Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10RGF-main/Input.zip
windows7-x64
1RGF-main/Input.zip
windows10-2004-x64
3RoBrute-ma...ute.py
ubuntu-18.04-amd64
RoBrute-ma...ute.py
debian-9-armhf
RoBrute-ma...ute.py
debian-9-mips
RoBrute-ma...ute.py
debian-9-mipsel
RoBrute-ma...Lib.py
windows7-x64
3RoBrute-ma...Lib.py
windows10-2004-x64
8RoBrute-ma...ib.pyc
windows7-x64
3RoBrute-ma...ib.pyc
windows10-2004-x64
8RoBrute-ma...cks.py
windows7-x64
3RoBrute-ma...cks.py
windows10-2004-x64
8RoBrute-ma...ks.pyc
windows7-x64
3RoBrute-ma...ks.pyc
windows10-2004-x64
8RGF-main/RBF.exe
windows7-x64
10RGF-main/RBF.exe
windows10-2004-x64
10Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
14/02/2025, 13:04
Behavioral task
behavioral1
Sample
RGF-main/Input.zip
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
RGF-main/Input.zip
Resource
win10v2004-20250211-en
Behavioral task
behavioral3
Sample
RoBrute-master/RoBrute.py
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral4
Sample
RoBrute-master/RoBrute.py
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral5
Sample
RoBrute-master/RoBrute.py
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral6
Sample
RoBrute-master/RoBrute.py
Resource
debian9-mipsel-20240611-en
Behavioral task
behavioral7
Sample
RoBrute-master/mainLib.py
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
RoBrute-master/mainLib.py
Resource
win10v2004-20250211-en
Behavioral task
behavioral9
Sample
RoBrute-master/mainLib.pyc
Resource
win7-20241023-en
Behavioral task
behavioral10
Sample
RoBrute-master/mainLib.pyc
Resource
win10v2004-20250211-en
Behavioral task
behavioral11
Sample
RoBrute-master/socks.py
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
RoBrute-master/socks.py
Resource
win10v2004-20250207-en
Behavioral task
behavioral13
Sample
RoBrute-master/socks.pyc
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
RoBrute-master/socks.pyc
Resource
win10v2004-20250207-en
Behavioral task
behavioral15
Sample
RGF-main/RBF.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
RGF-main/RBF.exe
Resource
win10v2004-20250211-en
General
-
Target
RoBrute-master/mainLib.py
-
Size
481B
-
MD5
d605f4316cf7dd5b2f4d68e5534903a5
-
SHA1
1d9f87b0316cacdbc97c265a2005ceb9f04dd0e2
-
SHA256
930cac6585d68eef349b1db9e376c3c9cef6a764a51c6e19a55b3d23cbe4acbd
-
SHA512
384a3e39dad72d77fa8da085714b08ea8bddaa49c70df389febf9290c9ce09114646c417d31d6888437d237817b2eea67d183c7c65e5e985faa66a02b05a746b
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2680 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2680 AcroRd32.exe 2680 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2280 wrote to memory of 1988 2280 cmd.exe 31 PID 2280 wrote to memory of 1988 2280 cmd.exe 31 PID 2280 wrote to memory of 1988 2280 cmd.exe 31 PID 1988 wrote to memory of 2680 1988 rundll32.exe 32 PID 1988 wrote to memory of 2680 1988 rundll32.exe 32 PID 1988 wrote to memory of 2680 1988 rundll32.exe 32 PID 1988 wrote to memory of 2680 1988 rundll32.exe 32
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\RoBrute-master\mainLib.py1⤵
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\RoBrute-master\mainLib.py2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\RoBrute-master\mainLib.py"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2680
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5a6654c3a48b46b725daf9c1ed13b5958
SHA11d5c7a9aea3d52d694e6fb8133d9817d3650350a
SHA25629154c5464aa4b4da4f0ba21dcedd45f721b34824f8200dca8537942a8a8102b
SHA512aafa2d0db8d497c0fb6d8f1dc352f8e9ec271e246ab39a629085018d13eb71a456f2b883c6a1728f9bfb943614a43e227dad3a6c18b784d72431e7cb2d29c0c3