Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10Rich Executor.exe
windows7-x64
7Rich Executor.exe
windows10-2004-x64
7discord_to...er.pyc
windows7-x64
3discord_to...er.pyc
windows10-2004-x64
3get_cookies.pyc
windows7-x64
3get_cookies.pyc
windows10-2004-x64
3misc.pyc
windows7-x64
3misc.pyc
windows10-2004-x64
3passwords_grabber.pyc
windows7-x64
3passwords_grabber.pyc
windows10-2004-x64
3source_prepared.pyc
windows7-x64
3source_prepared.pyc
windows10-2004-x64
3Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
15/01/2025, 16:53
Behavioral task
behavioral1
Sample
Rich Executor.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Rich Executor.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
discord_token_grabber.pyc
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
discord_token_grabber.pyc
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
get_cookies.pyc
Resource
win7-20240729-en
Behavioral task
behavioral6
Sample
get_cookies.pyc
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
misc.pyc
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
misc.pyc
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
passwords_grabber.pyc
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
passwords_grabber.pyc
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
source_prepared.pyc
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
source_prepared.pyc
Resource
win10v2004-20241007-en
General
-
Target
get_cookies.pyc
-
Size
9KB
-
MD5
32bb8ed84a18f665d03dd5afbc7b65b0
-
SHA1
a2129ec6568e20c620429d884a13cd4671504a2b
-
SHA256
7d9fff7c91679c94728b83eeabc34f54201fc9ee6fa6806665b25007ce5b88a6
-
SHA512
399198dfac2fd7bdea480d93d836c2f194ae9c93d7ee7855537cac44bf7c6e463a8104f7f7380b9f075fdd67bb12027909ce2d3407b5423d2837a96c3c835bc2
-
SSDEEP
192:lNaBBeiNR9QfUF2x3NC79F21aG67+DAhN:lPiT2XtFcjKDAhN
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2720 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2720 AcroRd32.exe 2720 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1916 wrote to memory of 2472 1916 cmd.exe 31 PID 1916 wrote to memory of 2472 1916 cmd.exe 31 PID 1916 wrote to memory of 2472 1916 cmd.exe 31 PID 2472 wrote to memory of 2720 2472 rundll32.exe 32 PID 2472 wrote to memory of 2720 2472 rundll32.exe 32 PID 2472 wrote to memory of 2720 2472 rundll32.exe 32 PID 2472 wrote to memory of 2720 2472 rundll32.exe 32
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\get_cookies.pyc1⤵
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\get_cookies.pyc2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\get_cookies.pyc"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2720
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD50c3d634bd8dfc2b7b1a632cf348746c8
SHA1a1c7228d42416d3c7c0c3ce8e39af166db7653b2
SHA25657f8fb9f2138703f1cd0d005d4203bb861d29240c7069a73005d1823ad49bbf9
SHA512027ad1e81878d05dd99c88ef47d1ff726f2ff2a3765f4c30113c810dc1c95ca80d65ed80496f77b576b0b61d8327c12b313e58eda6f65c81752bc6424df0e03c