Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

13/07/2024, 23:11

240713-26p46asgld 8

13/07/2024, 20:33

240713-zb9h7swdpk 8

11/07/2024, 21:44

240711-1lnj6axfpd 8

11/07/2024, 21:32

240711-1d16aaxcrf 8

11/07/2024, 21:29

240711-1b5qpaxcke 8

11/07/2024, 21:25

240711-z9kmqsvcnm 8

11/07/2024, 21:22

240711-z7xvaavbrp 8

11/07/2024, 21:20

240711-z6q1cavbmj 8

11/07/2024, 21:16

240711-z4v7aawhrd 8

Analysis

  • max time kernel
    117s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    11/07/2024, 21:29

General

  • Target

    Blank-Grabber-main/Blank Grabber/Components/__pycache__/process.cpython-310.pyc

  • Size

    7KB

  • MD5

    0c2f950a5f92cacf729ffec49c27863e

  • SHA1

    6dc70e891a84b083bda8b86f618a5f08139ff503

  • SHA256

    467722164fcb956d788620d428f5548afe9976f74e950b6f63494594da7834fa

  • SHA512

    51fdacd66a3758a72e4ffe05d34052c6fb128839b512348b7b1b13c0f58fde3cb3053e4bbd0df722dcb4ceddfb8d1e396e11d1d5c1047217d05bb365f7d527b5

  • SSDEEP

    96:5t51N4wrEkxdfo6fbZJTmB1glto1DZ8D44U4qIL3by3zh6cEG1j3rx:T51N4ytxZ7HmBCl8w44UdMIIOj3rx

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\Blank-Grabber-main\Blank Grabber\Components\__pycache__\process.cpython-310.pyc"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1680
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Blank-Grabber-main\Blank Grabber\Components\__pycache__\process.cpython-310.pyc
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1060
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Blank-Grabber-main\Blank Grabber\Components\__pycache__\process.cpython-310.pyc"
        3⤵
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2740

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    3d82d789916a040d5b5e1e640c8a6b80

    SHA1

    388f7ff4194190d58f312b989e3ba8170b3de51a

    SHA256

    2a324ae838a1b9e34dd5d452445e72bf6c0ab5ccac86fc61e5ea83fba71324f9

    SHA512

    bdd32e6162f27fda8d0368828ff313a63231887bd84170a87dd0062fd15ba626f504698849ac96da511414cd223917a84a55e8de738674a9c95c6d2d4ad94ef4