Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    08/01/2025, 02:16

General

  • Target

    source_prepared.pyc

  • Size

    185KB

  • MD5

    822aeac039d0411a064ee540ed9616c9

  • SHA1

    bf59fccfbfd11630d6b4b247cf7526fe78f44fa7

  • SHA256

    c6dd9969b09158e6caece31c321a1b5d7561dc7aef82d10d0cf0a8573ccea8b9

  • SHA512

    13fce9000da3290a47d8383892d50e0f217b91c0694a4a3aced0ab749ec06977d83506cf7867a321a58833fa9e204d464b315e73d29326922ae295eb953b04e3

  • SSDEEP

    3072:wTvkLaiI6A9MmlbJo2PEtelZN+tVZa/zqge6/q6Ckn0:wTsWiILHJo28cN+7Za/zqgeqFCh

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\source_prepared.pyc
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2988
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\source_prepared.pyc
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2160
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\source_prepared.pyc"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2676

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    331efe68e435b5d8557731fb6059c9b7

    SHA1

    ea9730b9013571d587ff711919ebe7e7e4a42494

    SHA256

    fd306ed8e65424b95f5757f2bdc5bcfcdaa91043d5a3c1f98d529541d924b011

    SHA512

    2d2b5c728543566ea2ed5962ffd8e4456bfed850636c2d0b36f05583dd2a0cb07599243d3f44cfcede9ecd97a2b4a0bc33e50c8edf3fe521fcacb37d4e3ac9e0