Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3Xeno[1].exe
windows11-21h2-x64
10Restructur...Ad.cda
windows11-21h2-x64
1Restructur...es.cda
windows11-21h2-x64
1Restructur...go.cda
windows11-21h2-x64
1Restructur...ck.cda
windows11-21h2-x64
1Restructur...nk.cda
windows11-21h2-x64
1Restructur...ic.cda
windows11-21h2-x64
1Restructur...ng.cda
windows11-21h2-x64
1Restructur...lk.cda
windows11-21h2-x64
1Restructur...ty.cab
windows11-21h2-x64
1Avenue
windows11-21h2-x64
1Chi
windows11-21h2-x64
1Congratulations
windows11-21h2-x64
1Cw
windows11-21h2-x64
1Devices
windows11-21h2-x64
1Drivers
windows11-21h2-x64
1Emails
windows11-21h2-x64
1Independently
windows11-21h2-x64
1Levy
windows11-21h2-x64
1Moments
windows11-21h2-x64
1Purchased
windows11-21h2-x64
1They
windows11-21h2-x64
1Restructur...st.cda
windows11-21h2-x64
1Restructur...um.cda
windows11-21h2-x64
1Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20250217-en -
resource tags
arch:x64arch:x86image:win11-20250217-enlocale:en-usos:windows11-21h2-x64system -
submitted
13/03/2025, 15:07
Static task
static1
Behavioral task
behavioral1
Sample
Xeno[1].exe
Resource
win11-20250217-en
Behavioral task
behavioral2
Sample
RestructuringStorage/Ad.cda
Resource
win11-20250217-en
Behavioral task
behavioral3
Sample
RestructuringStorage/Candles.cda
Resource
win11-20250217-en
Behavioral task
behavioral4
Sample
RestructuringStorage/Cargo.cda
Resource
win11-20250217-en
Behavioral task
behavioral5
Sample
RestructuringStorage/Click.cda
Resource
win11-20250217-en
Behavioral task
behavioral6
Sample
RestructuringStorage/Drunk.cda
Resource
win11-20250217-en
Behavioral task
behavioral7
Sample
RestructuringStorage/Garlic.cda
Resource
win11-20250217-en
Behavioral task
behavioral8
Sample
RestructuringStorage/Learning.cda
Resource
win11-20250217-en
Behavioral task
behavioral9
Sample
RestructuringStorage/Milk.cda
Resource
win11-20250217-en
Behavioral task
behavioral10
Sample
RestructuringStorage/Quality.cab
Resource
win11-20250217-en
Behavioral task
behavioral11
Sample
Avenue
Resource
win11-20250217-en
Behavioral task
behavioral12
Sample
Chi
Resource
win11-20250217-en
Behavioral task
behavioral13
Sample
Congratulations
Resource
win11-20250217-en
Behavioral task
behavioral14
Sample
Cw
Resource
win11-20250217-en
Behavioral task
behavioral15
Sample
Devices
Resource
win11-20250217-en
Behavioral task
behavioral16
Sample
Drivers
Resource
win11-20250217-en
Behavioral task
behavioral17
Sample
Emails
Resource
win11-20250217-en
Behavioral task
behavioral18
Sample
Independently
Resource
win11-20250217-en
Behavioral task
behavioral19
Sample
Levy
Resource
win11-20250217-en
Behavioral task
behavioral20
Sample
Moments
Resource
win11-20250217-en
Behavioral task
behavioral21
Sample
Purchased
Resource
win11-20250217-en
Behavioral task
behavioral22
Sample
They
Resource
win11-20250217-en
Behavioral task
behavioral23
Sample
RestructuringStorage/Tourist.cda
Resource
win11-20250217-en
Behavioral task
behavioral24
Sample
RestructuringStorage/Zum.cda
Resource
win11-20250217-en
General
-
Target
RestructuringStorage/Milk.cda
-
Size
63KB
-
MD5
74db0d44d20d089c9b96910981c63e98
-
SHA1
5cb0bf4fd429e3e51786764b4bccc77a4b2e9a50
-
SHA256
1fcd4b87f9a417e42ee71ef092f73c80fbe6c0e91dc4fe1b86615610de3d5061
-
SHA512
4abb60f53205b5a7ed5c2fe02b70bd42bbc16213e71457be32c9da76f495351772662d7f8b3db527289198c759e6b7067d4e07e70a3494849793987e06659353
-
SSDEEP
1536:Nxxs02oQrnolDdq2bLMjysp7lGnz2SiGxEMYIbw3M:Hxs0vxd+2ytYXuM
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4812 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4812 vlc.exe -
Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe -
Suspicious use of SendNotifyMessage 7 IoCs
pid Process 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe 4812 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4812 vlc.exe
Processes
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\RestructuringStorage\Milk.cda"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4812