Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
11/07/2024, 05:49
240711-gh3ecsvala 511/07/2024, 05:46
240711-gggfhasakr 311/07/2024, 05:43
240711-geqama1hmn 5Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
11/07/2024, 05:43
Static task
static1
Behavioral task
behavioral1
Sample
lxgs_destroyer_9000_️_🔥.py
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
lxgs_destroyer_9000_️_🔥.py
Resource
win10v2004-20240709-en
General
-
Target
lxgs_destroyer_9000_️_🔥.py
-
Size
7KB
-
MD5
7f392adfa9733c8d7011f625d442ffaf
-
SHA1
80a85a1ff51608abc3b3f9ea65b0a2e09503f8c9
-
SHA256
dafcf2e5192082a3dc33b2c82fa70b62c661a5fc548c6494ec590a97ff53e702
-
SHA512
d7d06a22c8e5585ea2a641c349d6dfcd72e828e88824500a4c2ef82153161e1f044f208c304f7a70965b96d3ad142903fca1933669671d384eab0763164f088b
-
SSDEEP
96:M4wzpIKNcDOjmiDxYhkAevEYGdPiAQmPyFVGDeCae+M4KUOhPKM8S4V:KpIKNIMfBvvEYgaGyIqowKTT8S4V
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2880 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2196 wrote to memory of 2880 2196 cmd.exe 31 PID 2196 wrote to memory of 2880 2196 cmd.exe 31 PID 2196 wrote to memory of 2880 2196 cmd.exe 31
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\lxgs_destroyer_9000_️_🔥.py1⤵
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\lxgs_destroyer_9000_️_🔥.py2⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:2880
-