Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
30/01/2025, 06:42
Behavioral task
behavioral1
Sample
Wave.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
Wave.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral3
Sample
Stub.pyc
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
Stub.pyc
Resource
win10v2004-20250129-en
General
-
Target
Stub.pyc
-
Size
799KB
-
MD5
986ea60d59009e4643ac95b4d50d5fb4
-
SHA1
2936dd2ed94d101daaf12b947cada396e3b19b2c
-
SHA256
edfec6ec07fc31c0c9c3d875e6262f362a342fdf2acfb006d46fc6a36852b05f
-
SHA512
22ac112950353d71962737d3046db4e4ffedad7b8165efe11b1aa91c337b7dcd1a03c6bb830b9ed782a7663c4733f5c158e787d46e05e546baa38c93c56c32f1
-
SSDEEP
24576:ChGx/p2sXyHHOHZHIMXE+Ge+vKeo0qVCB7:YU2lumVJZsCZ
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2648 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2648 AcroRd32.exe 2648 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1664 wrote to memory of 2996 1664 cmd.exe 31 PID 1664 wrote to memory of 2996 1664 cmd.exe 31 PID 1664 wrote to memory of 2996 1664 cmd.exe 31 PID 2996 wrote to memory of 2648 2996 rundll32.exe 32 PID 2996 wrote to memory of 2648 2996 rundll32.exe 32 PID 2996 wrote to memory of 2648 2996 rundll32.exe 32 PID 2996 wrote to memory of 2648 2996 rundll32.exe 32
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Stub.pyc1⤵
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Stub.pyc2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Stub.pyc"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2648
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5fcbdd5033ae9bf258288a00441ba5041
SHA129c6eaf2bdf649ed60721639f3697d8577e7a7cf
SHA2563aa6f9132fac6acf6d6efcb003d3e0eeb15e7f022eab660ea3bb54ba4674fcbb
SHA51296281b60ebcca4602a3ca73a3420b21a61391593018743338aac407126f822a6c5231a15b0da4a19ebe4f3b4399534d1e81e919f298a34c52546b7a04b369621