Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
11/10/2023, 22:41
Static task
static1
Behavioral task
behavioral1
Sample
NitroGen/main.py
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NitroGen/main.py
Resource
win10v2004-20230915-en
Behavioral task
behavioral3
Sample
NitroGen/start.bat
Resource
win7-20230831-en
Behavioral task
behavioral4
Sample
NitroGen/start.bat
Resource
win10v2004-20230915-en
General
-
Target
NitroGen/main.py
-
Size
4KB
-
MD5
fa6183a623395f0ab9481f7531ca7fe2
-
SHA1
5358f133340928e04aecf5481b59728549f4c53d
-
SHA256
5d20547db56ebd760e261d4689cac95b9c11b34860bd93017a730224a03c785b
-
SHA512
a0e513598bc688a72520cc05ac8c900e89ef5174d9caa40b162540079589713ca695bf8f2690246e860ca66a23d8ae3365075e2dce5683c1475449b11d98a0b8
-
SSDEEP
96:BnA3kNa8ZM3Wj5a/vRHgibx6NaQUY0xUuZE0fxJJTbOl+//llzg4GsNMds:asa8ZXjI/CJNaQBFuZE0fxJxRAu
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_CLASSES\py_auto_file\shell\Read\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_CLASSES\py_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_CLASSES\.py\ = "py_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_CLASSES\.py rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_CLASSES\py_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_CLASSES\py_auto_file\shell rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_Classes\Local Settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_CLASSES\py_auto_file\ rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3036 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3036 AcroRd32.exe 3036 AcroRd32.exe 3036 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1688 wrote to memory of 2652 1688 cmd.exe 29 PID 1688 wrote to memory of 2652 1688 cmd.exe 29 PID 1688 wrote to memory of 2652 1688 cmd.exe 29 PID 2652 wrote to memory of 3036 2652 rundll32.exe 30 PID 2652 wrote to memory of 3036 2652 rundll32.exe 30 PID 2652 wrote to memory of 3036 2652 rundll32.exe 30 PID 2652 wrote to memory of 3036 2652 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\NitroGen\main.py1⤵
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\NitroGen\main.py2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\NitroGen\main.py"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3036
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD55be2815a10d5116db4b1e65acb0cf54e
SHA102500b9e7783570511d49dc4ed82cffab90a80dd
SHA2563298dd2efac932b2a361832744ca7bf37c95504ef16e6feea0bc88229d69bcf3
SHA512dc6b36b8961bb330b9967c029103126051023f4f4938ccabfe47b6250c1f2ea503418001a51696ec22936cb1cf4c858cee138f1dc3246e970ceb98abcb843195