Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
16s -
max time network
17s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
21/06/2024, 19:20
Behavioral task
behavioral1
Sample
Electron_V3.rar
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
Electron V3/ElectronV3.exe
Resource
win10-20240611-en
Behavioral task
behavioral3
Sample
Stub.pyc
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
Electron V3/bin/agree.txt
Resource
win10-20240404-en
Behavioral task
behavioral5
Sample
Electron V3/scripts/Inf Yield.txt
Resource
win10-20240404-en
Behavioral task
behavioral6
Sample
Electron V3/workspace/IY_FE.iy
Resource
win10-20240404-en
General
-
Target
Stub.pyc
-
Size
799KB
-
MD5
770585a4e7175a5f3acb6a7ab6c72bbb
-
SHA1
9fcc7498c944190b167a5f73932c5b92f573444f
-
SHA256
d1fd92f6099cc0dbe71d4c1b70cc608d7b7ef929bc270b6febe1ea08264a2748
-
SHA512
8ce3be9406636678f2b63c4aae2dcc5b06a96b078b1eaec2a80f5ffd495067676e0cb3c430058d7867ccfd154187d54c3af59503bd62f138f55684f7d73791d9
-
SSDEEP
12288:+gEFvz619CSHpXW+xQE5whanVHtE2zcGcXLrK0bCWZwUA913fVPWjw8fCmO:+1vzMMSHpm+GhaVd+rUBn3fYamO
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1708 OpenWith.exe