Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
6Static
static
6Linear/lib...de.dll
windows7-x64
1Linear/lib...de.dll
windows10-2004-x64
1Linear/lib...le.pyc
windows7-x64
3Linear/lib...le.pyc
windows10-2004-x64
3Linear/lib...in.pyc
windows7-x64
3Linear/lib...in.pyc
windows10-2004-x64
3Linear/lib...in.pyc
windows7-x64
3Linear/lib...in.pyc
windows10-2004-x64
3Linear/lib...in.pyc
windows7-x64
3Linear/lib...in.pyc
windows10-2004-x64
3Linear/lib...in.pyc
windows7-x64
3Linear/lib...in.pyc
windows10-2004-x64
3Linear/lib...ce.pyc
windows7-x64
3Linear/lib...ce.pyc
windows10-2004-x64
3Linear/lib...or.vbs
windows7-x64
1Linear/lib...or.vbs
windows10-2004-x64
1Linear/lib...rg.vbs
windows7-x64
1Linear/lib...rg.vbs
windows10-2004-x64
1Linear/lib.../hello
ubuntu-18.04-amd64
Linear/lib.../hello
debian-9-armhf
Linear/lib.../hello
debian-9-mips
Linear/lib.../hello
debian-9-mipsel
Linear/lib...ms.vbs
windows7-x64
1Linear/lib...ms.vbs
windows10-2004-x64
1Linear/lib.../ixset
ubuntu-18.04-amd64
Linear/lib.../ixset
debian-9-armhf
Linear/lib.../ixset
debian-9-mips
Linear/lib.../ixset
debian-9-mipsel
Linear/lib...ur.vbs
windows7-x64
1Linear/lib...ur.vbs
windows10-2004-x64
1Linear/lib...me.vbs
windows7-x64
1Linear/lib...me.vbs
windows10-2004-x64
1Analysis
-
max time kernel
102s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
26/08/2024, 04:28
Behavioral task
behavioral1
Sample
Linear/lib/Cryptodome/Cipher/_pkcs1_decode.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
Linear/lib/Cryptodome/Cipher/_pkcs1_decode.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Linear/lib/PIL/BdfFontFile.pyc
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
Linear/lib/PIL/BdfFontFile.pyc
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
Linear/lib/PIL/BufrStubImagePlugin.pyc
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
Linear/lib/PIL/BufrStubImagePlugin.pyc
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
Linear/lib/PIL/DdsImagePlugin.pyc
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
Linear/lib/PIL/DdsImagePlugin.pyc
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
Linear/lib/PIL/GbrImagePlugin.pyc
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
Linear/lib/PIL/GbrImagePlugin.pyc
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
Linear/lib/PIL/IcoImagePlugin.pyc
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
Linear/lib/PIL/IcoImagePlugin.pyc
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
Linear/lib/PIL/ImageEnhance.pyc
Resource
win7-20240729-en
Behavioral task
behavioral14
Sample
Linear/lib/PIL/ImageEnhance.pyc
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
Linear/lib/tk8.6/demos/floor.vbs
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
Linear/lib/tk8.6/demos/floor.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
Linear/lib/tk8.6/demos/goldberg.vbs
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
Linear/lib/tk8.6/demos/goldberg.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
Linear/lib/tk8.6/demos/hello
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral20
Sample
Linear/lib/tk8.6/demos/hello
Resource
debian9-armhf-20240729-en
Behavioral task
behavioral21
Sample
Linear/lib/tk8.6/demos/hello
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral22
Sample
Linear/lib/tk8.6/demos/hello
Resource
debian9-mipsel-20240611-en
Behavioral task
behavioral23
Sample
Linear/lib/tk8.6/demos/items.vbs
Resource
win7-20240704-en
Behavioral task
behavioral24
Sample
Linear/lib/tk8.6/demos/items.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
Linear/lib/tk8.6/demos/ixset
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral26
Sample
Linear/lib/tk8.6/demos/ixset
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral27
Sample
Linear/lib/tk8.6/demos/ixset
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral28
Sample
Linear/lib/tk8.6/demos/ixset
Resource
debian9-mipsel-20240611-en
Behavioral task
behavioral29
Sample
Linear/lib/tk8.6/demos/knightstour.vbs
Resource
win7-20240705-en
Behavioral task
behavioral30
Sample
Linear/lib/tk8.6/demos/knightstour.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
Linear/lib/tk8.6/demos/labelframe.vbs
Resource
win7-20240729-en
Behavioral task
behavioral32
Sample
Linear/lib/tk8.6/demos/labelframe.vbs
Resource
win10v2004-20240802-en
General
-
Target
Linear/lib/PIL/DdsImagePlugin.pyc
-
Size
21KB
-
MD5
b0a492702f5346fbbaeb3d2d7c356a27
-
SHA1
f688f70032c33922dad6363757bbb51f5d6ccc7d
-
SHA256
c6aed8adfd6a890aa4791bcf23cd8c3a7413faa60b89ee12c5df9da9b54b4884
-
SHA512
0bfa17b6eea4401b40efdf2297bcbc5f3491efdb2e9cfb76b2291a325c1cb4b1a2decea48b566d79b9ada65918d1853cdd0f77b573ea607464ecfd7e8918bb29
-
SSDEEP
384:emoJAY+yrOkVMm7TOxTXMFjmRZJmWzpXV9WrQGQR/ehWWWRfV:emoJAYCxGmLJ8rUe0
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\pyc_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\.pyc rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\.pyc\ = "pyc_auto_file" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\pyc_auto_file\shell\Read\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_Classes\Local Settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\pyc_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\pyc_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\pyc_auto_file\shell rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1080 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1080 AcroRd32.exe 1080 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 380 wrote to memory of 2940 380 cmd.exe 31 PID 380 wrote to memory of 2940 380 cmd.exe 31 PID 380 wrote to memory of 2940 380 cmd.exe 31 PID 2940 wrote to memory of 1080 2940 rundll32.exe 32 PID 2940 wrote to memory of 1080 2940 rundll32.exe 32 PID 2940 wrote to memory of 1080 2940 rundll32.exe 32 PID 2940 wrote to memory of 1080 2940 rundll32.exe 32
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Linear\lib\PIL\DdsImagePlugin.pyc1⤵
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Linear\lib\PIL\DdsImagePlugin.pyc2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Linear\lib\PIL\DdsImagePlugin.pyc"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1080
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD52e89bdfa9825cebc7334f1abae846e24
SHA1e775c0e9aa6432ae8ab9c3786ac1531481c53c8c
SHA2561d3901c49f8e70de9883c3a943f7de970b056680a7b12fc3bfc938d8209c2cb5
SHA5125b1868922300eb011b2dc278a2cfc064f469625361ef3bd407947c55224efccd2b7881233c1211ac08b07b40e5ce3af8de664dea152d275a141649122ed317f2