Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
8Static
static
8Builder.bat
windows7-x64
1Builder.bat
windows10-2004-x64
1Components...OBF.py
windows7-x64
3Components...OBF.py
windows10-2004-x64
3Components/loader.py
windows7-x64
3Components/loader.py
windows10-2004-x64
3Components...ess.py
windows7-x64
3Components...ess.py
windows10-2004-x64
3Components/process.py
windows7-x64
3Components/process.py
windows10-2004-x64
3Components/rar.exe
windows7-x64
3Components/rar.exe
windows10-2004-x64
3Components/run.bat
windows7-x64
1Components/run.bat
windows10-2004-x64
1Components...ief.py
windows7-x64
3Components...ief.py
windows10-2004-x64
3Components/stub.py
windows7-x64
3Components/stub.py
windows10-2004-x64
3Components/upx.exe
windows7-x64
7Components/upx.exe
windows10-2004-x64
7Extras/unb...tes.py
windows7-x64
3Extras/unb...tes.py
windows10-2004-x64
3env/Script...xa.dll
windows7-x64
1env/Script...xa.dll
windows10-2004-x64
1env/Script...lt.exe
windows7-x64
1env/Script...lt.exe
windows10-2004-x64
1env/Script...64.exe
windows7-x64
1env/Script...64.exe
windows10-2004-x64
1env/Script...En.exe
windows7-x64
1env/Script...En.exe
windows10-2004-x64
1env/Script...64.exe
windows7-x64
1env/Script...64.exe
windows10-2004-x64
1Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
07/06/2024, 00:57
Behavioral task
behavioral1
Sample
Builder.bat
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Builder.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
Components/BlankOBF.py
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
Components/BlankOBF.py
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
Components/loader.py
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
Components/loader.py
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
Components/postprocess.py
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
Components/postprocess.py
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
Components/process.py
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
Components/process.py
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
Components/rar.exe
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
Components/rar.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
Components/run.bat
Resource
win7-20240508-en
Behavioral task
behavioral14
Sample
Components/run.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
Components/sigthief.py
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
Components/sigthief.py
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
Components/stub.py
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
Components/stub.py
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
Components/upx.exe
Resource
win7-20240508-en
Behavioral task
behavioral20
Sample
Components/upx.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
Extras/unblock_sites.py
Resource
win7-20240220-en
Behavioral task
behavioral22
Sample
Extras/unblock_sites.py
Resource
win10v2004-20240426-en
Behavioral task
behavioral23
Sample
env/Scripts/dist/7zxa.dll
Resource
win7-20231129-en
Behavioral task
behavioral24
Sample
env/Scripts/dist/7zxa.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
env/Scripts/dist/Default.exe
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
env/Scripts/dist/Default.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
env/Scripts/dist/Default64.exe
Resource
win7-20240508-en
Behavioral task
behavioral28
Sample
env/Scripts/dist/Default64.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral29
Sample
env/Scripts/dist/DefaultEn.exe
Resource
win7-20240508-en
Behavioral task
behavioral30
Sample
env/Scripts/dist/DefaultEn.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral31
Sample
env/Scripts/dist/DefaultEn64.exe
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
env/Scripts/dist/DefaultEn64.exe
Resource
win10v2004-20240226-en
General
-
Target
Components/loader.py
-
Size
634B
-
MD5
ca35548638710a32f6d4bc1a61a103c5
-
SHA1
2703967c4376cc2e0ca20191eff97b85989d8310
-
SHA256
e7dbfe873c719006f28e6526ef54215d7b7598bce5566734c552dab9f1f487e6
-
SHA512
d1c0839326662b240dfa4bcea7284d261be46e9bb8b03f073e0328e361321f9cdfa740abd4541b2cdc21c806bcd901d3bc3cc36b9f7e0ee6191d189df0533061
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\py_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\py_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\py_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\py_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.py rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.py\ = "py_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\py_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2632 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2632 AcroRd32.exe 2632 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2928 wrote to memory of 2652 2928 cmd.exe 29 PID 2928 wrote to memory of 2652 2928 cmd.exe 29 PID 2928 wrote to memory of 2652 2928 cmd.exe 29 PID 2652 wrote to memory of 2632 2652 rundll32.exe 30 PID 2652 wrote to memory of 2632 2652 rundll32.exe 30 PID 2652 wrote to memory of 2632 2652 rundll32.exe 30 PID 2652 wrote to memory of 2632 2652 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Components\loader.py1⤵
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Components\loader.py2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Components\loader.py"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2632
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD576df5600a46788e8cbae741d6f1c8d81
SHA12e958ecc234496508adcd738feca2c2e3c52f2d2
SHA256167e33bada4406548666367d5e55dd62aac47856070493f543163dbe3ff5d446
SHA512b7f107f5c6b67e63c8affb2ed9a9934af7f87a3962c055a1953efd88d4143534af63c7ce78d9fb6e5d808b1f31df6e3e37ca9554461b3d5b33b9c951de38a1b4