Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    137s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    30/05/2024, 16:10

General

  • Target

    loader.py

  • Size

    444KB

  • MD5

    0da03c4b07a24f885ad2dcaee1c4465c

  • SHA1

    d1fc34925e62827f4908b49a73b0fd351a827604

  • SHA256

    92295bfd781d95551475fac81734bd03f6facee877f439438d8d48f27c93f036

  • SHA512

    6dddab9a1a73d178104b2d08ea372d2bf493f34b36ae1fdf75e049ce87d1d230f57e0b958138b0120172d4634e69080eb8e88ff60c8270493f4122d6c285ff05

  • SSDEEP

    12288:/A0uRUS1WsyOFmNinKk2REiOG2C4YN+H83G3OBP0o:/A0uRnmaiO9CtN+H8S5o

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\loader.py
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2164
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\loader.py
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2732
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\loader.py"
        3⤵
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2772

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    d877ec20e701892362050bd19bcb2988

    SHA1

    dd114e10b5ae18b52d9dbb14931b6c1b9e22462e

    SHA256

    5c90ddae24a01fce71584795904f15333b071855873c2efcc656e13b18c4e6e9

    SHA512

    757280fb220036dd067385297e332c22b1aff34ad5c7977a4c059199ffc48b5c1ef7f57ce07f84515524d643ad58a2150542fd35f060fb6a4c0b7289d91e2ac2