Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3Xeno[1].exe
windows11-21h2-x64
10Restructur...Ad.cda
windows11-21h2-x64
1Restructur...es.cda
windows11-21h2-x64
1Restructur...go.cda
windows11-21h2-x64
1Restructur...ck.cda
windows11-21h2-x64
1Restructur...nk.cda
windows11-21h2-x64
1Restructur...ic.cda
windows11-21h2-x64
1Restructur...ng.cda
windows11-21h2-x64
1Restructur...lk.cda
windows11-21h2-x64
1Restructur...ty.cab
windows11-21h2-x64
1Avenue
windows11-21h2-x64
1Chi
windows11-21h2-x64
1Congratulations
windows11-21h2-x64
1Cw
windows11-21h2-x64
1Devices
windows11-21h2-x64
1Drivers
windows11-21h2-x64
1Emails
windows11-21h2-x64
1Independently
windows11-21h2-x64
1Levy
windows11-21h2-x64
1Moments
windows11-21h2-x64
1Purchased
windows11-21h2-x64
1They
windows11-21h2-x64
1Restructur...st.cda
windows11-21h2-x64
1Restructur...um.cda
windows11-21h2-x64
1Analysis
-
max time kernel
140s -
max time network
95s -
platform
windows11-21h2_x64 -
resource
win11-20250217-en -
resource tags
arch:x64arch:x86image:win11-20250217-enlocale:en-usos:windows11-21h2-x64system -
submitted
13/03/2025, 15:07
Static task
static1
Behavioral task
behavioral1
Sample
Xeno[1].exe
Resource
win11-20250217-en
Behavioral task
behavioral2
Sample
RestructuringStorage/Ad.cda
Resource
win11-20250217-en
Behavioral task
behavioral3
Sample
RestructuringStorage/Candles.cda
Resource
win11-20250217-en
Behavioral task
behavioral4
Sample
RestructuringStorage/Cargo.cda
Resource
win11-20250217-en
Behavioral task
behavioral5
Sample
RestructuringStorage/Click.cda
Resource
win11-20250217-en
Behavioral task
behavioral6
Sample
RestructuringStorage/Drunk.cda
Resource
win11-20250217-en
Behavioral task
behavioral7
Sample
RestructuringStorage/Garlic.cda
Resource
win11-20250217-en
Behavioral task
behavioral8
Sample
RestructuringStorage/Learning.cda
Resource
win11-20250217-en
Behavioral task
behavioral9
Sample
RestructuringStorage/Milk.cda
Resource
win11-20250217-en
Behavioral task
behavioral10
Sample
RestructuringStorage/Quality.cab
Resource
win11-20250217-en
Behavioral task
behavioral11
Sample
Avenue
Resource
win11-20250217-en
Behavioral task
behavioral12
Sample
Chi
Resource
win11-20250217-en
Behavioral task
behavioral13
Sample
Congratulations
Resource
win11-20250217-en
Behavioral task
behavioral14
Sample
Cw
Resource
win11-20250217-en
Behavioral task
behavioral15
Sample
Devices
Resource
win11-20250217-en
Behavioral task
behavioral16
Sample
Drivers
Resource
win11-20250217-en
Behavioral task
behavioral17
Sample
Emails
Resource
win11-20250217-en
Behavioral task
behavioral18
Sample
Independently
Resource
win11-20250217-en
Behavioral task
behavioral19
Sample
Levy
Resource
win11-20250217-en
Behavioral task
behavioral20
Sample
Moments
Resource
win11-20250217-en
Behavioral task
behavioral21
Sample
Purchased
Resource
win11-20250217-en
Behavioral task
behavioral22
Sample
They
Resource
win11-20250217-en
Behavioral task
behavioral23
Sample
RestructuringStorage/Tourist.cda
Resource
win11-20250217-en
Behavioral task
behavioral24
Sample
RestructuringStorage/Zum.cda
Resource
win11-20250217-en
General
-
Target
RestructuringStorage/Tourist.cda
-
Size
94KB
-
MD5
8d4baa550a8e4b3943d7990961be56df
-
SHA1
a19e5ea61e8c63fc5673787bb00cd2bf17490f84
-
SHA256
e4a4d8a6051597941bab63ac4a2d83501978436d9826496760d9841d46e031b0
-
SHA512
6a354adff672dad0c64135d896068ee2406d3721b72e5b935ce9f4ca7b8e089ed5737cad24d76c5a1804fd41a561e5cb5276c13faab48f602e32eb2fad03f56b
-
SSDEEP
1536:CxdZvXtBarQsLUlMFa0hYFEmXllqQvQBuNBZtPC4p6PiqqHzqrl32lZM3vtO7Tl:wdZtkrQsLUl8aS7GlqQvbZtq4MKTzolA
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4560 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4560 vlc.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 4560 vlc.exe 4560 vlc.exe 4560 vlc.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 4560 vlc.exe 4560 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4560 vlc.exe
Processes
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\RestructuringStorage\Tourist.cda"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4560