Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

10/06/2024, 13:26

240610-qpxbcsxbra 8

10/06/2024, 13:22

240610-qmq2kaxfll 8

10/06/2024, 13:16

240610-qh9m4swhle 8

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    10/06/2024, 13:22

General

  • Target

    PySilon-malware-main/builder.py

  • Size

    30KB

  • MD5

    f011ab09f5e640bbf339d9edd93e2739

  • SHA1

    cfe055600b42ed2eb3b77c3f9632301cd4c3e6dd

  • SHA256

    443bd85e3bf8d6a5880400025047933bf58e7cccdb9f1c7585fc6932113f2fdb

  • SHA512

    bdae087b6fa1a781805fa8a1a2b248e23226261bb4be179dcf1b762f0a1241f7d697797434f23e0820ab39b4c6156c9b4674383cdfb251ce346351132b6ee3b3

  • SSDEEP

    768:d2PufIVSZvFWL2sthHqxFgYP0kqhvqeju:d22QEZvMLp/HqxFgYP0kqhvqei

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\PySilon-malware-main\builder.py
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1720
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\PySilon-malware-main\builder.py
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2656
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\PySilon-malware-main\builder.py"
        3⤵
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2716

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    a5166c9c7a079ca9e90389b3a0ad2418

    SHA1

    468748fcc7885798eee551ae23e87588bc4621ad

    SHA256

    519c461d5dc3075966571c46a61dcfb1a8570501b98fd5dc1ef277f3e3e8fed1

    SHA512

    a094705c11880416617e95281570280e654df25829d39dc56455d49d3697a815e6805c195fea3c11e3cfc21e1741aacb17773b5e9bff1712bf05c1fb9ad9408e