Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10Court Proj...IO.exe
windows10-ltsc 2021-x64
7Court Proj...ct.exe
windows10-ltsc 2021-x64
9Court Proj...fo.exe
windows10-ltsc 2021-x64
3Court Proj...ing.py
windows10-ltsc 2021-x64
3Court Proj...ker.py
windows10-ltsc 2021-x64
3Court Proj...mer.py
windows10-ltsc 2021-x64
3Court Proj...up.exe
windows10-ltsc 2021-x64
7Court Proj...one.py
windows10-ltsc 2021-x64
3Court Proj...pic.py
windows10-ltsc 2021-x64
3Analysis
-
max time kernel
146s -
max time network
152s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20250128-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250128-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
02/02/2025, 15:00
Behavioral task
behavioral1
Sample
Court Project V1.1/AIO.exe
Resource
win10ltsc2021-20250128-en
Behavioral task
behavioral2
Sample
Court Project V1.1/Court Project.exe
Resource
win10ltsc2021-20250128-en
Behavioral task
behavioral3
Sample
Court Project V1.1/Doxinfo.exe
Resource
win10ltsc2021-20250128-en
Behavioral task
behavioral4
Sample
Court Project V1.1/Doxing.py
Resource
win10ltsc2021-20250128-en
Behavioral task
behavioral5
Sample
Court Project V1.1/Doxtracker.py
Resource
win10ltsc2021-20250128-en
Behavioral task
behavioral6
Sample
Court Project V1.1/GmailSpammer.py
Resource
win10ltsc2021-20250128-en
Behavioral task
behavioral7
Sample
Court Project V1.1/iplookup.exe
Resource
win10ltsc2021-20250128-en
Behavioral task
behavioral8
Sample
Court Project V1.1/phone.py
Resource
win10ltsc2021-20250128-en
Behavioral task
behavioral9
Sample
Court Project V1.1/reversepic.py
Resource
win10ltsc2021-20250128-en
General
-
Target
Court Project V1.1/phone.py
-
Size
913B
-
MD5
0a9939cd780f54b08593509d8efce5aa
-
SHA1
4a5cb2c39f53a1cf945082acdfe966c5d3ccf2a0
-
SHA256
879a15ee153cfd588b61bf07fc56e5fd8a6c3f6bcb42230acfee2e22f19ce536
-
SHA512
592f0152cc85618fcb263105b147b1f7d45a6c037c76801a310fca68658b29504f49efa2d0d4fff89e72fece8b9bba26d1857db2cc4a50b8073602ddcff85674
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-946476529-1335986830-1090511001-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-946476529-1335986830-1090511001-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2128 OpenWith.exe