Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
17s -
max time network
15s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
02/09/2024, 09:04
General
-
Target
main1.exe.py
-
Size
1KB
-
MD5
7c6211f2ff430db322cefa73cc2e9bd4
-
SHA1
a7104974a070c6df4c74f467bc61893487fe8256
-
SHA256
d85ac4e30467fd331cb3c129a33396e438250710d710ee2637cc9b16778def1d
-
SHA512
b00a5a3951d7cd4354a9449d72e36c67f257daf58025a280e01bf44219157c3e32ec8de012e516807451afe0cbea3910953d4ca87783cc8d8aa42e001e1fdf9a
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 39 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\main1.exe.py1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\main1.exe.py2⤵
- Opens file in notepad (likely ransom note)
-