Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    102s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    26/08/2024, 04:28

General

  • Target

    Linear/lib/PIL/DdsImagePlugin.pyc

  • Size

    21KB

  • MD5

    b0a492702f5346fbbaeb3d2d7c356a27

  • SHA1

    f688f70032c33922dad6363757bbb51f5d6ccc7d

  • SHA256

    c6aed8adfd6a890aa4791bcf23cd8c3a7413faa60b89ee12c5df9da9b54b4884

  • SHA512

    0bfa17b6eea4401b40efdf2297bcbc5f3491efdb2e9cfb76b2291a325c1cb4b1a2decea48b566d79b9ada65918d1853cdd0f77b573ea607464ecfd7e8918bb29

  • SSDEEP

    384:emoJAY+yrOkVMm7TOxTXMFjmRZJmWzpXV9WrQGQR/ehWWWRfV:emoJAYCxGmLJ8rUe0

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Linear\lib\PIL\DdsImagePlugin.pyc
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:380
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Linear\lib\PIL\DdsImagePlugin.pyc
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2940
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Linear\lib\PIL\DdsImagePlugin.pyc"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:1080

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    2e89bdfa9825cebc7334f1abae846e24

    SHA1

    e775c0e9aa6432ae8ab9c3786ac1531481c53c8c

    SHA256

    1d3901c49f8e70de9883c3a943f7de970b056680a7b12fc3bfc938d8209c2cb5

    SHA512

    5b1868922300eb011b2dc278a2cfc064f469625361ef3bd407947c55224efccd2b7881233c1211ac08b07b40e5ce3af8de664dea152d275a141649122ed317f2