Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
1Luna-Grabb...una.py
windows7-x64
3Luna-Grabb...una.py
windows10-2004-x64
3Luna-Grabb...un.bat
windows7-x64
1Luna-Grabb...un.bat
windows10-2004-x64
1Luna-Grabb...up.bat
windows7-x64
1Luna-Grabb...up.bat
windows10-2004-x64
1Luna-Grabb...ion.py
windows7-x64
3Luna-Grabb...ion.py
windows10-2004-x64
3Luna-Grabb...ate.py
windows7-x64
3Luna-Grabb...ate.py
windows10-2004-x64
3Luna-Grabb...upx.py
windows7-x64
3Luna-Grabb...upx.py
windows10-2004-x64
3Analysis
-
max time kernel
45s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
15/03/2024, 23:00 UTC
Static task
static1
Behavioral task
behavioral1
Sample
Luna-Grabber-1.5.5-alpha/luna.py
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
Luna-Grabber-1.5.5-alpha/luna.py
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
Luna-Grabber-1.5.5-alpha/run.bat
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Luna-Grabber-1.5.5-alpha/run.bat
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
Luna-Grabber-1.5.5-alpha/setup.bat
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
Luna-Grabber-1.5.5-alpha/setup.bat
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
Luna-Grabber-1.5.5-alpha/tools/obfuscation.py
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
Luna-Grabber-1.5.5-alpha/tools/obfuscation.py
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
Luna-Grabber-1.5.5-alpha/tools/update.py
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
Luna-Grabber-1.5.5-alpha/tools/update.py
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
Luna-Grabber-1.5.5-alpha/tools/upx.py
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
Luna-Grabber-1.5.5-alpha/tools/upx.py
Resource
win10v2004-20240226-en
General
-
Target
Luna-Grabber-1.5.5-alpha/luna.py
-
Size
51KB
-
MD5
951fec5c3c0cda1bee7f6a9250a5aac0
-
SHA1
5f560277ae47188a609c35bf9ca7d9577fbc727e
-
SHA256
89d19888f1a1e821cd40bc32ffe20dd28204c11ef6cca74cd82014786a15cab6
-
SHA512
5d079b4874d0576e503c80fb2238c807c9d5cc11ce61897c93e86aea8df6390b1d42cb654e4529c8b03209aa25f766703c8accc252a0e48d42408b9b0a2bcbae
-
SSDEEP
768:mNEv8SqFEIxK4R464G87yU/X4C+VJyj/sGDT8D79Rz1txlc:mGv8SwKQG0Jyj/xDT8D7Ntxlc
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file\shell\Read\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.py rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.py\ = "py_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file\shell rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file\ rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2660 AcroRd32.exe 2660 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1992 wrote to memory of 2552 1992 cmd.exe 29 PID 1992 wrote to memory of 2552 1992 cmd.exe 29 PID 1992 wrote to memory of 2552 1992 cmd.exe 29 PID 2552 wrote to memory of 2660 2552 rundll32.exe 30 PID 2552 wrote to memory of 2660 2552 rundll32.exe 30 PID 2552 wrote to memory of 2660 2552 rundll32.exe 30 PID 2552 wrote to memory of 2660 2552 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Luna-Grabber-1.5.5-alpha\luna.py1⤵
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Luna-Grabber-1.5.5-alpha\luna.py2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Luna-Grabber-1.5.5-alpha\luna.py"3⤵
- Suspicious use of SetWindowsHookEx
PID:2660
-
-