Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    07/06/2024, 05:57 UTC

General

  • Target

    Luna-Grabber-main/luna.py

  • Size

    5KB

  • MD5

    c082dbb0f0fa8511937468782e1daff6

  • SHA1

    0cdb95cc8e3cd75e39abfa584e6afa3e4d2599a4

  • SHA256

    1affe34c9a0f84fc1ecf2bcdc306cdcac37109674356a322b111ed938e8b34bf

  • SHA512

    cbeb47397afdb280f3dbd4a823849645ef99f9d87f9aa585ced100e90ed90ca80ba46928eb2498bfafbc9822280d2467ac4571da3b59e01e8fe86c9960a08112

  • SSDEEP

    96:93u/XXGmDAmxlEPQVbqGVHChjl0t9u3fk2+nqB4k6SAVuFODeA3:xeGSx1Ehh0OR+nqB1aR3

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Luna-Grabber-main\luna.py
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2848
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Luna-Grabber-main\luna.py
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2396
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Luna-Grabber-main\luna.py"
        3⤵
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2568

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    d108af7e7982dff7045830d81f43f242

    SHA1

    a8f73375f089aa8e6286ac36032c89eb3a4f4c1a

    SHA256

    12cd6481baf6e695df74985641f7320238c03e830c1b15c8541168f68a1dcf21

    SHA512

    d37e6fb6bb6bc6800ad9aec3c4734785aa03ae87fdfc1f6c5745f36de4349f53c3c4e5e8c9befaf86e257bc4b46b69bec321f5cc5b737160946ee1634aad5314

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.