Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
19/07/2024, 04:07
Behavioral task
behavioral1
Sample
SolaraTSBV2.0.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
SolaraTSBV2.0.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
Stub.pyc
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
Stub.pyc
Resource
win10v2004-20240709-en
General
-
Target
Stub.pyc
-
Size
875KB
-
MD5
aa3f78f425af3e9980c6dc1d11c8ccfb
-
SHA1
98c82b1a60bbc0b88c23e0858dc54a7448def95c
-
SHA256
c15f682d5704649934eed26c40e34e71621933a9a60ab38e500e4a1dce84c334
-
SHA512
83ceba6cae67e94d696472d8ad9e3e4cb42178cd78713af26ff4b578ab0c4033d95c0a8ffa82a8ee6d7869069d1de04ae5d47b3d203dce1a78a6b10361e25538
-
SSDEEP
12288:vOfvwDWpnW4fai+EQbMcGIi5wgCjL6ncOWgMd9XpzQ/NIOm3FbhAYfQR69vsua:W3wUnRaizcQgL9OW31XhZwT
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\pyc_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\pyc_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\.pyc rundll32.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\pyc_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_Classes\Local Settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\.pyc\ = "pyc_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\pyc_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\pyc_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2860 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2860 AcroRd32.exe 2860 AcroRd32.exe 2860 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2320 wrote to memory of 2800 2320 cmd.exe 31 PID 2320 wrote to memory of 2800 2320 cmd.exe 31 PID 2320 wrote to memory of 2800 2320 cmd.exe 31 PID 2800 wrote to memory of 2860 2800 rundll32.exe 33 PID 2800 wrote to memory of 2860 2800 rundll32.exe 33 PID 2800 wrote to memory of 2860 2800 rundll32.exe 33 PID 2800 wrote to memory of 2860 2800 rundll32.exe 33
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Stub.pyc1⤵
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Stub.pyc2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Stub.pyc"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2860
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5ddcfb024ab964f82a65a29b1cb0e595d
SHA139a2806d84bb711b6a57e2d8757b0547dcd4ec58
SHA25656bce94a8b3a77a47d2fe6d0209abb50b21aea573bf0e86ccdec5aea18752751
SHA512bab63e13acf9ccb169d563c10f79b991e8c5a505eb31c7ebb9014b3824feaad030fd974c067eb39b3db18d11d313a86193b6b7686a4c5a4c13851e96cbb4c0b6