Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
1cinerotiqu...__.pyc
windows7-x64
3cinerotiqu...__.pyc
windows10-2004-x64
3cinerotiqu...ts.pyc
windows7-x64
3cinerotiqu...ts.pyc
windows10-2004-x64
3cinerotiqu...on.pyc
windows7-x64
3cinerotiqu...on.pyc
windows10-2004-x64
3cinerotiqu...ts.pyc
windows7-x64
3cinerotiqu...ts.pyc
windows10-2004-x64
3cinerotiqu...ns.pyc
windows7-x64
3cinerotiqu...ns.pyc
windows10-2004-x64
3cinerotiqu...on.pyc
windows7-x64
3cinerotiqu...on.pyc
windows10-2004-x64
3cinerotiqu...ns.pyc
windows7-x64
3cinerotiqu...ns.pyc
windows10-2004-x64
3cinerotiqu...ng.pyc
windows7-x64
3cinerotiqu...ng.pyc
windows10-2004-x64
3cinerotiqu...ns.pyc
windows7-x64
3cinerotiqu...ns.pyc
windows10-2004-x64
3cinerotiqu...ls.pyc
windows7-x64
3cinerotiqu...ls.pyc
windows10-2004-x64
3Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
14/06/2024, 07:44
Static task
static1
Behavioral task
behavioral1
Sample
cinerotique_mod_scripts/__init__.pyc
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
cinerotique_mod_scripts/__init__.pyc
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
cinerotique_mod_scripts/add_tag_elements.pyc
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
cinerotique_mod_scripts/add_tag_elements.pyc
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
cinerotique_mod_scripts/display_mod_version.pyc
Resource
win7-20240220-en
Behavioral task
behavioral6
Sample
cinerotique_mod_scripts/display_mod_version.pyc
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
cinerotique_mod_scripts/dlc_pack_tests.pyc
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
cinerotique_mod_scripts/dlc_pack_tests.pyc
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
cinerotique_mod_scripts/inject_testsets_into_interactions.pyc
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
cinerotique_mod_scripts/inject_testsets_into_interactions.pyc
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
cinerotique_mod_scripts/notification.pyc
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
cinerotique_mod_scripts/notification.pyc
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
cinerotique_mod_scripts/object_injections.pyc
Resource
win7-20240611-en
Behavioral task
behavioral14
Sample
cinerotique_mod_scripts/object_injections.pyc
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
cinerotique_mod_scripts/objects_handling.pyc
Resource
win7-20240220-en
Behavioral task
behavioral16
Sample
cinerotique_mod_scripts/objects_handling.pyc
Resource
win10v2004-20240611-en
Behavioral task
behavioral17
Sample
cinerotique_mod_scripts/tuning_injections.pyc
Resource
win7-20240508-en
Behavioral task
behavioral18
Sample
cinerotique_mod_scripts/tuning_injections.pyc
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
cinerotique_mod_scripts/utils.pyc
Resource
win7-20240508-en
Behavioral task
behavioral20
Sample
cinerotique_mod_scripts/utils.pyc
Resource
win10v2004-20240611-en
General
-
Target
cinerotique_mod_scripts/__init__.pyc
-
Size
136B
-
MD5
ddd7455f8155c9097df926938166cfe7
-
SHA1
c008541cddc60a49e2b1b3345173e7b11918fe8b
-
SHA256
2fb1e2c076914590a2b51be5f36ecc6f790c8154a4327f8dcd92eb92abd31401
-
SHA512
e8f5b541e15b63701fe7461277d3de210f537db6d04375815cfb80a76d4d65f066f7bb62328f2a15897b41e6e4c2492c57919835df60b1b0cadc158f86872eca
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\pyc_auto_file\shell\Read\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.pyc rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.pyc\ = "pyc_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\pyc_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\pyc_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\pyc_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\pyc_auto_file\ rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2608 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2608 AcroRd32.exe 2608 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2276 wrote to memory of 2688 2276 cmd.exe 29 PID 2276 wrote to memory of 2688 2276 cmd.exe 29 PID 2276 wrote to memory of 2688 2276 cmd.exe 29 PID 2688 wrote to memory of 2608 2688 rundll32.exe 30 PID 2688 wrote to memory of 2608 2688 rundll32.exe 30 PID 2688 wrote to memory of 2608 2688 rundll32.exe 30 PID 2688 wrote to memory of 2608 2688 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\cinerotique_mod_scripts\__init__.pyc1⤵
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\cinerotique_mod_scripts\__init__.pyc2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\cinerotique_mod_scripts\__init__.pyc"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2608
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5c6017602c731726cc2133837ba10e91b
SHA1dbe384a9792c09e2de3bb4b8c33fce40f3d0d822
SHA2569b09d61d1b10a9507e6a9a946edf4b9e6148b1ee9824fab1cf0b5ca4f3c3ccb1
SHA51221e094e55121a33868911cb8d994916d8a57ac9e7e1d03274c85e3ac0f882023ee5561a2ac42b68e7b64e96ce3a9833cf67f272e00f8225b2f5000fc8fe8cbf0