Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3Xeno[1].exe
windows11-21h2-x64
10Restructur...Ad.cda
windows11-21h2-x64
1Restructur...es.cda
windows11-21h2-x64
1Restructur...go.cda
windows11-21h2-x64
1Restructur...ck.cda
windows11-21h2-x64
1Restructur...nk.cda
windows11-21h2-x64
1Restructur...ic.cda
windows11-21h2-x64
1Restructur...ng.cda
windows11-21h2-x64
1Restructur...lk.cda
windows11-21h2-x64
1Restructur...ty.cab
windows11-21h2-x64
1Avenue
windows11-21h2-x64
1Chi
windows11-21h2-x64
1Congratulations
windows11-21h2-x64
1Cw
windows11-21h2-x64
1Devices
windows11-21h2-x64
1Drivers
windows11-21h2-x64
1Emails
windows11-21h2-x64
1Independently
windows11-21h2-x64
1Levy
windows11-21h2-x64
1Moments
windows11-21h2-x64
1Purchased
windows11-21h2-x64
1They
windows11-21h2-x64
1Restructur...st.cda
windows11-21h2-x64
1Restructur...um.cda
windows11-21h2-x64
1Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20250217-en -
resource tags
arch:x64arch:x86image:win11-20250217-enlocale:en-usos:windows11-21h2-x64system -
submitted
13/03/2025, 15:07
Static task
static1
Behavioral task
behavioral1
Sample
Xeno[1].exe
Resource
win11-20250217-en
Behavioral task
behavioral2
Sample
RestructuringStorage/Ad.cda
Resource
win11-20250217-en
Behavioral task
behavioral3
Sample
RestructuringStorage/Candles.cda
Resource
win11-20250217-en
Behavioral task
behavioral4
Sample
RestructuringStorage/Cargo.cda
Resource
win11-20250217-en
Behavioral task
behavioral5
Sample
RestructuringStorage/Click.cda
Resource
win11-20250217-en
Behavioral task
behavioral6
Sample
RestructuringStorage/Drunk.cda
Resource
win11-20250217-en
Behavioral task
behavioral7
Sample
RestructuringStorage/Garlic.cda
Resource
win11-20250217-en
Behavioral task
behavioral8
Sample
RestructuringStorage/Learning.cda
Resource
win11-20250217-en
Behavioral task
behavioral9
Sample
RestructuringStorage/Milk.cda
Resource
win11-20250217-en
Behavioral task
behavioral10
Sample
RestructuringStorage/Quality.cab
Resource
win11-20250217-en
Behavioral task
behavioral11
Sample
Avenue
Resource
win11-20250217-en
Behavioral task
behavioral12
Sample
Chi
Resource
win11-20250217-en
Behavioral task
behavioral13
Sample
Congratulations
Resource
win11-20250217-en
Behavioral task
behavioral14
Sample
Cw
Resource
win11-20250217-en
Behavioral task
behavioral15
Sample
Devices
Resource
win11-20250217-en
Behavioral task
behavioral16
Sample
Drivers
Resource
win11-20250217-en
Behavioral task
behavioral17
Sample
Emails
Resource
win11-20250217-en
Behavioral task
behavioral18
Sample
Independently
Resource
win11-20250217-en
Behavioral task
behavioral19
Sample
Levy
Resource
win11-20250217-en
Behavioral task
behavioral20
Sample
Moments
Resource
win11-20250217-en
Behavioral task
behavioral21
Sample
Purchased
Resource
win11-20250217-en
Behavioral task
behavioral22
Sample
They
Resource
win11-20250217-en
Behavioral task
behavioral23
Sample
RestructuringStorage/Tourist.cda
Resource
win11-20250217-en
Behavioral task
behavioral24
Sample
RestructuringStorage/Zum.cda
Resource
win11-20250217-en
General
-
Target
RestructuringStorage/Drunk.cda
-
Size
81KB
-
MD5
b53b44452048d1f79aab4187bd7741dd
-
SHA1
b6033b3915594c07fd48bdac2054b266e9ff9ae4
-
SHA256
496f9fd798ca8aa06c9304fd5d73ca371ee7497908bd74d839b37d95b07d81c1
-
SHA512
cf69597c03d01c8a6811fe98cc683d8f962ecc9972cf7251108779d32254258774509d0ff57231fba9b78f428456a0f55e0fe4280469c9a63ee75b1f1799e0eb
-
SSDEEP
1536:AFTu6/x/6PHKUMNAZjN9aJ1b238ICgAocUBsBUrmZaDk9VQQ3frBrwx8/3n1wbP1:oHBkM+Zxk23VzAaDIJ1rPeh57PoL5C
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4452 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4452 vlc.exe -
Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 4452 vlc.exe 4452 vlc.exe 4452 vlc.exe 4452 vlc.exe 4452 vlc.exe 4452 vlc.exe 4452 vlc.exe 4452 vlc.exe -
Suspicious use of SendNotifyMessage 7 IoCs
pid Process 4452 vlc.exe 4452 vlc.exe 4452 vlc.exe 4452 vlc.exe 4452 vlc.exe 4452 vlc.exe 4452 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4452 vlc.exe
Processes
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\RestructuringStorage\Drunk.cda"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4452