Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
27/07/2024, 12:19 UTC
Static task
static1
Behavioral task
behavioral1
Sample
3d.py
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3d.py
Resource
win10v2004-20240709-en
General
-
Target
3d.py
-
Size
2KB
-
MD5
a65538efe5a428646c2068c75ff500ac
-
SHA1
91eff7472be8cf14d0f866c336f8186a696ba643
-
SHA256
4e6d0b49ce3a8f3feb238f087ecbb68ddde8f2e10393a4dd9ef134f2606519f3
-
SHA512
cb23b6f0d50b8bfa46ea233d1f2ed13c4a80d387585f5e2781ad5ea9b16b395479756c5a58086051784589d92bfd85f6f3cec61182301475b64e281558f5c933
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_Classes\Local Settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\.py\ = "py_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\py_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\py_auto_file\shell rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\py_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\py_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\.py rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\py_auto_file\shell\Read\command rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2588 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2588 AcroRd32.exe 2588 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2852 wrote to memory of 2696 2852 cmd.exe 31 PID 2852 wrote to memory of 2696 2852 cmd.exe 31 PID 2852 wrote to memory of 2696 2852 cmd.exe 31 PID 2696 wrote to memory of 2588 2696 rundll32.exe 32 PID 2696 wrote to memory of 2588 2696 rundll32.exe 32 PID 2696 wrote to memory of 2588 2696 rundll32.exe 32 PID 2696 wrote to memory of 2588 2696 rundll32.exe 32
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\3d.py1⤵
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\3d.py2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\3d.py"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2588
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD598ddea64aa9e1e17f83d3399767a2c4d
SHA18a41b23d76c33cf81a091c1e5268ae160584150c
SHA2562115e5625cd73161af5db585e30efbda4a14a3fd0fd881ffa06b82c7f496f722
SHA51279761d96dd777dcd997daad2ead076738ac1cd729e2545f9b93f5147fd85f9c1f2c0a630208686d36b48f2925bdf25312a914cdfed8b6821a948b22b030af793