Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
06/07/2024, 22:12
General
-
Target
HaterCollecter.pyc
-
Size
57KB
-
MD5
3e6b658da688b5e4538d96d1f3bba4a3
-
SHA1
c005025e0f67d5385ba594ef0639af12b72c61b8
-
SHA256
896e62a81fa894962f65ee18adde9da069936f133bc7f2e0ef7dc35ea5b473ca
-
SHA512
769ca6f5c7664f6354cd988bfdd3f7f389a8c095a82990403e871efa61552088d4577f1d8ebf4ad0edbcbea9741a8449c9a47cd5f1b7f5dce61d5b8eb89ee4bc
-
SSDEEP
768:v16L99lxW4Jv09D/rBNVNic7tFMGoVAugA7Lk/7mflDRBfMS6LkX:g34/rlscsAugAXkjIltBfELkX
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 27 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\HaterCollecter.pyc1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\HaterCollecter.pyc2⤵
- Opens file in notepad (likely ransom note)
-