Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
8Static
static
8Blank-Grab...er.bat
windows11-21h2-x64
8Blank-Grab...OBF.py
windows11-21h2-x64
3Blank-Grab...10.pyc
windows11-21h2-x64
3Blank-Grab...10.pyc
windows11-21h2-x64
3Blank-Grab...10.pyc
windows11-21h2-x64
3Blank-Grab...der.py
windows11-21h2-x64
3Blank-Grab...ess.py
windows11-21h2-x64
3Blank-Grab...ess.py
windows11-21h2-x64
3Blank-Grab...ar.exe
windows11-21h2-x64
3Blank-Grab...un.bat
windows11-21h2-x64
1Blank-Grab...ief.py
windows11-21h2-x64
3Blank-Grab...tub.py
windows11-21h2-x64
3Blank-Grab...px.exe
windows11-21h2-x64
7Blank-Grab...tes.py
windows11-21h2-x64
3Blank-Grab...gui.py
windows11-21h2-x64
3Blank-Grab...er.bat
windows11-21h2-x64
1Blank-Grab...OBF.py
windows11-21h2-x64
3Blank-Grab...10.pyc
windows11-21h2-x64
3Blank-Grab...10.pyc
windows11-21h2-x64
3Blank-Grab...10.pyc
windows11-21h2-x64
3Blank-Grab...der.py
windows11-21h2-x64
3Blank-Grab...ess.py
windows11-21h2-x64
3Blank-Grab...ess.py
windows11-21h2-x64
3Blank-Grab...ar.exe
windows11-21h2-x64
3Blank-Grab...un.bat
windows11-21h2-x64
1Blank-Grab...ief.py
windows11-21h2-x64
3Blank-Grab...tub.py
windows11-21h2-x64
3Blank-Grab...px.exe
windows11-21h2-x64
7Blank-Grab...tes.py
windows11-21h2-x64
3Blank-Grab...gui.py
windows11-21h2-x64
3Resubmissions
13/07/2024, 23:11
240713-26p46asgld 813/07/2024, 20:33
240713-zb9h7swdpk 811/07/2024, 21:44
240711-1lnj6axfpd 811/07/2024, 21:32
240711-1d16aaxcrf 811/07/2024, 21:29
240711-1b5qpaxcke 811/07/2024, 21:25
240711-z9kmqsvcnm 811/07/2024, 21:22
240711-z7xvaavbrp 811/07/2024, 21:20
240711-z6q1cavbmj 811/07/2024, 21:16
240711-z4v7aawhrd 8Analysis
-
max time kernel
416s -
max time network
423s -
platform
windows11-21h2_x64 -
resource
win11-20240709-en -
resource tags
arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system -
submitted
13/07/2024, 23:11
Behavioral task
behavioral1
Sample
Blank-Grabber-main/Blank Grabber/Builder.bat
Resource
win11-20240709-en
Behavioral task
behavioral2
Sample
Blank-Grabber-main/Blank Grabber/Components/BlankOBF.py
Resource
win11-20240709-en
Behavioral task
behavioral3
Sample
Blank-Grabber-main/Blank Grabber/Components/__pycache__/BlankOBF.cpython-310.pyc
Resource
win11-20240709-en
Behavioral task
behavioral4
Sample
Blank-Grabber-main/Blank Grabber/Components/__pycache__/process.cpython-310.pyc
Resource
win11-20240709-en
Behavioral task
behavioral5
Sample
Blank-Grabber-main/Blank Grabber/Components/__pycache__/sigthief.cpython-310.pyc
Resource
win11-20240709-en
Behavioral task
behavioral6
Sample
Blank-Grabber-main/Blank Grabber/Components/loader.py
Resource
win11-20240709-en
Behavioral task
behavioral7
Sample
Blank-Grabber-main/Blank Grabber/Components/postprocess.py
Resource
win11-20240709-en
Behavioral task
behavioral8
Sample
Blank-Grabber-main/Blank Grabber/Components/process.py
Resource
win11-20240709-en
Behavioral task
behavioral9
Sample
Blank-Grabber-main/Blank Grabber/Components/rar.exe
Resource
win11-20240709-en
Behavioral task
behavioral10
Sample
Blank-Grabber-main/Blank Grabber/Components/run.bat
Resource
