Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    10/07/2024, 17:18

General

  • Target

    cstealer.pyc

  • Size

    75KB

  • MD5

    44d80709f492610a377eafff857aa413

  • SHA1

    91e53c38437797bd7e0ae5bb45a3e03144c4ec21

  • SHA256

    2312b7c1b6704e66d44d44971fed7492d2fa9655009e3cc00c6a7a79e59d8c53

  • SHA512

    b3b42555de7648aa4a1d6dfc94ae0503964913af7baa9528b623e5f9991a560734d43b9c88608a3cca5f13c507debfd4711951230d2932933d981b7c0b31f0d0

  • SSDEEP

    1536:DvIiOtbI3vkwsJlYaa2Is8qRai+jjV6P4grrRheEX:DvQ29t2Is8HdgP4grrRnX

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\cstealer.pyc
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2624
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\cstealer.pyc
      2⤵
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of WriteProcessMemory
      PID:2540
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\cstealer.pyc"
        3⤵
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2556

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    cc64198daaa4c6f553ae543080f08efa

    SHA1

    ee86085a0e42f1d1f24aeb187d6862e10ffae030

    SHA256

    7fd02db8a1b0a3defc499ca084ab8c4eef365a8df4e402cb2ee152ae3af1f1ec

    SHA512

    f7ea619982986667fd1deda3f70dd405866ca38fa3fe44e5caa1bfaca63b05a34c32056b3bb5381622917c118457446fb18dbabfb53f1662ac4a5ddec42e8cf0