Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3New folder (5).rar
windows7-x64
3New folder (5).rar
windows10-2004-x64
3New folder...es.iso
windows7-x64
3New folder...es.iso
windows10-2004-x64
3New folder...ty.iso
windows7-x64
3New folder...ty.iso
windows10-2004-x64
3New folder...FO.txt
windows7-x64
1New folder...FO.txt
windows10-2004-x64
1New folder...s.json
windows7-x64
3New folder...s.json
windows10-2004-x64
3New folder...ect.js
windows7-x64
3New folder...ect.js
windows10-2004-x64
3New folder...DS.cdn
windows7-x64
3New folder...DS.cdn
windows10-2004-x64
3New folder...gR.dll
windows7-x64
1New folder...gR.dll
windows10-2004-x64
1New folder...NT.txt
windows7-x64
1New folder...NT.txt
windows10-2004-x64
1New folder...er.exe
windows7-x64
7New folder...er.exe
windows10-2004-x64
10Stub.pyc
windows7-x64
3Stub.pyc
windows10-2004-x64
3Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06/09/2024, 07:24
Behavioral task
behavioral1
Sample
New folder (5).rar
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
New folder (5).rar
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
New folder (5)/GUI/Frames.iso
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
New folder (5)/GUI/Frames.iso
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
New folder (5)/GUI/Quality.iso
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
New folder (5)/GUI/Quality.iso
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
New folder (5)/INFO.txt
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
New folder (5)/INFO.txt
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
New folder (5)/Loader/Frames.json
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
New folder (5)/Loader/Frames.json
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
New folder (5)/Loader/Gui Connect.js
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
New folder (5)/Loader/Gui Connect.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
New folder (5)/Loader/key_format/KeyBINDS.cdn
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
New folder (5)/Loader/key_format/KeyBINDS.cdn
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
New folder (5)/QllzgR.dll
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
New folder (5)/QllzgR.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
New folder (5)/READ ME!!/DEVELOPMENT.txt
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
New folder (5)/READ ME!!/DEVELOPMENT.txt
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
New folder (5)/Skin Changer.exe
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
New folder (5)/Skin Changer.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
Stub.pyc
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
Stub.pyc
Resource
win10v2004-20240802-en
General
-
Target
Stub.pyc
-
Size
198KB
-
MD5
bf50be6023ad3852cf8dafe71ae0149e
-
SHA1
a497396e43fd9bd19f699293f4a043283f6ce997
-
SHA256
45dc909ea64b61dea3cc8aea2e85aede247f7970915c3ef18451748146c7a79c
-
SHA512
4a98130ae575ad3a32e9801eb5354ad760e7dbec505f7216909ed391aa7f21d17f81a9d3cb386bf51451a4345f6bca4fe0236e2d68ac779400641493fa7a50b4
-
SSDEEP
6144:MeYPhr47CTpKfTgYhYYYYY9YYjTFlZE1l:5spAsFlZ+
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\pyc_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\.pyc rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\pyc_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\pyc_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_Classes\Local Settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\pyc_auto_file\ rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\.pyc\ = "pyc_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\pyc_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2792 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2792 AcroRd32.exe 2792 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2672 wrote to memory of 2696 2672 cmd.exe 32 PID 2672 wrote to memory of 2696 2672 cmd.exe 32 PID 2672 wrote to memory of 2696 2672 cmd.exe 32 PID 2696 wrote to memory of 2792 2696 rundll32.exe 33 PID 2696 wrote to memory of 2792 2696 rundll32.exe 33 PID 2696 wrote to memory of 2792 2696 rundll32.exe 33 PID 2696 wrote to memory of 2792 2696 rundll32.exe 33
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Stub.pyc1⤵
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Stub.pyc2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Stub.pyc"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2792
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD53d2c59b649ebf32a5ea1bb30b0a267e0
SHA143ac9de350da2f30ad5f56fb46316e7f5d191781
SHA2569cdeaea349f528ac65bb9f4906195772a3f9b64238bf0c16d76a2a9524e24757
SHA51254aae334ebab3577cfeb521ab4d8d7cc98601014b5547c382cb4851ed6857c2a802b8dc5d44f5d95be3a026b9b22b3bfdfcfa2fbf16442f6da20009fe08afd74