Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3Xeno[1].exe
windows11-21h2-x64
10Restructur...Ad.cda
windows11-21h2-x64
1Restructur...es.cda
windows11-21h2-x64
1Restructur...go.cda
windows11-21h2-x64
1Restructur...ck.cda
windows11-21h2-x64
1Restructur...nk.cda
windows11-21h2-x64
1Restructur...ic.cda
windows11-21h2-x64
1Restructur...ng.cda
windows11-21h2-x64
1Restructur...lk.cda
windows11-21h2-x64
1Restructur...ty.cab
windows11-21h2-x64
1Avenue
windows11-21h2-x64
1Chi
windows11-21h2-x64
1Congratulations
windows11-21h2-x64
1Cw
windows11-21h2-x64
1Devices
windows11-21h2-x64
1Drivers
windows11-21h2-x64
1Emails
windows11-21h2-x64
1Independently
windows11-21h2-x64
1Levy
windows11-21h2-x64
1Moments
windows11-21h2-x64
1Purchased
windows11-21h2-x64
1They
windows11-21h2-x64
1Restructur...st.cda
windows11-21h2-x64
1Restructur...um.cda
windows11-21h2-x64
1Analysis
-
max time kernel
140s -
max time network
94s -
platform
windows11-21h2_x64 -
resource
win11-20250217-en -
resource tags
arch:x64arch:x86image:win11-20250217-enlocale:en-usos:windows11-21h2-x64system -
submitted
13/03/2025, 15:07
Static task
static1
Behavioral task
behavioral1
Sample
Xeno[1].exe
Resource
win11-20250217-en
Behavioral task
behavioral2
Sample
RestructuringStorage/Ad.cda
Resource
win11-20250217-en
Behavioral task
behavioral3
Sample
RestructuringStorage/Candles.cda
Resource
win11-20250217-en
Behavioral task
behavioral4
Sample
RestructuringStorage/Cargo.cda
Resource
win11-20250217-en
Behavioral task
behavioral5
Sample
RestructuringStorage/Click.cda
Resource
win11-20250217-en
Behavioral task
behavioral6
Sample
RestructuringStorage/Drunk.cda
Resource
win11-20250217-en
Behavioral task
behavioral7
Sample
RestructuringStorage/Garlic.cda
Resource
win11-20250217-en
Behavioral task
behavioral8
Sample
RestructuringStorage/Learning.cda
Resource
win11-20250217-en
Behavioral task
behavioral9
Sample
RestructuringStorage/Milk.cda
Resource
win11-20250217-en
Behavioral task
behavioral10
Sample
RestructuringStorage/Quality.cab
Resource
win11-20250217-en
Behavioral task
behavioral11
Sample
Avenue
Resource
win11-20250217-en
Behavioral task
behavioral12
Sample
Chi
Resource
win11-20250217-en
Behavioral task
behavioral13
Sample
Congratulations
Resource
win11-20250217-en
Behavioral task
behavioral14
Sample
Cw
Resource
win11-20250217-en
Behavioral task
behavioral15
Sample
Devices
Resource
win11-20250217-en
Behavioral task
behavioral16
Sample
Drivers
Resource
win11-20250217-en
Behavioral task
behavioral17
Sample
Emails
Resource
win11-20250217-en
Behavioral task
behavioral18
Sample
Independently
Resource
win11-20250217-en
Behavioral task
behavioral19
Sample
Levy
Resource
win11-20250217-en
Behavioral task
behavioral20
Sample
Moments
Resource
win11-20250217-en
Behavioral task
behavioral21
Sample
Purchased
Resource
win11-20250217-en
Behavioral task
behavioral22
Sample
They
Resource
win11-20250217-en
Behavioral task
behavioral23
Sample
RestructuringStorage/Tourist.cda
Resource
win11-20250217-en
Behavioral task
behavioral24
Sample
RestructuringStorage/Zum.cda
Resource
win11-20250217-en
General
-
Target
RestructuringStorage/Learning.cda
-
Size
79KB
-
MD5
2447add9ef7fbc3db9f1f533514a2490
-
SHA1
ef0886005c946cec8f450c644ddf219f3e292715
-
SHA256
82f980ac40c070691fa4264277fb089ec87dedff40d889c7ae6cfc5f21ffe051
-
SHA512
dd84ded149e80fec88f24d7daeb911b4a2e842779ec21405b100d7c1859fa1f3151d4f9413783359a367c990a732a7090070380735022806f27d4d610d6b06cd
-
SSDEEP
1536:DUMcHVZLEN1pRWvt9OcItgKn7hvCkeraSM2OWWBw:QM8ZLGWVyhKker7M2OWWm
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4248 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4248 vlc.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 4248 vlc.exe 4248 vlc.exe 4248 vlc.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 4248 vlc.exe 4248 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4248 vlc.exe
Processes
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\RestructuringStorage\Learning.cda"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4248