Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    41s
  • max time network
    33s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    01/05/2023, 20:09

General

  • Target

    Runtime (Abri isso antes de abrir o Extreme Injector).exe

  • Size

    9.6MB

  • MD5

    093ab8b625eb6fd14801118e87fa4eae

  • SHA1

    1c33569c599d47d568a25caa794b01832b0f5b6f

  • SHA256

    4723dcde8ad6d450408d31539b416879a5d525e5ed87a81387b37370e39b33a0

  • SHA512

    1e7e1e655760b6540447edcf95ab26bb597492a8718a91c0c6dcea2b731521a00057af40f4502b9add4c30f070d656d7cfc20d9740aa331e0a597b4c51e933fd

  • SSDEEP

    196608:EuyL9HLAlnfih8FwjxHSRHvUWvozhx0PuqLQbRLXtg/4MNUt8wNT3c:UxAlnfLFHRHd2x0u+QbClN27

Score
7/10
upx

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Runtime (Abri isso antes de abrir o Extreme Injector).exe
    "C:\Users\Admin\AppData\Local\Temp\Runtime (Abri isso antes de abrir o Extreme Injector).exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1460
    • C:\Users\Admin\AppData\Local\Temp\Runtime (Abri isso antes de abrir o Extreme Injector).exe
      "C:\Users\Admin\AppData\Local\Temp\Runtime (Abri isso antes de abrir o Extreme Injector).exe"
      2⤵
      • Loads dropped DLL
      PID:992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI14602\python310.dll

    Filesize

    1.4MB

    MD5

    fe730faa642713f53be7423421cf3273

    SHA1

    b31588980a40f4fc45c5deb51869d850d1490da1

    SHA256

    de05a58247136d07970b5d3a0582143833e397abfb9ba22e36fcae99f4c7c66d

    SHA512

    ab11100259a5b81a8c424f2ea47886ca821bad1128973fd4bc068f9f46b4000f54793edb2dcb596e63616bb45e88b30ea129100225685c17ed36ca6b238c37bf

  • \Users\Admin\AppData\Local\Temp\_MEI14602\python310.dll

    Filesize

    1.4MB

    MD5

    fe730faa642713f53be7423421cf3273

    SHA1

    b31588980a40f4fc45c5deb51869d850d1490da1

    SHA256

    de05a58247136d07970b5d3a0582143833e397abfb9ba22e36fcae99f4c7c66d

    SHA512

    ab11100259a5b81a8c424f2ea47886ca821bad1128973fd4bc068f9f46b4000f54793edb2dcb596e63616bb45e88b30ea129100225685c17ed36ca6b238c37bf

  • memory/992-133-0x000007FEF6A00000-0x000007FEF6E65000-memory.dmp

    Filesize

    4.4MB