ed8fba8eff2608445bb233d

  • SHA512

    e13770aef33b6666ed7d54e03ee20ca291d4167d673ba6c61d8e64cdd5f7ffe0a9521b95af67be719bf263932ecf16e2b2d0b5f3404f9bcd7879114fcc6fc474

  • SSDEEP

    1536:SiaI3C87jhakhR0VGkw7ys7CskUH6y4e6IFB4xyMuhvDnJGhFaCo527arBbm07LZ:S2yGjh17yGqxTXhvQoejJd8FUjVgk

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\translations\qtbase_gd.qm
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1144
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\translations\qtbase_gd.qm
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2452
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\translations\qtbase_gd.qm"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2820

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    4f470c1e6b5e98d4ebddab5a0e9e43d7

    SHA1

    608a2767ef90ea5cf2b1c7ab89d6db7190bb4f82

    SHA256

    5521c8de229a5f81b66f858fae9c3c05b33771a3bd1d156e67c639015da8bb32

    SHA512

    4556b3115c431fdde6b6d29bbe16683cc5fabe3ab3b1c41973e66c715a4e224f262409cde670948b66a91a9520f5d4084bf250b05a8cbbf84b94a618fbc6970f