Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
1advanced-m...ls.rar
windows7-x64
3advanced-m...ls.rar
windows10-2004-x64
3advanced-m...ain.py
windows7-x64
3advanced-m...ain.py
windows10-2004-x64
3advanced-m...ler.py
windows7-x64
3advanced-m...ler.py
windows10-2004-x64
3advanced-m...ber.py
windows7-x64
3advanced-m...ber.py
windows10-2004-x64
3advanced-m...mer.py
windows7-x64
3advanced-m...mer.py
windows10-2004-x64
3advanced-m...kup.py
windows7-x64
3advanced-m...kup.py
windows10-2004-x64
3advanced-m...nfo.py
windows7-x64
3advanced-m...nfo.py
windows10-2004-x64
3advanced-m...aid.py
windows7-x64
3advanced-m...aid.py
windows10-2004-x64
3advanced-m...nfo.py
windows7-x64
3advanced-m...nfo.py
windows10-2004-x64
3advanced-m...mer.py
windows7-x64
3advanced-m...mer.py
windows10-2004-x64
3advanced-m...12.pyc
windows7-x64
3advanced-m...12.pyc
windows10-2004-x64
3advanced-m...12.pyc
windows7-x64
3advanced-m...12.pyc
windows10-2004-x64
advanced-m...kup.py
windows7-x64
3advanced-m...kup.py
windows10-2004-x64
3advanced-m...sdm.py
windows7-x64
3advanced-m...sdm.py
windows10-2004-x64
3advanced-m...ger.py
windows7-x64
3advanced-m...ger.py
windows10-2004-x64
3advanced-m...ts.txt
windows7-x64
1advanced-m...ts.txt
windows10-2004-x64
1Analysis
-
max time kernel
102s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
09/08/2024, 19:51
Static task
static1
Behavioral task
behavioral1
Sample
advanced-multitools.rar
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
advanced-multitools.rar
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
advanced-multitools/main.py
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
advanced-multitools/main.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
advanced-multitools/plugins/Account-disabler.py
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
advanced-multitools/plugins/Account-disabler.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
advanced-multitools/plugins/Anti-grabber.py
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
advanced-multitools/plugins/Anti-grabber.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
advanced-multitools/plugins/Group-spammer.py
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
advanced-multitools/plugins/Group-spammer.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
advanced-multitools/plugins/Serveurlookup.py
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
advanced-multitools/plugins/Serveurlookup.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
advanced-multitools/plugins/Tokeninfo.py
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
advanced-multitools/plugins/Tokeninfo.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
advanced-multitools/plugins/Tokenraid.py
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
advanced-multitools/plugins/Tokenraid.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
advanced-multitools/plugins/Webhook-info.py
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
advanced-multitools/plugins/Webhook-info.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
advanced-multitools/plugins/Webhook-spammer.py
Resource
win7-20240705-en
Behavioral task
behavioral20
Sample
advanced-multitools/plugins/Webhook-spammer.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
advanced-multitools/plugins/__pycache__/numbers.cpython-312.pyc
Resource
win7-20240704-en
Behavioral task
behavioral22
Sample
advanced-multitools/plugins/__pycache__/numbers.cpython-312.pyc
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
advanced-multitools/plugins/__pycache__/phonenumbers.cpython-312.pyc
Resource
win7-20240708-en
Behavioral task
behavioral24
Sample
advanced-multitools/plugins/__pycache__/phonenumbers.cpython-312.pyc
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
advanced-multitools/plugins/lookup.py
Resource
win7-20240704-en
Behavioral task
behavioral26
Sample
advanced-multitools/plugins/lookup.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
advanced-multitools/plugins/massdm.py
Resource
win7-20240708-en
Behavioral task
behavioral28
Sample
advanced-multitools/plugins/massdm.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
advanced-multitools/plugins/pinger.py
Resource
win7-20240729-en
Behavioral task
behavioral30
Sample
advanced-multitools/plugins/pinger.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
advanced-multitools/requirements.txt
Resource
win7-20240704-en
Behavioral task
behavioral32
Sample
advanced-multitools/requirements.txt
Resource
win10v2004-20240802-en
General
-
Target
advanced-multitools/main.py
-
Size
2KB
-
MD5
aa295a65404685d3bf16e56b3b65a2d8
-
SHA1
b82633c3fe38f85f3964ea8553d0e1c8e6692079
-
SHA256
f122a482a0c1e826f7473010e98a72c585f6ec77287d1cca5edf519275cb107c
-
SHA512
53c13d1bc84a1e7d105f20a5a5b0c935b19290a71b8eaaef525b63339aae650b550354b59fcbb3dd6377b4999a8a157ba09cd23c1b0c4b78d6e78c258d1abedf
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\py_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\.py rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\py_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\py_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\py_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\.py\ = "py_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\py_auto_file\shell rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 720 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 720 AcroRd32.exe 720 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1824 wrote to memory of 2444 1824 cmd.exe 29 PID 1824 wrote to memory of 2444 1824 cmd.exe 29 PID 1824 wrote to memory of 2444 1824 cmd.exe 29 PID 2444 wrote to memory of 720 2444 rundll32.exe 30 PID 2444 wrote to memory of 720 2444 rundll32.exe 30 PID 2444 wrote to memory of 720 2444 rundll32.exe 30 PID 2444 wrote to memory of 720 2444 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\advanced-multitools\main.py1⤵
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\advanced-multitools\main.py2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\advanced-multitools\main.py"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:720
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD502544fd43336a5df16e27ba021158786
SHA11d0d6e0d34c15058ed4d90199f930b4aba2bf3f7
SHA2563e9c269cceb145f52eb756f2c9651ab86d88fe1752740f349f32fcacdf6c346e
SHA51250fc97ae6bba405951f0131de1b1af3ea0017c4710c568c796164a2ec7057c401d0d34ba9e827d1ce14900e5f549b1b9e0cdd09b408b4dc3724c6d8874918246