Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    14/02/2025, 13:04

General

  • Target

    RoBrute-master/socks.py

  • Size

    31KB

  • MD5

    48785c4abab003e3567e381d81a4e3fe

  • SHA1

    b78b23d63ac8d301e24e9a0f2c709f4d02abba87

  • SHA256

    bc89e89dcd6a255af82c73cbd6cbbaaddba2aa83380188bbb8282aef40b0a11a

  • SHA512

    52d7002548b3dc31ba4c355270577b92980c4a569dcad45c6af518da7355fcec0ace7c9ce5fabcf68dc04b2211d0d31a5cac1e7dc92a5017a1c3f1ed74cbb09a

  • SSDEEP

    768:MTMqwGwX3Q/28zGh9czigrcQcJWN2hqoJRBLXo:M1rwXl8zGhCzig4QIWN0JRBjo

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\RoBrute-master\socks.py
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2996
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\RoBrute-master\socks.py
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2132
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\RoBrute-master\socks.py"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2760

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    6aa2befcb978067e078e11e0007e4697

    SHA1

    c30806307c0244b2bc2185314b0a5f44ebbb8192

    SHA256

    826461db24ded08326de1e738ebad9889cb8b92e28724bd96120af5ab7e88ad0

    SHA512

    5d050624b868e5809912d4c293d3b26d7a0b5d3d48a8d949e34fb5d30be3032bd934dd5cbd139488a54e7bf647aa8480fb618749cebc5bc9f81747f01a6a6b54