Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
268s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
26/05/2024, 23:09
Behavioral task
behavioral1
Sample
MegaAIO.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
MegaAIO.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
main.pyc
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
main.pyc
Resource
win10v2004-20240226-en
General
-
Target
main.pyc
-
Size
2KB
-
MD5
fb424145b420727883f2ab26d3450f7a
-
SHA1
835fbb48c0f73b41ac4c186b984229762faf9a28
-
SHA256
9d01cda94b5baeb9ae9e680065ae0e7599e3aa5881a411cd52732e299456c58a
-
SHA512
b3ef31622e4b291c190e4336f54ba4fd44867733e52c07cb3966ea696b2d1f35c3e60be4efd2090be08bbbdcaa72e5987786508e31293007cac4f336cb4187a2
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\.pyc\ = "pyc_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\pyc_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\.pyc rundll32.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\pyc_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\pyc_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\pyc_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\pyc_auto_file\ rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2644 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2644 AcroRd32.exe 2644 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2460 wrote to memory of 2660 2460 cmd.exe 29 PID 2460 wrote to memory of 2660 2460 cmd.exe 29 PID 2460 wrote to memory of 2660 2460 cmd.exe 29 PID 2660 wrote to memory of 2644 2660 rundll32.exe 30 PID 2660 wrote to memory of 2644 2660 rundll32.exe 30 PID 2660 wrote to memory of 2644 2660 rundll32.exe 30 PID 2660 wrote to memory of 2644 2660 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\main.pyc1⤵
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\main.pyc2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\main.pyc"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2644
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD595adfb1a3787fbfac6e46d600adbc6cd
SHA1de89f365f3d7bd67f150731bda4a9d24ceeb2e49
SHA2560ea9bc996caf186146b358090d53a8d2128987d1df6f71208f3ba23ea986b333
SHA512cbcf6b7e61b6a58f4495d4c57d150619e3cf452c9bc4c171821f148401ad2eae28df26ecce1e499b0fd33839711c3bbe3469d046585f338c52713ce0877db195