Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
14/02/2024, 14:30
Static task
static1
Behavioral task
behavioral1
Sample
Simos-Modmenu.py
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Simos-Modmenu.py
Resource
win10-20231215-en
Behavioral task
behavioral3
Sample
Simos-Modmenu.py
Resource
win10v2004-20231222-en
Behavioral task
behavioral4
Sample
Simos-Modmenu.py
Resource
win11-20231215-en
General
-
Target
Simos-Modmenu.py
-
Size
47KB
-
MD5
5b9b1707bdf6d2219ade95c964675033
-
SHA1
3f8a58729f274622fe30f08fccb671ab2da24085
-
SHA256
9b9d3270a631ca1690ab9b5a03e213eb7731964748a57c7cf6e789829472026e
-
SHA512
540e47964eca0985ca613b9e315ce0eefa91254dad07c743370a12b5befaf12674799484f2bb7829508521b99c26cfa748e095d4c91684a45d6b1a3aee65a89e
-
SSDEEP
768:aZb75RByZ6xc6mIx94C48bb7aICW01lfBaqyMbUTnb6w5VbAWR5u:aZb/4Z6xl9JSB1yMbUSw5VsWR5u
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\.py rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\py_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\py_auto_file\shell\Read\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\py_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\py_auto_file\ rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\.py\ = "py_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\py_auto_file\shell\Read rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2616 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2616 AcroRd32.exe 2616 AcroRd32.exe 2616 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2944 wrote to memory of 2780 2944 cmd.exe 29 PID 2944 wrote to memory of 2780 2944 cmd.exe 29 PID 2944 wrote to memory of 2780 2944 cmd.exe 29 PID 2780 wrote to memory of 2616 2780 rundll32.exe 31 PID 2780 wrote to memory of 2616 2780 rundll32.exe 31 PID 2780 wrote to memory of 2616 2780 rundll32.exe 31 PID 2780 wrote to memory of 2616 2780 rundll32.exe 31
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Simos-Modmenu.py1⤵
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Simos-Modmenu.py2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Simos-Modmenu.py"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2616
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD55bdaafb373a598722c43a048c3b7d268
SHA14d0d62731cbc78e91eb04146db3d192a4d509cc7
SHA256b51559fda5f656644b4853cf292a3690e898d75e31000dfbca7c60583d476973
SHA5121b7033eedf534515f58be457d30546df40cf0c7398a8d7da4333a6a695b47e7b16bcef4af71d585338bb91ff28b7534cb49f995be83e033e3e1dc01889828c6c