Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
1robotcoded...n__.py
windows7-x64
3robotcoded...n__.py
windows10-2004-x64
3robotcoded...ion.py
windows7-x64
3robotcoded...ion.py
windows10-2004-x64
3robotcoded...ig.vbs
windows7-x64
1robotcoded...ig.vbs
windows10-2004-x64
1robotcoded...n__.py
windows7-x64
3robotcoded...n__.py
windows10-2004-x64
3robotcoded...zer.py
windows7-x64
3robotcoded...zer.py
windows10-2004-x64
3robotcoded...cli.py
windows7-x64
3robotcoded...cli.py
windows10-2004-x64
3robotcoded...fig.py
windows7-x64
3robotcoded...fig.py
windows10-2004-x64
3robotcoded...oks.py
windows7-x64
3robotcoded...oks.py
windows10-2004-x64
3robotcoded...n__.py
windows7-x64
3robotcoded...n__.py
windows10-2004-x64
3robotcoded...ols.py
windows7-x64
3robotcoded...ols.py
windows10-2004-x64
3robotcoded...ent.py
windows7-x64
3robotcoded...ent.py
windows10-2004-x64
3robotcoded...ger.py
windows7-x64
3robotcoded...ger.py
windows10-2004-x64
3robotcoded...ent.py
windows7-x64
3robotcoded...ent.py
windows10-2004-x64
3robotcoded...her.py
windows7-x64
3robotcoded...her.py
windows10-2004-x64
3robotcoded...pec.py
windows7-x64
3robotcoded...pec.py
windows10-2004-x64
3robotcoded...age.py
windows7-x64
3robotcoded...age.py
windows10-2004-x64
3Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
07/09/2024, 23:53
Static task
static1
Behavioral task
behavioral1
Sample
robotcodedev-robotcode-280f0d4/bundled/tool/robotcode/__main__.py
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
robotcodedev-robotcode-280f0d4/bundled/tool/robotcode/__main__.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
robotcodedev-robotcode-280f0d4/bundled/tool/utils/check_robot_version.py
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
robotcodedev-robotcode-280f0d4/bundled/tool/utils/check_robot_version.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
robotcodedev-robotcode-280f0d4/docs/03_reference/config.vbs
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
robotcodedev-robotcode-280f0d4/docs/03_reference/config.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
robotcodedev-robotcode-280f0d4/packages/analyze/src/robotcode/analyze/__version__.py
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
robotcodedev-robotcode-280f0d4/packages/analyze/src/robotcode/analyze/__version__.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
robotcodedev-robotcode-280f0d4/packages/analyze/src/robotcode/analyze/analyzer.py
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
robotcodedev-robotcode-280f0d4/packages/analyze/src/robotcode/analyze/analyzer.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
robotcodedev-robotcode-280f0d4/packages/analyze/src/robotcode/analyze/cli.py
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
robotcodedev-robotcode-280f0d4/packages/analyze/src/robotcode/analyze/cli.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
robotcodedev-robotcode-280f0d4/packages/analyze/src/robotcode/analyze/config.py
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
robotcodedev-robotcode-280f0d4/packages/analyze/src/robotcode/analyze/config.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
robotcodedev-robotcode-280f0d4/packages/analyze/src/robotcode/analyze/hooks.py
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
robotcodedev-robotcode-280f0d4/packages/analyze/src/robotcode/analyze/hooks.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
robotcodedev-robotcode-280f0d4/packages/core/src/robotcode/core/__version__.py
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
robotcodedev-robotcode-280f0d4/packages/core/src/robotcode/core/__version__.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
robotcodedev-robotcode-280f0d4/packages/core/src/robotcode/core/async_tools.py
Resource
win7-20240729-en
Behavioral task
behavioral20
Sample
robotcodedev-robotcode-280f0d4/packages/core/src/robotcode/core/async_tools.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
robotcodedev-robotcode-280f0d4/packages/core/src/robotcode/core/concurrent.py
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
robotcodedev-robotcode-280f0d4/packages/core/src/robotcode/core/concurrent.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
robotcodedev-robotcode-280f0d4/packages/core/src/robotcode/core/documents_manager.py
Resource
win7-20240704-en
Behavioral task
behavioral24
Sample
robotcodedev-robotcode-280f0d4/packages/core/src/robotcode/core/documents_manager.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
robotcodedev-robotcode-280f0d4/packages/core/src/robotcode/core/event.py
Resource
win7-20240708-en
Behavioral task
behavioral26
Sample
robotcodedev-robotcode-280f0d4/packages/core/src/robotcode/core/event.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
robotcodedev-robotcode-280f0d4/packages/core/src/robotcode/core/filewatcher.py
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
robotcodedev-robotcode-280f0d4/packages/core/src/robotcode/core/filewatcher.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
robotcodedev-robotcode-280f0d4/packages/core/src/robotcode/core/ignore_spec.py
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
robotcodedev-robotcode-280f0d4/packages/core/src/robotcode/core/ignore_spec.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
robotcodedev-robotcode-280f0d4/packages/core/src/robotcode/core/language.py
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
robotcodedev-robotcode-280f0d4/packages/core/src/robotcode/core/language.py
Resource
win10v2004-20240802-en
General
-
Target
robotcodedev-robotcode-280f0d4/bundled/tool/utils/check_robot_version.py
-
Size
936B
-
MD5
18d47d8f92a349d2aa9e00bb5cd08519
-
SHA1
d5ac7529b3fa455e05569a5407274a51e029109a
-
SHA256
d4d3df4e6a3b1795f46dc75f00024a3fee3b1fb49746e35140b6ef73624fc63b
-
SHA512
3d5660eadedeac3bee088634ae4fb61ce1da59c1035fc19a08aedd7596100981113a3d9f0c11d8678e7da0623c77a1e5f4e9c04e315fd1bdbda4e5078d466c38
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\py_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\py_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\py_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\.py rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\.py\ = "py_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\py_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\py_auto_file\shell rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2580 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2580 AcroRd32.exe 2580 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2260 wrote to memory of 2984 2260 cmd.exe 29 PID 2260 wrote to memory of 2984 2260 cmd.exe 29 PID 2260 wrote to memory of 2984 2260 cmd.exe 29 PID 2984 wrote to memory of 2580 2984 rundll32.exe 32 PID 2984 wrote to memory of 2580 2984 rundll32.exe 32 PID 2984 wrote to memory of 2580 2984 rundll32.exe 32 PID 2984 wrote to memory of 2580 2984 rundll32.exe 32
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\robotcodedev-robotcode-280f0d4\bundled\tool\utils\check_robot_version.py1⤵
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\robotcodedev-robotcode-280f0d4\bundled\tool\utils\check_robot_version.py2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\robotcodedev-robotcode-280f0d4\bundled\tool\utils\check_robot_version.py"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2580
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5a8cd9f95dc970508945263c923781c7f
SHA1948f131d55471392f1c883797c1e39375070c356
SHA2564293538fe8192f4e94c1ca01ef39d7274c533e5b5d8004004b16c14280f8d50c
SHA5120d3c667c725eb240df185ad786034087987b7c905133ff0603127e18264b9b791fe9ce913065008189eca742334f3762251789c4be96725a631795dbc48878ad