Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

18/10/2024, 10:15

241018-mageta1eph 8

18/10/2024, 10:14

241018-l9r5xstgkl 3

18/10/2024, 10:12

241018-l8j3xs1drb 3

Analysis

  • max time kernel
    26s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    18/10/2024, 10:14

General

  • Target

    iVault.py

  • Size

    746KB

  • MD5

    08990be6640354d6c8558cf88c3f18e5

  • SHA1

    a92a9751e57b81254f09a474f9e53367f1fc9306

  • SHA256

    12d5eea4a11a119a6d722aecae66ff0b71a24cdfaefa42a34cf53d5a06415600

  • SHA512

    7717a14bb9446c5f74f22d8cc33ac166a06cf1c75cda7eb9279e0779cda9a631c376cbc5d13e8d9ff7b46008bc12ce139f0c7f8b94a11f7b2f498f279cbe0a52

  • SSDEEP

    768:fQ9esPysAEw6S6bWgKDE0chEgfaWE2/ibICxEmSR0sUR3yHwkBzF4BXUu2lcwZi3:RsPy9Ew4bWhRgfaXmmkw5ciwZsb

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\iVault.py
    1⤵
    • Modifies registry class
    PID:1352
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3404
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:4516

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads