Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
24s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
24/10/2023, 06:16
Static task
static1
Behavioral task
behavioral1
Sample
entry_1_0/StudentManager.py
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
entry_1_0/StudentManager.py
Resource
win10v2004-20231023-en
General
-
Target
entry_1_0/StudentManager.py
-
Size
1KB
-
MD5
674a3bad25aebd23602029efe901190a
-
SHA1
f8967a8e12c9dadacb79db40f4789688a5f95f0b
-
SHA256
c51a03ed3f02c8af01233800f7d08279fdf78f3310f21421b51d2aec2e02c612
-
SHA512
4c2ca1c8556b7d720feb7900952b91201d78757fff112b218398962150e79dd8e13620695504efcc946eb5e6b3a3363c35eaadfc9e228d7f0189278ada379696
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\py_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\py_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\.py rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\.py\ = "py_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\py_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\py_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\py_auto_file\ rundll32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2740 AcroRd32.exe 2740 AcroRd32.exe 2740 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2104 wrote to memory of 2704 2104 cmd.exe 29 PID 2104 wrote to memory of 2704 2104 cmd.exe 29 PID 2104 wrote to memory of 2704 2104 cmd.exe 29 PID 2704 wrote to memory of 2740 2704 rundll32.exe 30 PID 2704 wrote to memory of 2740 2704 rundll32.exe 30 PID 2704 wrote to memory of 2740 2704 rundll32.exe 30 PID 2704 wrote to memory of 2740 2704 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\entry_1_0\StudentManager.py1⤵
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\entry_1_0\StudentManager.py2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\entry_1_0\StudentManager.py"3⤵
- Suspicious use of SetWindowsHookEx
PID:2740
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD56412ff8ddbb2f8e42ae3e4f56f49fd2f
SHA18e34bc429541d7c681a7ee2dd72aa52462afeabb
SHA256e83fefb922fe8b9144eb28eec7aa27a37703d1abbee26faf7c907d4aabfac241
SHA5123392ff97f5a6e6e376397b5f522bb3512f5408d20dccddc24363ba0016a95d2ac098a57be770b71ffa72f049df2bdf0353962bdff7457687c494798444ce278c