Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

30/12/2024, 00:00

241230-aagpcs1lgt 10

29/12/2024, 23:59

241229-31rw8s1lhm 10

25/12/2024, 13:51

241225-q5yjcsvjcw 10

Analysis

  • max time kernel
    721s
  • max time network
    726s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    30/12/2024, 00:00

General

  • Target

    misc.pyc

  • Size

    2KB

  • MD5

    bcb404423ac51f798753e8d11e401071

  • SHA1

    9080018dae3aa157e3a97904c86af06d4a0a6873

  • SHA256

    572b18ccb1838f23714fae1c8cbb399a08796b1eb846960d5463d40ee784fe5a

  • SHA512

    25a2997cff19308956086ae4e464f5039e53149043f094f2a65dae4dfa78b6410650a3c4d1514511f23c6bf77228772fa7b8a3cf5119e4ed46edb65ac40ff800

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\misc.pyc
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1680
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\misc.pyc
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2876
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\misc.pyc"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2664

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    2d5bf2a5bb9de5858203b0fbe1bff6bd

    SHA1

    afa95ed53d2cb70e00eaaff3438a5ba0cd67eb3e

    SHA256

    d12e9460bfd48c0f5143cd21db243aa11c00f01c49323913189275fde231858c

    SHA512

    4cabf097750cae19c097ee69492a02799ac2d138480614441d28dc25a640bbbd1f5f9eb1941db7352bf4e3bcd9755f8d99fcf3f86796fdf117daf40a646b3932