Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10HydraDrago...tch.py
windows7-x64
3HydraDrago...tch.py
windows10-2004-x64
3HydraDrago...ter.py
windows7-x64
3HydraDrago...ter.py
windows10-2004-x64
3HydraDrago...ter.py
windows7-x64
3HydraDrago...ter.py
windows10-2004-x64
3HydraDrago...tor.py
windows7-x64
3HydraDrago...tor.py
windows10-2004-x64
3HydraDrago...ing.py
windows7-x64
3HydraDrago...ing.py
windows10-2004-x64
3HydraDrago...ker.py
windows7-x64
3HydraDrago...ker.py
windows10-2004-x64
3HydraDrago...ins.py
windows7-x64
3HydraDrago...ins.py
windows10-2004-x64
3HydraDrago...lip.py
windows7-x64
3HydraDrago...lip.py
windows10-2004-x64
3HydraDrago...tic.py
windows7-x64
3HydraDrago...tic.py
windows10-2004-x64
3HydraDrago...ted.py
windows7-x64
3HydraDrago...ted.py
windows10-2004-x64
3HydraDrago...ers.py
windows7-x64
3HydraDrago...ers.py
windows10-2004-x64
3HydraDrago...ng0.py
windows7-x64
3HydraDrago...ng0.py
windows10-2004-x64
3HydraDrago...ing.py
windows7-x64
3HydraDrago...ing.py
windows10-2004-x64
3HydraDrago...eck.py
windows7-x64
3HydraDrago...eck.py
windows10-2004-x64
3HydraDrago...ing.py
windows7-x64
3HydraDrago...ing.py
windows10-2004-x64
3HydraDrago...ng0.py
windows7-x64
3HydraDrago...ng0.py
windows10-2004-x64
3Analysis
-
max time kernel
139s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2024, 23:05
Behavioral task
behavioral1
Sample
HydraDragonAntivirus-main/website/fullymatch.py
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
HydraDragonAntivirus-main/website/fullymatch.py
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
HydraDragonAntivirus-main/website/hydraupdater.py
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
HydraDragonAntivirus-main/website/hydraupdater.py
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
HydraDragonAntivirus-main/website/nochracter.py
Resource
win7-20241023-en
Behavioral task
behavioral6
Sample
HydraDragonAntivirus-main/website/nochracter.py
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
HydraDragonAntivirus-main/website/theunknowndetector.py
Resource
win7-20241010-en
Behavioral task
behavioral8
Sample
HydraDragonAntivirus-main/website/theunknowndetector.py
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
HydraDragonAntivirus-main/website/tools/containsnothing.py
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
HydraDragonAntivirus-main/website/tools/containsnothing.py
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
HydraDragonAntivirus-main/website/tools/domainchecker.py
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
HydraDragonAntivirus-main/website/tools/domainchecker.py
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
HydraDragonAntivirus-main/website/tools/noipinodomains.py
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
HydraDragonAntivirus-main/website/tools/noipinodomains.py
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
HydraDragonAntivirus-main/website/tools/nolocalip.py
Resource
win7-20241010-en
Behavioral task
behavioral16
Sample
HydraDragonAntivirus-main/website/tools/nolocalip.py
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
HydraDragonAntivirus-main/website/tools/problematic.py
Resource
win7-20240729-en
Behavioral task
behavioral18
Sample
HydraDragonAntivirus-main/website/tools/problematic.py
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
HydraDragonAntivirus-main/website/tools/removerunwanted.py
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
HydraDragonAntivirus-main/website/tools/removerunwanted.py
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
HydraDragonAntivirus-main/website/tools/removeunwantedchracters.py
Resource
win7-20241010-en
Behavioral task
behavioral22
Sample
HydraDragonAntivirus-main/website/tools/removeunwantedchracters.py
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
HydraDragonAntivirus-main/website/tools/trashing0.py
Resource
win7-20241023-en
Behavioral task
behavioral24
Sample
HydraDragonAntivirus-main/website/tools/trashing0.py
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
HydraDragonAntivirus-main/website/tools/whitelisting.py
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
HydraDragonAntivirus-main/website/tools/whitelisting.py
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
HydraDragonAntivirus-main/website/tools/whitelistingrecheck.py
Resource
win7-20241010-en
Behavioral task
behavioral28
Sample
HydraDragonAntivirus-main/website/tools/whitelistingrecheck.py
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
HydraDragonAntivirus-main/website/tools/whitelistking.py
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
HydraDragonAntivirus-main/website/tools/whitelistking.py
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
HydraDragonAntivirus-main/website/tools/whitelistking0.py
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
HydraDragonAntivirus-main/website/tools/whitelistking0.py
Resource
win10v2004-20241007-en
General
-
Target
HydraDragonAntivirus-main/website/hydraupdater.py
-
Size
811B
-
MD5
38afd731ff251406768b957ba37b2abc
-
SHA1
069819413b22442e89f64f7293462582e4973ea5
-
SHA256
659b7ce420f2fc177f0b9f57873a391e4d57e62ebe8e6e0fbcf4bc64aca1b17f
-
SHA512
fc75a17c14735702f7afa5d3ae3f17de38c3ea5c8f3f68e23f56e9cc48eacb73d17cdfcbff07a3ed5f4b7cba1d3526c1c76da6eac646fb4d0d4f3d551db5e335
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 17 IoCs
pid Process 3536 OpenWith.exe 3536 OpenWith.exe 3536 OpenWith.exe 3536 OpenWith.exe 3536 OpenWith.exe 3536 OpenWith.exe 3536 OpenWith.exe 3536 OpenWith.exe 3536 OpenWith.exe 3536 OpenWith.exe 3536 OpenWith.exe 3536 OpenWith.exe 3536 OpenWith.exe 3536 OpenWith.exe 3536 OpenWith.exe 3536 OpenWith.exe 3536 OpenWith.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3536 wrote to memory of 2748 3536 OpenWith.exe 94 PID 3536 wrote to memory of 2748 3536 OpenWith.exe 94
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\HydraDragonAntivirus-main\website\hydraupdater.py1⤵
- Modifies registry class
PID:3660
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\HydraDragonAntivirus-main\website\hydraupdater.py2⤵PID:2748
-