Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

21/09/2024, 16:04

240921-th7eja1bnh 10

21/09/2024, 12:33

240921-prnlkasfpm 10

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    21/09/2024, 12:33

General

  • Target

    get_cookies.pyc

  • Size

    9KB

  • MD5

    06edc64263be4dbe97e99f510d1cf859

  • SHA1

    f9f4e8fc35ddf244cb215146f5097916bfeaa96e

  • SHA256

    d7444836c6013f4995383b0a76818dbc9cbc5b61965b5940dc4784a1dd333b9b

  • SHA512

    ab2a84b0027413584fb3bc310f18c11c6cabb953a094120295432fbbd8c34b72f2b41176d50a43f8b0dd0c65d2e6b7bb47e755db22fb7f405cd9fb2b42b747cc

  • SSDEEP

    192:kNaBBeiNR9QfUF2x3NC79F21aG67+DAhN:kPiT2XtFcjKDAhN

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\get_cookies.pyc
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2252
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\get_cookies.pyc
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1036
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\get_cookies.pyc"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:3024

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    ca8a9a57a68eab31dd0c486099121c1a

    SHA1

    de606e922af170232d4d6562bc5845204d0c21df

    SHA256

    17e4db9cca121f638b83849ac6013e5868f961c21dfa9cfce9a624810f5dde90

    SHA512

    535e7a3dfba0693f1240dfee5c3865393ccfec09641cc700ccfbd875c7d48a5ebfd5175a39b41b7a16c2efc566e9184ad6fb5419dbdbdd82eba0364cc7d272d5