Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    19/08/2024, 11:48

General

  • Target

    checksys.py

  • Size

    237B

  • MD5

    4c6e355ee078a74c4a59bffb15c7f493

  • SHA1

    16d5bce5959c4148d6c7cee1630534b9bf344772

  • SHA256

    e5ad29ba3490f6d3dfcd67574da6db368819e716db29a3c16e9da9eb2b273bce

  • SHA512

    dd619232a60aa0f42b161f9118fc37be7e796a1735258738f1923b7bbeaff701f837ac5fc8097ba4eb8a50ae44ae5a3fe28e5667b78d079665f9e42cccb1044b

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\checksys.py
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2180
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\checksys.py
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2632
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\checksys.py"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2768

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    b2964fcf6d05794182638d54bfe880ef

    SHA1

    539c21e70f4471c728ca3355c388a82de00d52bb

    SHA256

    cfc264531d86a87db9e675132f1439dc3a6c8f96792a22597b8e944a33be5e97

    SHA512

    bbfb61751169dbe9e910b517f3a69174bc3fc0c8899d6aa3ab1571453af06410848e92fe9c95c4d37709fe380ce54ad3cfb96f3fcdadf82a2ca83827124f6ef4