Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
28/03/2024, 11:12
Static task
static1
Behavioral task
behavioral1
Sample
ID-to-TOKEN-main/ID to TOKEN.py
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral2
Sample
ID-to-TOKEN-main/ID to TOKEN.py
Resource
win10v2004-20240226-en
windows10-2004-x64
General
-
Target
ID-to-TOKEN-main/ID to TOKEN.py
-
Size
5KB
-
MD5
391d0c0c2c22540e9a631a180a739722
-
SHA1
81848c775bd8d4efa3f75a34caa73184813d0276
-
SHA256
f7d780b18d0fefff78a359cc0645781266ac302e4509a07476b92d7fdf49fe6b
-
SHA512
15c39ef25cb7d1a3949e5b028ff66408386b0aaed4034af5a9181d77f5461369a6c87e066c3bc64affb8cc875ff947774fcc79bf8795e21e296e259dbfa05c50
-
SSDEEP
96:rMkv2VuawZBLIBfI3p8DpvlRXdFVrepZq2MDlwH2i:Z2Vuaw3LIBfI58nRzVr12elwH2i
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2012 rundll32.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1304 wrote to memory of 2012 1304 cmd.exe 29 PID 1304 wrote to memory of 2012 1304 cmd.exe 29 PID 1304 wrote to memory of 2012 1304 cmd.exe 29
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ID-to-TOKEN-main\ID to TOKEN.py"1⤵
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\ID-to-TOKEN-main\ID to TOKEN.py2⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:2012
-