Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
6Static
static
6Linear/lib...de.dll
windows7-x64
1Linear/lib...de.dll
windows10-2004-x64
1Linear/lib...le.pyc
windows7-x64
3Linear/lib...le.pyc
windows10-2004-x64
3Linear/lib...in.pyc
windows7-x64
3Linear/lib...in.pyc
windows10-2004-x64
3Linear/lib...in.pyc
windows7-x64
3Linear/lib...in.pyc
windows10-2004-x64
3Linear/lib...in.pyc
windows7-x64
3Linear/lib...in.pyc
windows10-2004-x64
3Linear/lib...in.pyc
windows7-x64
3Linear/lib...in.pyc
windows10-2004-x64
3Linear/lib...ce.pyc
windows7-x64
3Linear/lib...ce.pyc
windows10-2004-x64
3Linear/lib...or.vbs
windows7-x64
1Linear/lib...or.vbs
windows10-2004-x64
1Linear/lib...rg.vbs
windows7-x64
1Linear/lib...rg.vbs
windows10-2004-x64
1Linear/lib.../hello
ubuntu-18.04-amd64
Linear/lib.../hello
debian-9-armhf
Linear/lib.../hello
debian-9-mips
Linear/lib.../hello
debian-9-mipsel
Linear/lib...ms.vbs
windows7-x64
1Linear/lib...ms.vbs
windows10-2004-x64
1Linear/lib.../ixset
ubuntu-18.04-amd64
Linear/lib.../ixset
debian-9-armhf
Linear/lib.../ixset
debian-9-mips
Linear/lib.../ixset
debian-9-mipsel
Linear/lib...ur.vbs
windows7-x64
1Linear/lib...ur.vbs
windows10-2004-x64
1Linear/lib...me.vbs
windows7-x64
1Linear/lib...me.vbs
windows10-2004-x64
1Analysis
-
max time kernel
121s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
26/08/2024, 04:28
Behavioral task
behavioral1
Sample
Linear/lib/Cryptodome/Cipher/_pkcs1_decode.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
Linear/lib/Cryptodome/Cipher/_pkcs1_decode.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Linear/lib/PIL/BdfFontFile.pyc
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
Linear/lib/PIL/BdfFontFile.pyc
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
Linear/lib/PIL/BufrStubImagePlugin.pyc
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
Linear/lib/PIL/BufrStubImagePlugin.pyc
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
Linear/lib/PIL/DdsImagePlugin.pyc
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
Linear/lib/PIL/DdsImagePlugin.pyc
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
Linear/lib/PIL/GbrImagePlugin.pyc
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
Linear/lib/PIL/GbrImagePlugin.pyc
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
Linear/lib/PIL/IcoImagePlugin.pyc
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
Linear/lib/PIL/IcoImagePlugin.pyc
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
Linear/lib/PIL/ImageEnhance.pyc
Resource
win7-20240729-en
Behavioral task
behavioral14
Sample
Linear/lib/PIL/ImageEnhance.pyc
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
Linear/lib/tk8.6/demos/floor.vbs
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
Linear/lib/tk8.6/demos/floor.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
Linear/lib/tk8.6/demos/goldberg.vbs
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
Linear/lib/tk8.6/demos/goldberg.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
Linear/lib/tk8.6/demos/hello
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral20
Sample
Linear/lib/tk8.6/demos/hello
Resource
debian9-armhf-20240729-en
Behavioral task
behavioral21
Sample
Linear/lib/tk8.6/demos/hello
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral22
Sample
Linear/lib/tk8.6/demos/hello
Resource
debian9-mipsel-20240611-en
Behavioral task
behavioral23
Sample
Linear/lib/tk8.6/demos/items.vbs
Resource
win7-20240704-en
Behavioral task
behavioral24
Sample
Linear/lib/tk8.6/demos/items.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
Linear/lib/tk8.6/demos/ixset
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral26
Sample
Linear/lib/tk8.6/demos/ixset
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral27
Sample
Linear/lib/tk8.6/demos/ixset
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral28
Sample
Linear/lib/tk8.6/demos/ixset
Resource
debian9-mipsel-20240611-en
Behavioral task
behavioral29
Sample
Linear/lib/tk8.6/demos/knightstour.vbs
Resource
win7-20240705-en
Behavioral task
behavioral30
Sample
Linear/lib/tk8.6/demos/knightstour.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
Linear/lib/tk8.6/demos/labelframe.vbs
Resource
win7-20240729-en
Behavioral task
behavioral32
Sample
Linear/lib/tk8.6/demos/labelframe.vbs
Resource
win10v2004-20240802-en
General
-
Target
Linear/lib/PIL/BdfFontFile.pyc
-
Size
5KB
-
MD5
150ed1965b59bf58193de7292ae6f428
-
SHA1
d474188946e09cef0e4ab005722064ea268a6dc5
-
SHA256
8fa3fb2d36787f1e76e5eea06fc724e263ae6e9bee1b9717c3e6df5bed8acd23
-
SHA512
80706757723f5919c75b0f9b2fd194496c7e87e9609424b50d014e7018c6e44842963089dbd7fd8a02cc997fd82f9e7a4bc83d6ba1906ddbfe880f6505807ec9
-
SSDEEP
96:Wk1ouVpj0v8Wr5FFv7UXhxvLT0wrPUwSUFmA/:bNho5FFvwXhxvnIwSUF/
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2888 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Linear\lib\PIL\BdfFontFile.pyc1⤵
- Modifies registry class
PID:1872
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2888
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4508,i,16315016104747277319,5510969007830467313,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:81⤵PID:2220