Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
26s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
29/10/2023, 13:31
Static task
static1
Behavioral task
behavioral1
Sample
snake_eater.py
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
snake_eater.py
Resource
win10v2004-20231023-en
General
-
Target
snake_eater.py
-
Size
18KB
-
MD5
1d9eaf4363453b543895f8ca67be27a9
-
SHA1
fec3880e0c1b3345d6ae850e40a139cdb903ea24
-
SHA256
919be225b8ccfa5e97248e23d7e6ebdbc3d2f6824a339c42b89d426fa3c1d302
-
SHA512
b5d629924ac1eff54afbbac72d988d9626736b61c7c869c3e8fcfd028d68e02ffbeb4ce7989bbb080c1b2508a82cd7f5ade36a8c774b5247fc86103694950823
-
SSDEEP
384:VBNhBn21qpiPZBXjdEiajigGZq9yRIZMiVKCdAJyxO5KTaUuFt:TB5I4iJZs1NVKwAAlTm
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_Classes\Local Settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\py_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\.py rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\.py\ = "py_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\py_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\py_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\py_auto_file\shell\Read\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\py_auto_file rundll32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2776 AcroRd32.exe 2776 AcroRd32.exe 2776 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1968 wrote to memory of 3016 1968 cmd.exe 29 PID 1968 wrote to memory of 3016 1968 cmd.exe 29 PID 1968 wrote to memory of 3016 1968 cmd.exe 29 PID 3016 wrote to memory of 2776 3016 rundll32.exe 30 PID 3016 wrote to memory of 2776 3016 rundll32.exe 30 PID 3016 wrote to memory of 2776 3016 rundll32.exe 30 PID 3016 wrote to memory of 2776 3016 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\snake_eater.py1⤵
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\snake_eater.py2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\snake_eater.py"3⤵
- Suspicious use of SetWindowsHookEx
PID:2776
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5d410a321add34459df43b72f002f7b5c
SHA186471e04163d670188a778f0ed5e26e66d4b25dc
SHA256cd9a5b14ef5e39d5d83b3f19fc0b590ad9af2f93b70887f5ef97500fc724cb32
SHA512d81eda8fa9a8daab38909ac86fcc2031b2c7e9b5cb8733dbed7683d49c222e621f2dbd978b824006e2d5d356eef5561b2b1261318690190df4769c9e1b6a9b5d