Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
8Static
static
8Blank-Grab...er.bat
windows7-x64
1Blank-Grab...er.bat
windows10-2004-x64
1Blank-Grab...OBF.py
windows7-x64
3Blank-Grab...OBF.py
windows10-2004-x64
3Blank-Grab...10.pyc
windows7-x64
3Blank-Grab...10.pyc
windows10-2004-x64
3Blank-Grab...10.pyc
windows7-x64
3Blank-Grab...10.pyc
windows10-2004-x64
3Blank-Grab...10.pyc
windows7-x64
3Blank-Grab...10.pyc
windows10-2004-x64
3Blank-Grab...der.py
windows7-x64
3Blank-Grab...der.py
windows10-2004-x64
3Blank-Grab...ess.py
windows7-x64
3Blank-Grab...ess.py
windows10-2004-x64
3Blank-Grab...ess.py
windows7-x64
3Blank-Grab...ess.py
windows10-2004-x64
3Blank-Grab...ar.exe
windows7-x64
3Blank-Grab...ar.exe
windows10-2004-x64
3Blank-Grab...un.bat
windows7-x64
1Blank-Grab...un.bat
windows10-2004-x64
1Blank-Grab...ief.py
ubuntu-18.04-amd64
1Blank-Grab...ief.py
debian-9-armhf
1Blank-Grab...ief.py
debian-9-mips
1Blank-Grab...ief.py
debian-9-mipsel
1Blank-Grab...tub.py
windows7-x64
3Blank-Grab...tub.py
windows10-2004-x64
3Blank-Grab...px.exe
windows7-x64
7Blank-Grab...px.exe
windows10-2004-x64
7Blank-Grab...tes.py
windows7-x64
3Blank-Grab...tes.py
windows10-2004-x64
3Blank-Grab...gui.py
windows7-x64
3Blank-Grab...gui.py
windows10-2004-x64
3Resubmissions
13/07/2024, 23:11
240713-26p46asgld 813/07/2024, 20:33
240713-zb9h7swdpk 811/07/2024, 21:44
240711-1lnj6axfpd 811/07/2024, 21:32
240711-1d16aaxcrf 811/07/2024, 21:29
240711-1b5qpaxcke 811/07/2024, 21:25
240711-z9kmqsvcnm 811/07/2024, 21:22
240711-z7xvaavbrp 811/07/2024, 21:20
240711-z6q1cavbmj 811/07/2024, 21:16
240711-z4v7aawhrd 8Analysis
-
max time kernel
117s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
11/07/2024, 21:29
Behavioral task
behavioral1
Sample
Blank-Grabber-main/Blank Grabber/Builder.bat
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
Blank-Grabber-main/Blank Grabber/Builder.bat
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
Blank-Grabber-main/Blank Grabber/Components/BlankOBF.py
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
Blank-Grabber-main/Blank Grabber/Components/BlankOBF.py
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
Blank-Grabber-main/Blank Grabber/Components/__pycache__/BlankOBF.cpython-310.pyc
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
Blank-Grabber-main/Blank Grabber/Components/__pycache__/BlankOBF.cpython-310.pyc
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
Blank-Grabber-main/Blank Grabber/Components/__pycache__/process.cpython-310.pyc
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
Blank-Grabber-main/Blank Grabber/Components/__pycache__/process.cpython-310.pyc
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
Blank-Grabber-main/Blank Grabber/Components/__pycache__/sigthief.cpython-310.pyc
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
Blank-Grabber-main/Blank Grabber/Components/__pycache__/sigthief.cpython-310.pyc
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
Blank-Grabber-main/Blank Grabber/Components/loader.py
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
Blank-Grabber-main/Blank Grabber/Components/loader.py
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
Blank-Grabber-main/Blank Grabber/Components/postprocess.py
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
Blank-Grabber-main/Blank Grabber/Components/postprocess.py
Resource
win10v2004-20240709-en
Behavioral task
behavioral15
Sample
Blank-Grabber-main/Blank Grabber/Components/process.py
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
Blank-Grabber-main/Blank Grabber/Components/process.py
Resource
win10v2004-20240709-en
Behavioral task
behavioral17
Sample
Blank-Grabber-main/Blank Grabber/Components/rar.exe
Resource
win7-20240705-en
Behavioral task
behavioral18
Sample
Blank-Grabber-main/Blank Grabber/Components/rar.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral19
Sample
