Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
6Static
static
6CyberDEV C...nd.pyc
windows10-1703-x64
3CyberDEV C...er.pyc
windows10-1703-x64
3CyberDEV C...or.pyc
windows10-1703-x64
3CyberDEV C...nts.js
windows10-1703-x64
3CyberDEV C...ute.js
windows10-1703-x64
3CyberDEV C...yed.js
windows10-1703-x64
3CyberDEV C...le.pyc
windows10-1703-x64
3CyberDEV C...on.pyc
windows10-1703-x64
3CyberDEV C...ey.pyc
windows10-1703-x64
3CyberDEV C...ot.pyc
windows10-1703-x64
3CyberDEV C...to.pyc
windows10-1703-x64
3CyberDEV C...ls.pyc
windows10-1703-x64
3CyberDEV C...ver.js
windows10-1703-x64
3CyberDEV C...nt.pyc
windows10-1703-x64
3CyberDEV C...on.pyc
windows10-1703-x64
3CyberDEV C...__.pyc
windows10-1703-x64
3CyberDEV C...ns.pyc
windows10-1703-x64
3CyberDEV C...ns.pyc
windows10-1703-x64
3CyberDEV C...on.pyc
windows10-1703-x64
3CyberDEV C...ce.pyc
windows10-1703-x64
3CyberDEV C...er.pyc
windows10-1703-x64
3CyberDEV C...__.pyc
windows10-1703-x64
3CyberDEV C...er.pyc
windows10-1703-x64
3CyberDEV C...or.pyc
windows10-1703-x64
3CyberDEV C...er.pyc
windows10-1703-x64
3CyberDEV C...ts.pyc
windows10-1703-x64
3CyberDEV C...ns.pyc
windows10-1703-x64
3CyberDEV C...or.pyc
windows10-1703-x64
3CyberDEV C...ct.pyc
windows10-1703-x64
3CyberDEV C...ui.pyc
windows10-1703-x64
3CyberDEV C...tp.ps1
windows10-1703-x64
3CyberDEV C...it.vbs
windows10-1703-x64
1Analysis
-
max time kernel
109s -
max time network
135s -
platform
windows10-1703_x64 -
resource
win10-20240611-en -
resource tags
arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system -
submitted
14/08/2024, 05:40
Behavioral task
behavioral1
Sample
CyberDEV Client/lib/selenium/webdriver/remote/command.pyc
Resource
win10-20240611-en
Behavioral task
behavioral2
Sample
CyberDEV Client/lib/selenium/webdriver/remote/errorhandler.pyc
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
CyberDEV Client/lib/selenium/webdriver/remote/file_detector.pyc
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
CyberDEV Client/lib/selenium/webdriver/remote/findElements.js
Resource
win10-20240404-en
Behavioral task
behavioral5
Sample
CyberDEV Client/lib/selenium/webdriver/remote/getAttribute.js
Resource
win10-20240404-en
Behavioral task
behavioral6
Sample
CyberDEV Client/lib/selenium/webdriver/remote/isDisplayed.js
Resource
win10-20240404-en
Behavioral task
behavioral7
Sample
CyberDEV Client/lib/selenium/webdriver/remote/mobile.pyc
Resource
win10-20240611-en
Behavioral task
behavioral8
Sample
CyberDEV Client/lib/selenium/webdriver/remote/remote_connection.pyc
Resource
win10-20240404-en
Behavioral task
behavioral9
Sample
CyberDEV Client/lib/selenium/webdriver/remote/script_key.pyc
Resource
win10-20240404-en
Behavioral task
behavioral10
Sample
CyberDEV Client/lib/selenium/webdriver/remote/shadowroot.pyc
Resource
win10-20240404-en
Behavioral task
behavioral11
Sample
CyberDEV Client/lib/selenium/webdriver/remote/switch_to.pyc
Resource
win10-20240404-en
Behavioral task
behavioral12
Sample
CyberDEV Client/lib/selenium/webdriver/remote/utils.pyc
Resource
win10-20240404-en
Behavioral task
behavioral13
Sample
