Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    07/06/2024, 05:57

General

  • Target

    Luna-Grabber-main/options/CommonFiles.py

  • Size

    2KB

  • MD5

    b353e5de3cba26130e975ad68f5f3101

  • SHA1

    1aa66593f9970c9c0d8586310d1f9a89ad768741

  • SHA256

    c7f836fdf1b08617032556dba562249ac2933638c24eaba3cc82badacb18830f

  • SHA512

    d012433a24fbbf77c38168c9fbf9bf75e5bebfb580a334370bb2c05705480ab7e4108628528b176d0b132f391d96809615cd231f8175b91a531a9f7d277282d8

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Luna-Grabber-main\options\CommonFiles.py
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2740
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Luna-Grabber-main\options\CommonFiles.py
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2528
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Luna-Grabber-main\options\CommonFiles.py"
        3⤵
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2552

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    b1a136c4fa88681ff2e4f4b99896b517

    SHA1

    5a41f5174be2c05ff3e92c6e4a5f388b5a12fb05

    SHA256

    fd3e4aceadf6cdfc895fed604230fe747b3dba0ea5330dac4e93b57a70fccf35

    SHA512

    7faf7eabc0c74ef06808bda8ed207a430b29de486e72a42ee601dcdafe2ea485b64c8d1374bde19e6d4d34b108cf4a82ba0e32215d7523c0458f652c4d9a37d9