Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10RGF-main/Input.zip
windows7-x64
1RGF-main/Input.zip
windows10-2004-x64
3RoBrute-ma...ute.py
ubuntu-18.04-amd64
RoBrute-ma...ute.py
debian-9-armhf
RoBrute-ma...ute.py
debian-9-mips
RoBrute-ma...ute.py
debian-9-mipsel
RoBrute-ma...Lib.py
windows7-x64
3RoBrute-ma...Lib.py
windows10-2004-x64
8RoBrute-ma...ib.pyc
windows7-x64
3RoBrute-ma...ib.pyc
windows10-2004-x64
8RoBrute-ma...cks.py
windows7-x64
3RoBrute-ma...cks.py
windows10-2004-x64
8RoBrute-ma...ks.pyc
windows7-x64
3RoBrute-ma...ks.pyc
windows10-2004-x64
8RGF-main/RBF.exe
windows7-x64
10RGF-main/RBF.exe
windows10-2004-x64
10Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
14/02/2025, 13:04
Behavioral task
behavioral1
Sample
RGF-main/Input.zip
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
RGF-main/Input.zip
Resource
win10v2004-20250211-en
Behavioral task
behavioral3
Sample
RoBrute-master/RoBrute.py
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral4
Sample
RoBrute-master/RoBrute.py
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral5
Sample
RoBrute-master/RoBrute.py
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral6
Sample
RoBrute-master/RoBrute.py
Resource
debian9-mipsel-20240611-en
Behavioral task
behavioral7
Sample
RoBrute-master/mainLib.py
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
RoBrute-master/mainLib.py
Resource
win10v2004-20250211-en
Behavioral task
behavioral9
Sample
RoBrute-master/mainLib.pyc
Resource
win7-20241023-en
Behavioral task
behavioral10
Sample
RoBrute-master/mainLib.pyc
Resource
win10v2004-20250211-en
Behavioral task
behavioral11
Sample
RoBrute-master/socks.py
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
RoBrute-master/socks.py
Resource
win10v2004-20250207-en
Behavioral task
behavioral13
Sample
RoBrute-master/socks.pyc
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
RoBrute-master/socks.pyc
Resource
win10v2004-20250207-en
Behavioral task
behavioral15
Sample
RGF-main/RBF.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
RGF-main/RBF.exe
Resource
win10v2004-20250211-en
General
-
Target
RoBrute-master/socks.pyc
-
Size
26KB
-
MD5
c59597fcf54f22c79d319b129c33a62a
-
SHA1
316daa8cc82926af92ae9400c83c172681f427be
-
SHA256
245adcd5c71c12585d86e4cee0370781d99bd3ea8029e9869744028ed26bb7d5
-
SHA512
bf1b978029e2500ef16c4f201ef456324752f2dfc5e213153a861c990010518520e7e2d4b501deab30056302201537291ceff77312f5adae2d3845c8bce2a9c9
-
SSDEEP
768:x+TMqK0DoOgVH8zD5x50Y8a6RA516g0QsCh:k1DIVczDbXr6Ku4h
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2788 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2788 AcroRd32.exe 2788 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3020 wrote to memory of 2996 3020 cmd.exe 32 PID 3020 wrote to memory of 2996 3020 cmd.exe 32 PID 3020 wrote to memory of 2996 3020 cmd.exe 32 PID 2996 wrote to memory of 2788 2996 rundll32.exe 33 PID 2996 wrote to memory of 2788 2996 rundll32.exe 33 PID 2996 wrote to memory of 2788 2996 rundll32.exe 33 PID 2996 wrote to memory of 2788 2996 rundll32.exe 33
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\RoBrute-master\socks.pyc1⤵
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\RoBrute-master\socks.pyc2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\RoBrute-master\socks.pyc"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2788
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD538e7bc2b36b51d5c970ac7755b22eba3
SHA1877506986275a6d3e25e44ab0fb177acbf9f59fb
SHA256700a45c5b2d957c88c71978a1001c5dc2dcdf22de0884bc282c7153e46cd3730
SHA512778fc2c32c8223a3f6ed667e99a5ebaf1a606eb6163d9fb2db91e0acc10173f0161c2cfa4c4012881c2ec38ba1443253b45337333ccecb4400c0c18645cc1572