Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
30/05/2024, 16:10
Static task
static1
Behavioral task
behavioral1
Sample
loader.py
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
loader.py
Resource
win10v2004-20240508-en
General
-
Target
loader.py
-
Size
444KB
-
MD5
0da03c4b07a24f885ad2dcaee1c4465c
-
SHA1
d1fc34925e62827f4908b49a73b0fd351a827604
-
SHA256
92295bfd781d95551475fac81734bd03f6facee877f439438d8d48f27c93f036
-
SHA512
6dddab9a1a73d178104b2d08ea372d2bf493f34b36ae1fdf75e049ce87d1d230f57e0b958138b0120172d4634e69080eb8e88ff60c8270493f4122d6c285ff05
-
SSDEEP
12288:/A0uRUS1WsyOFmNinKk2REiOG2C4YN+H83G3OBP0o:/A0uRnmaiO9CtN+H8S5o
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\py_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\py_auto_file\ rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.py\ = "py_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\py_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\py_auto_file\shell\Read\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.py rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\py_auto_file\shell rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2772 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2772 AcroRd32.exe 2772 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2164 wrote to memory of 2732 2164 cmd.exe 29 PID 2164 wrote to memory of 2732 2164 cmd.exe 29 PID 2164 wrote to memory of 2732 2164 cmd.exe 29 PID 2732 wrote to memory of 2772 2732 rundll32.exe 30 PID 2732 wrote to memory of 2772 2732 rundll32.exe 30 PID 2732 wrote to memory of 2772 2732 rundll32.exe 30 PID 2732 wrote to memory of 2772 2732 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\loader.py1⤵
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\loader.py2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\loader.py"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2772
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5d877ec20e701892362050bd19bcb2988
SHA1dd114e10b5ae18b52d9dbb14931b6c1b9e22462e
SHA2565c90ddae24a01fce71584795904f15333b071855873c2efcc656e13b18c4e6e9
SHA512757280fb220036dd067385297e332c22b1aff34ad5c7977a4c059199ffc48b5c1ef7f57ce07f84515524d643ad58a2150542fd35f060fb6a4c0b7289d91e2ac2