Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10Bugs.dll
windows7-x64
1Bugs.dll
windows10-2004-x64
1Decompiler V.2.4.exe
windows7-x64
7Decompiler V.2.4.exe
windows10-2004-x64
9LoaderScripts.py
windows7-x64
3LoaderScripts.py
windows10-2004-x64
3Roblox HWD/Bugs.dll
windows7-x64
1Roblox HWD/Bugs.dll
windows10-2004-x64
1Roblox HWD/Scripts.py
windows7-x64
3Roblox HWD/Scripts.py
windows10-2004-x64
3Scripts/Scripts.py
windows7-x64
3Scripts/Scripts.py
windows10-2004-x64
3Scripts/ServerSide.py
windows7-x64
3Scripts/ServerSide.py
windows10-2004-x64
3decompile.dll
windows7-x64
1decompile.dll
windows10-2004-x64
1krnlapi.dll
windows7-x64
1krnlapi.dll
windows10-2004-x64
1saveinstance.dll
windows7-x64
1saveinstance.dll
windows10-2004-x64
1Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
12/01/2025, 14:03
Behavioral task
behavioral1
Sample
Bugs.dll
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
Bugs.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Decompiler V.2.4.exe
Resource
win7-20241023-en
Behavioral task
behavioral4
Sample
Decompiler V.2.4.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
LoaderScripts.py
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
LoaderScripts.py
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Roblox HWD/Bugs.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
Roblox HWD/Bugs.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
Roblox HWD/Scripts.py
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
Roblox HWD/Scripts.py
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
Scripts/Scripts.py
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
Scripts/Scripts.py
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
Scripts/ServerSide.py
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
Scripts/ServerSide.py
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
decompile.dll
Resource
win7-20241010-en
Behavioral task
behavioral16
Sample
decompile.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
krnlapi.dll
Resource
win7-20240729-en
Behavioral task
behavioral18
Sample
krnlapi.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
saveinstance.dll
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
saveinstance.dll
Resource
win10v2004-20241007-en
General
-
Target
Scripts/Scripts.py
-
Size
2KB
-
MD5
8f65f38bca462f4841aeca7b9fae6078
-
SHA1
c6cfd3b8788a934a2830bf9dc561bffac072efab
-
SHA256
cc3e3f0a38dcede5641b5f79f6d34907d11035cd33c02ed85d88541b07267512
-
SHA512
2232a0442efb56bcf784a155ae46fc9b4f295985a307062efae1517cc13df59acf47669332a8d2f5d8057b8d0c73bad07b404125448a48bd5b821d18348c367b
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2172 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2172 AcroRd32.exe 2172 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2644 wrote to memory of 2772 2644 cmd.exe 31 PID 2644 wrote to memory of 2772 2644 cmd.exe 31 PID 2644 wrote to memory of 2772 2644 cmd.exe 31 PID 2772 wrote to memory of 2172 2772 rundll32.exe 32 PID 2772 wrote to memory of 2172 2772 rundll32.exe 32 PID 2772 wrote to memory of 2172 2772 rundll32.exe 32 PID 2772 wrote to memory of 2172 2772 rundll32.exe 32
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Scripts\Scripts.py1⤵
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Scripts\Scripts.py2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Scripts\Scripts.py"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2172
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5b2400623f191b4bd94ba63ecb459ecd2
SHA1a27e5b53bd94a37ed1d1745405dd440826240e1d
SHA25653e403d2866a8cc4809c97716aad1c15f28e6b0f1d33be734a05cb9b68e9fcdf
SHA5128679603715526a1e483a7b0acd56ea587e5477afb07d568fb1b14b828724996bca97b8ff4840ad7941f974d23d9aa4086cc22347502888719e6b245755b25e13