CyberDEV Client/lib/selenium/webdriver/remote/webdriver.js
Resource
win10-20240404-en
Behavioral task
behavioral14
Sample
CyberDEV Client/lib/selenium/webdriver/remote/webelement.pyc
Resource
win10-20240611-en
Behavioral task
behavioral15
Sample
CyberDEV Client/lib/selenium/webdriver/remote/websocket_connection.pyc
Resource
win10-20240404-en
Behavioral task
behavioral16
Sample
CyberDEV Client/lib/selenium/webdriver/safari/__init__.pyc
Resource
win10-20240404-en
Behavioral task
behavioral17
Sample
CyberDEV Client/lib/selenium/webdriver/safari/options.pyc
Resource
win10-20240404-en
Behavioral task
behavioral18
Sample
CyberDEV Client/lib/selenium/webdriver/safari/permissions.pyc
Resource
win10-20240404-en
Behavioral task
behavioral19
Sample
CyberDEV Client/lib/selenium/webdriver/safari/remote_connection.pyc
Resource
win10-20240404-en
Behavioral task
behavioral20
Sample
CyberDEV Client/lib/selenium/webdriver/safari/service.pyc
Resource
win10-20240404-en
Behavioral task
behavioral21
Sample
CyberDEV Client/lib/selenium/webdriver/safari/webdriver.pyc
Resource
win10-20240611-en
Behavioral task
behavioral22
Sample
CyberDEV Client/lib/selenium/webdriver/support/__init__.pyc
Resource
win10-20240404-en
Behavioral task
behavioral23
Sample
CyberDEV Client/lib/selenium/webdriver/support/abstract_event_listener.pyc
Resource
win10-20240404-en
Behavioral task
behavioral24
Sample
CyberDEV Client/lib/selenium/webdriver/support/color.pyc
Resource
win10-20240404-en
Behavioral task
behavioral25
Sample
CyberDEV Client/lib/selenium/webdriver/support/event_firing_webdriver.pyc
Resource
win10-20240404-en
Behavioral task
behavioral26
Sample
CyberDEV Client/lib/selenium/webdriver/support/events.pyc
Resource
win10-20240404-en
Behavioral task
behavioral27
Sample
CyberDEV Client/lib/selenium/webdriver/support/expected_conditions.pyc
Resource
win10-20240404-en
Behavioral task
behavioral28
Sample
CyberDEV Client/lib/selenium/webdriver/support/relative_locator.pyc
Resource
win10-20240404-en
Behavioral task
behavioral29
Sample
CyberDEV Client/lib/selenium/webdriver/support/select.pyc
Resource
win10-20240404-en
Behavioral task
behavioral30
Sample
CyberDEV Client/lib/selenium/webdriver/support/ui.pyc
Resource
win10-20240611-en
Behavioral task
behavioral31
Sample
CyberDEV Client/share/tcl8.6/http1.0/http.ps1
Resource
win10-20240404-en
Behavioral task
behavioral32
Sample
CyberDEV Client/share/tcl8.6/init.vbs
Resource
win10-20240404-en
General
-
Target
CyberDEV Client/lib/selenium/webdriver/support/ui.pyc
-
Size
322B
-
MD5
a7e36ab0b00da42b9556fd7d9c6b0064
-
SHA1
660465f30eec1fc2fff12a3d8a8bfbb4e510dcdf
-
SHA256
301e124f7b0cc2a19c2a4f90f050fadb145c209067ca92262c9198653feb6549
-
SHA512
bb78f8e0e7c4bf0a2b5dde8299aa0f7544c5127e147d0eba5a7dd0bf02bfdb499351d759997179ddd89e615a3e231a4920fdb60aa2ea5ed9fec8d99eab608287
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 380 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\CyberDEV Client\lib\selenium\webdriver\support\ui.pyc"1⤵
- Modifies registry class
PID:3652
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:380