Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10Shrek-Tools-main.zip
windows10-2004-x64
8LICENSE
windows10-2004-x64
1Menu.py
windows10-2004-x64
3README.md
windows10-2004-x64
3Setup.bat
windows10-2004-x64
7chromedriver.exe
windows10-2004-x64
1data/Member_id.txt
windows10-2004-x64
1data/channels.txt
windows10-2004-x64
1data/groups.txt
windows10-2004-x64
1data/roles.txt
windows10-2004-x64
1utilities/...gin.py
windows10-2004-x64
3utilities/...ker.py
windows10-2004-x64
3utilities/...ber.py
windows10-2004-x64
3utilities/...ort.py
windows10-2004-x64
3utilities/...nfo.py
windows10-2004-x64
3utilities/...mon.py
windows10-2004-x64
3utilities/...on2.py
windows10-2004-x64
3utilities/...rys.py
windows10-2004-x64
3utilities/...ate.py
windows10-2004-x64
3utilities/Start.bat
windows10-2004-x64
1utilities/...er.exe
windows10-2004-x64
7X�p~�p<.pyc
windows10-2004-x64
Analysis
-
max time kernel
571s -
max time network
453s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
24/03/2024, 15:40
Behavioral task
behavioral1
Sample
Shrek-Tools-main.zip
Resource
win10v2004-20240226-en
Behavioral task
behavioral2
Sample
LICENSE
Resource
win10v2004-20240319-en
Behavioral task
behavioral3
Sample
Menu.py
Resource
win10v2004-20240226-en
Behavioral task
behavioral4
Sample
README.md
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
Setup.bat
Resource
win10v2004-20240226-en
Behavioral task
behavioral6
Sample
chromedriver.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
data/Member_id.txt
Resource
win10v2004-20240226-en
Behavioral task
behavioral8
Sample
data/channels.txt
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
data/groups.txt
Resource
win10v2004-20240226-en
Behavioral task
behavioral10
Sample
data/roles.txt
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
utilities/Plugins/AutoLogin.py
Resource
win10v2004-20240226-en
Behavioral task
behavioral12
Sample
utilities/Plugins/DdosAttacker.py
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
utilities/Plugins/QR_grabber.py
Resource
win10v2004-20240226-en
Behavioral task
behavioral14
Sample
utilities/Plugins/massreport.py
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
utilities/Plugins/tokeninfo.py
Resource
win10v2004-20240319-en
Behavioral task
behavioral16
Sample
utilities/Settings/common.py
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
utilities/Settings/common2.py
Resource
win10v2004-20240226-en
Behavioral task
behavioral18
Sample
utilities/Settings/libarys.py
Resource
win10v2004-20231215-en
Behavioral task
behavioral19
Sample
utilities/Settings/update.py
Resource
win10v2004-20240226-en
Behavioral task
behavioral20
Sample
utilities/Start.bat
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
utilities/assets/Pyinstaller.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral22
Sample
X�p~�p<.pyc
Resource
win10v2004-20240226-en
General
-
Target
utilities/Start.bat
-
Size
34B
-
MD5
c24add9b40129d29c40e5fd94ccd1812
-
SHA1
6a9c4c822f6aa8a46d5e6a8c5c7c09eca83bca80
-
SHA256
9df81babbfd6f7054c60943ad0179f0a74ef814080252554f8f4e97fe5a790eb
-
SHA512
c93373a9a2a4cb4d83c7579f9c3cb82016542e904310f073cd39f5b20ca349efcb3359d8976d6d01c87d613ce8c31cb99ad19c35e96b9721c57b4d0ea1715789
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeManageVolumePrivilege 4040 svchost.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\utilities\Start.bat"1⤵PID:3432
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵PID:3976
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4040