Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    842s
  • max time network
    843s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    24/12/2024, 04:41

General

  • Target

    source_prepared.pyc

  • Size

    185KB

  • MD5

    99a7b84ac32e083f5a5f93637a10fec2

  • SHA1

    0fd65e019166d1f263ea7e1959a84de3286f0e0f

  • SHA256

    92a604d5cfc3d739005cca7d9a4e6e151a9683861a9d9f6964d713c35a638a21

  • SHA512

    11519dbe8a0021a3682d67369c50cb98b403e7a7a8863451b5b40d3229d01d06b740417cedef817528ac6764b9565e0106fc37ec4b5c071b562493346acc923c

  • SSDEEP

    3072:cCHSLai9sA9MpcgSobPEtelZN+tVZa3Bcgh90WCkn0:c3Wi9lUSob8cN+7Za3Bcgh9HCh

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\source_prepared.pyc
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1720
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\source_prepared.pyc
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2096
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\source_prepared.pyc"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2228

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    9bbb373b55bfe9e62e5cfd522e35cb6d

    SHA1

    fc4a1934606a816d67764f442babceeeb0ac734f

    SHA256

    abeb7e49e3c1c2d7b68d5d217d36b977cfd5e117b7725f6a9516744e0a3733d8

    SHA512

    ac7e91f7d90179931498cc58e583b7c1a4242f5a3348bd909b8459f2323cea238236d3271692a4c30f1e5692ac8b59fee5c826b4f8aed7e68e7bf2144b1045fa