Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
19/03/2024, 20:27
240319-y8vwmsfd7z 719/03/2024, 20:23
240319-y6lj7afc9w 719/03/2024, 20:16
240319-y2lpdsed73 7Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19/03/2024, 20:16
Behavioral task
behavioral1
Sample
TTD_TRADE_SCAM_CLIENT.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
TTD_TRADE_SCAM_CLIENT.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
CockiLoggerNEW.pyc
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
CockiLoggerNEW.pyc
Resource
win10v2004-20240226-en
General
-
Target
CockiLoggerNEW.pyc
-
Size
10KB
-
MD5
6b47edbefd6c9c6c68420acaed36b20f
-
SHA1
675f8bc0302a4030d0d475f106a4343aedfc7251
-
SHA256
7e1fde40831c2604ed95158d2e3bad7efab63816190bade9d06b22b307047ea2
-
SHA512
35254fefa768366b48f3b3579686701e7fdc15508e9e8fc196f65d75bcc76477d270b4b8ef5753e47b37c5d8826ef5d8d838424d282aab2a66ef0fd24c7234b6
-
SSDEEP
192:KYzQ2Ucq5cNTme0KBjo5OX4CzzA1V0CmGA9FbJut3nyrdyXT:KkBUcqqNT7Bc5o4CzzA1eXU4i
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\shell rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.pyc\ = "pyc_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\shell\Read\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.pyc rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2724 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2724 AcroRd32.exe 2724 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2972 wrote to memory of 2516 2972 cmd.exe 29 PID 2972 wrote to memory of 2516 2972 cmd.exe 29 PID 2972 wrote to memory of 2516 2972 cmd.exe 29 PID 2516 wrote to memory of 2724 2516 rundll32.exe 30 PID 2516 wrote to memory of 2724 2516 rundll32.exe 30 PID 2516 wrote to memory of 2724 2516 rundll32.exe 30 PID 2516 wrote to memory of 2724 2516 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\CockiLoggerNEW.pyc1⤵
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\CockiLoggerNEW.pyc2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\CockiLoggerNEW.pyc"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2724
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5fe78d4eb9bf1008d43a5eff0b039be09
SHA149a201185acf9c26c828415c064d7c92e023c928
SHA25614090e611220d6a667d294e36c91579d58c777e6ad0d0519f44e6e57aba0da69
SHA512e1d68230ff409641847fc4b07e8363b9a7cbd00a6d062831f7faebad016d71b6ffc4c0d0cf64fb9ee6c685757a8d816de934014cdcacf43159577d69aa83db55