Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    05/03/2024, 20:12

General

  • Target

    Blank-Grabber-main/Blank Grabber/Components/process.py

  • Size

    8KB

  • MD5

    8cc1b499d73f3fc2140a5b0c97afd6f2

  • SHA1

    4e60e01f11ff8fec425c74679146e13713b18931

  • SHA256

    72f2b7cbcc38b79ce96d12e6fdd9a45874728a1abd49eed00438069ba8006f21

  • SHA512

    ac86a61d68bdac9b019d3c8a3f6102378b3e4f23be8398e6f0d79586dd29c0d104dc66e0cba267f88fb1b1d5241b74f51c073f2395f44d8f4ca34975b7534903

  • SSDEEP

    192:Eew1auOoI8I+IQI2Iz2Iym+IyIQICI0IiIgIcI6ISI+ISIKG2I0U0F+05dkIMN06:f4iE9pV3522EQTq1o4mE

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\Blank-Grabber-main\Blank Grabber\Components\process.py"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1688
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Blank-Grabber-main\Blank Grabber\Components\process.py
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2068
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Blank-Grabber-main\Blank Grabber\Components\process.py"
        3⤵
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2628

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    0137f4d70a8542875dee86edb2fb46ce

    SHA1

    dfd3bbb2884ceefbe6b47ae46741611513e29e80

    SHA256

    fa6e3043546725cf90c1dae17b43016a55fe1463e01e2d0f1dad6e2768c2055d

    SHA512

    401d6b5447fbdf7c3f9de74cbb92276fa67a599465dc646b7a0cb2610fb19de4532e941e34e76ff76408dfe5fa10933a40007304fd7d18e2b4bac4ca420f7f79