Blank-Grabber-main/Blank Grabber/Components/run.bat
Resource
win7-20240705-en
Behavioral task
behavioral20
Sample
Blank-Grabber-main/Blank Grabber/Components/run.bat
Resource
win10v2004-20240709-en
Behavioral task
behavioral21
Sample
Blank-Grabber-main/Blank Grabber/Components/sigthief.py
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral22
Sample
Blank-Grabber-main/Blank Grabber/Components/sigthief.py
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral23
Sample
Blank-Grabber-main/Blank Grabber/Components/sigthief.py
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral24
Sample
Blank-Grabber-main/Blank Grabber/Components/sigthief.py
Resource
debian9-mipsel-20240418-en
Behavioral task
behavioral25
Sample
Blank-Grabber-main/Blank Grabber/Components/stub.py
Resource
win7-20240704-en
Behavioral task
behavioral26
Sample
Blank-Grabber-main/Blank Grabber/Components/stub.py
Resource
win10v2004-20240709-en
Behavioral task
behavioral27
Sample
Blank-Grabber-main/Blank Grabber/Components/upx.exe
Resource
win7-20240704-en
Behavioral task
behavioral28
Sample
Blank-Grabber-main/Blank Grabber/Components/upx.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral29
Sample
Blank-Grabber-main/Blank Grabber/Extras/unblock_sites.py
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
Blank-Grabber-main/Blank Grabber/Extras/unblock_sites.py
Resource
win10v2004-20240704-en
Behavioral task
behavioral31
Sample
Blank-Grabber-main/Blank Grabber/gui.py
Resource
win7-20240708-en
Behavioral task
behavioral32
Sample
Blank-Grabber-main/Blank Grabber/gui.py
Resource
win10v2004-20240709-en
General
-
Target
Blank-Grabber-main/Blank Grabber/Components/__pycache__/process.cpython-310.pyc
-
Size
7KB
-
MD5
0c2f950a5f92cacf729ffec49c27863e
-
SHA1
6dc70e891a84b083bda8b86f618a5f08139ff503
-
SHA256
467722164fcb956d788620d428f5548afe9976f74e950b6f63494594da7834fa
-
SHA512
51fdacd66a3758a72e4ffe05d34052c6fb128839b512348b7b1b13c0f58fde3cb3053e4bbd0df722dcb4ceddfb8d1e396e11d1d5c1047217d05bb365f7d527b5
-
SSDEEP
96:5t51N4wrEkxdfo6fbZJTmB1glto1DZ8D44U4qIL3by3zh6cEG1j3rx:T51N4ytxZ7HmBCl8w44UdMIIOj3rx
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\pyc_auto_file\ rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\.pyc\ = "pyc_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\pyc_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\pyc_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\pyc_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\.pyc rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\pyc_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2740 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2740 AcroRd32.exe 2740 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1680 wrote to memory of 1060 1680 cmd.exe 31 PID 1680 wrote to memory of 1060 1680 cmd.exe 31 PID 1680 wrote to memory of 1060 1680 cmd.exe 31 PID 1060 wrote to memory of 2740 1060 rundll32.exe 33 PID 1060 wrote to memory of 2740 1060 rundll32.exe 33 PID 1060 wrote to memory of 2740 1060 rundll32.exe 33 PID 1060 wrote to memory of 2740 1060 rundll32.exe 33
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Blank-Grabber-main\Blank Grabber\Components\__pycache__\process.cpython-310.pyc"1⤵
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Blank-Grabber-main\Blank Grabber\Components\__pycache__\process.cpython-310.pyc2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Blank-Grabber-main\Blank Grabber\Components\__pycache__\process.cpython-310.pyc"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2740
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD53d82d789916a040d5b5e1e640c8a6b80
SHA1388f7ff4194190d58f312b989e3ba8170b3de51a
SHA2562a324ae838a1b9e34dd5d452445e72bf6c0ab5ccac86fc61e5ea83fba71324f9
SHA512bdd32e6162f27fda8d0368828ff313a63231887bd84170a87dd0062fd15ba626f504698849ac96da511414cd223917a84a55e8de738674a9c95c6d2d4ad94ef4