Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
17/11/2024, 01:12
241117-bk12esxhnp 317/11/2024, 01:12
241117-bkpy6axhmq 317/11/2024, 01:09
241117-bhytaaxjhw 3Analysis
-
max time kernel
121s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
17/11/2024, 01:12
Static task
static1
Behavioral task
behavioral1
Sample
Nitro-Generator-main/main.py
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
Nitro-Generator-main/main.py
Resource
win10v2004-20241007-en
General
-
Target
Nitro-Generator-main/main.py
-
Size
4KB
-
MD5
8c8f80556986328020c86044a15e93db
-
SHA1
1e72ca40206bdaa31581ca5186d09c2f795e4d56
-
SHA256
09f995dee3be7bd181a66cb21d4799c39c38930cb7d8be95d7257399302a5b72
-
SHA512
6ef16bb2055c5d461e12597a6cbe3ca30e5ce06057864d82e6b9523972d704c717af67097b40049605575a66e3409c6b9f652c45ba72423a87e69218a2e7b21b
-
SSDEEP
96:PsF1/TnTpxTRoCQfHGCp2i/1covRmw2CihmhZM2OIm2WiZkyQvqu6Xy/Zr:cTnTpxT2CQfJHGovbpih0Z9OIm2WiSyA
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\py_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\py_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\py_auto_file\shell\Read\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\py_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\py_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\.py rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\.py\ = "py_auto_file" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2852 rundll32.exe 2728 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2728 AcroRd32.exe 2728 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3044 wrote to memory of 2852 3044 cmd.exe 31 PID 3044 wrote to memory of 2852 3044 cmd.exe 31 PID 3044 wrote to memory of 2852 3044 cmd.exe 31 PID 2852 wrote to memory of 2728 2852 rundll32.exe 32 PID 2852 wrote to memory of 2728 2852 rundll32.exe 32 PID 2852 wrote to memory of 2728 2852 rundll32.exe 32 PID 2852 wrote to memory of 2728 2852 rundll32.exe 32
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Nitro-Generator-main\main.py1⤵
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Nitro-Generator-main\main.py2⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Nitro-Generator-main\main.py"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2728
-
-