Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

30/12/2024, 00:00

241230-aagpcs1lgt 10

29/12/2024, 23:59

241229-31rw8s1lhm 10

25/12/2024, 13:51

241225-q5yjcsvjcw 10

Analysis

  • max time kernel
    839s
  • max time network
    840s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    30/12/2024, 00:00

General

  • Target

    discord_token_grabber.pyc

  • Size

    8KB

  • MD5

    6b2aaa23f9b67dca5fa0efd9d96e9060

  • SHA1

    07293442aa33cbc0afc1b69af287b1fede2e9a70

  • SHA256

    f49ba791814001b3d4101685bfebb635cdaf3103407a08171bb5d6bbe3e79c77

  • SHA512

    bcd7b41e7758b30954b0e24db5d53d3d904b6c4b9a5105bd33e5dddddb310614cc09a028d0cd8ccb6a272ce5eba0e9142a1cc36ec848b54fb99b695752b5e20d

  • SSDEEP

    192:ESB7osP1MJaugwXaafNqaclHJLOq3ZJFD/b8xjJzdJv:TP1iavwTqacyq35D0Fnv

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\discord_token_grabber.pyc
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2168
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\discord_token_grabber.pyc
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2684
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\discord_token_grabber.pyc"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2688

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    9acb4c17d9854af801d2bf72f78ba4ce

    SHA1

    4bc52054b83f547b7925b2f8c8a725aec31a38dd

    SHA256

    1f0137074e381e68d8c4d2bc8368aca34f852d33f7a16d9883ae8e0a9ed9102c

    SHA512

    a5be7af39e6c1e2049ac9e04cafe621d0d016f9cc2e090e6e8c7968d563e1644fd0959c807028ecc27a4f82420405e5c90fcc29913bd9e15b59350ff6a8f756e