win11-20240709-en
Behavioral task
behavioral11
Sample
Blank-Grabber-main/Blank Grabber/Components/sigthief.py
Resource
win11-20240709-en
Behavioral task
behavioral12
Sample
Blank-Grabber-main/Blank Grabber/Components/stub.py
Resource
win11-20240709-en
Behavioral task
behavioral13
Sample
Blank-Grabber-main/Blank Grabber/Components/upx.exe
Resource
win11-20240709-en
Behavioral task
behavioral14
Sample
Blank-Grabber-main/Blank Grabber/Extras/unblock_sites.py
Resource
win11-20240709-en
Behavioral task
behavioral15
Sample
Blank-Grabber-main/Blank Grabber/gui.py
Resource
win11-20240709-en
Behavioral task
behavioral16
Sample
Blank-Grabber-main/grabb/Builder.bat
Resource
win11-20240709-en
Behavioral task
behavioral17
Sample
Blank-Grabber-main/grabb/Components/BlankOBF.py
Resource
win11-20240709-en
Behavioral task
behavioral18
Sample
Blank-Grabber-main/grabb/Components/__pycache__/BlankOBF.cpython-310.pyc
Resource
win11-20240709-en
Behavioral task
behavioral19
Sample
Blank-Grabber-main/grabb/Components/__pycache__/process.cpython-310.pyc
Resource
win11-20240709-en
Behavioral task
behavioral20
Sample
Blank-Grabber-main/grabb/Components/__pycache__/sigthief.cpython-310.pyc
Resource
win11-20240709-en
Behavioral task
behavioral21
Sample
Blank-Grabber-main/grabb/Components/loader.py
Resource
win11-20240709-en
Behavioral task
behavioral22
Sample
Blank-Grabber-main/grabb/Components/postprocess.py
Resource
win11-20240709-en
Behavioral task
behavioral23
Sample
Blank-Grabber-main/grabb/Components/process.py
Resource
win11-20240709-en
Behavioral task
behavioral24
Sample
Blank-Grabber-main/grabb/Components/rar.exe
Resource
win11-20240709-en
Behavioral task
behavioral25
Sample
Blank-Grabber-main/grabb/Components/run.bat
Resource
win11-20240709-en
Behavioral task
behavioral26
Sample
Blank-Grabber-main/grabb/Components/sigthief.py
Resource
win11-20240709-en
Behavioral task
behavioral27
Sample
Blank-Grabber-main/grabb/Components/stub.py
Resource
win11-20240709-en
Behavioral task
behavioral28
Sample
Blank-Grabber-main/grabb/Components/upx.exe
Resource
win11-20240709-en
Behavioral task
behavioral29
Sample
Blank-Grabber-main/grabb/Extras/unblock_sites.py
Resource
win11-20240709-en
Behavioral task
behavioral30
Sample
Blank-Grabber-main/grabb/gui.py
Resource
win11-20240709-en
General
-
Target
Blank-Grabber-main/grabb/Components/__pycache__/sigthief.cpython-310.pyc
-
Size
6KB
-
MD5
11bbb90de40c37b8b031e4c6479b0c92
-
SHA1
55b2c2043db5719c0d483f2c7d6ead847cf710d5
-
SHA256
a55f8e02d66da616f8708ea1f1c7544b94158842cf83e3ee18075f6dd2ba1f16
-
SHA512
aed5944dd60ad4978bc86466d801e3d668d0b822fb5295c22aa91ddebb961e741dc31963c28e322582144c625eeb9931aaa12707de43a827d5fdb995d2be9133
-
SSDEEP
96:mXcH6ZnJ9DL12YMmlNvOTySgevwqmIWTx2VvrfflkcpwZFU0Ep:mkUflNvOTyPqdWTMdrXltuFc
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2400 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Blank-Grabber-main\grabb\Components\__pycache__\sigthief.cpython-310.pyc1⤵
- Modifies registry class
PID:3440
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2400