Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

NOTMALWARE.exe

windows7-x64

7

NOTMALWARE.exe

windows10-1703-x64

7

Resubmissions

12/05/2023, 01:40

230512-b3nh2sde7w 7

12/05/2023, 01:39

230512-b2yydsde7v 7

12/05/2023, 01:37

230512-b2bsvsbc43 7

Analysis

  • max time kernel
    14s
  • max time network
    17s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    12/05/2023, 01:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    NOTMALWARE.exe

  • Size

    6.1MB

  • MD5

    8de136c99e448cb3787336570197ef0b

  • SHA1

    07612a501d123fc9876dc5a6b5d8f1459a2d50a3

  • SHA256

    d199504123a0ddfacd241bc39fff0d15d2eba859c8ecc95a89e058067c7b5021

  • SHA512

    29c657f4cfe8f192b1e7f96694209b2e692f63d689c4827226410c2561b46908296d07e02b47d099866389f348fa0fc68d891a3f343e3735e970be9b41ca4af5

  • SSDEEP

    98304:8oZIfh7ZMD/x/0feyGutbQ940BDlgwdnpka9R/k9t+2MGt+Nkpogug6ZqREPOhIv:8mmuDfyGuwBdnpkYRM66ogVCmh

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 13 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NOTMALWARE.exe
    "C:\Users\Admin\AppData\Local\Temp\NOTMALWARE.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2540
    • C:\Users\Admin\AppData\Local\Temp\NOTMALWARE.exe
      "C:\Users\Admin\AppData\Local\Temp\NOTMALWARE.exe"
      2⤵
      • Loads dropped DLL
      PID:3828

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI25402\VCRUNTIME140.dll
    Filesize

    95KB

    MD5

    f34eb034aa4a9735218686590cba2e8b

    SHA1

    2bc20acdcb201676b77a66fa7ec6b53fa2644713

    SHA256

    9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1

    SHA512

    d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI25402\_bz2.pyd
    Filesize

    81KB

    MD5

    86d1b2a9070cd7d52124126a357ff067

    SHA1

    18e30446fe51ced706f62c3544a8c8fdc08de503

    SHA256

    62173a8fadd4bf4dd71ab89ea718754aa31620244372f0c5bbbae102e641a60e

    SHA512

    7db4b7e0c518a02ae901f4b24e3860122acc67e38e73f98f993fe99eb20bb3aa539db1ed40e63d6021861b54f34a5f5a364907ffd7da182adea68bbdd5c2b535

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI25402\_hashlib.pyd
    Filesize

    63KB

    MD5

    d4674750c732f0db4c4dd6a83a9124fe

    SHA1

    fd8d76817abc847bb8359a7c268acada9d26bfd5

    SHA256

    caa4d2f8795e9a55e128409cc016e2cc5c694cb026d7058fc561e4dd131ed1c9

    SHA512

    97d57cfb80dd9dd822f2f30f836e13a52f771ee8485bc0fd29236882970f6bfbdfaac3f2e333bba5c25c20255e8c0f5ad82d8bc8a6b6e2f7a07ea94a9149c81e

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI25402\_lzma.pyd
    Filesize

    154KB

    MD5

    7447efd8d71e8a1929be0fac722b42dc

    SHA1

    6080c1b84c2dcbf03dcc2d95306615ff5fce49a6

    SHA256

    60793c8592193cfbd00fd3e5263be4315d650ba4f9e4fda9c45a10642fd998be

    SHA512

    c6295d45ed6c4f7534c1a38d47ddc55fea8b9f62bbdc0743e4d22e8ad0484984f8ab077b73e683d0a92d11bf6588a1ae395456cfa57da94bb2a6c4a1b07984de

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI25402\_queue.pyd
    Filesize

    30KB

    MD5

    d8c1b81bbc125b6ad1f48a172181336e

    SHA1

    3ff1d8dcec04ce16e97e12263b9233fbf982340c

    SHA256

    925f05255f4aae0997dc4ec94d900fd15950fd840685d5b8aa755427c7422b14

    SHA512

    ccc9f0d3aca66729832f26be12f8e7021834bbee1f4a45da9451b1aa5c2e63126c0031d223af57cf71fad2c85860782a56d78d8339b35720194df139076e0772

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI25402\_socket.pyd
    Filesize

    77KB

    MD5

    819166054fec07efcd1062f13c2147ee

    SHA1

    93868ebcd6e013fda9cd96d8065a1d70a66a2a26

    SHA256

    e6deb751039cd5424a139708475ce83f9c042d43e650765a716cb4a924b07e4f

    SHA512

    da3a440c94cb99b8af7d2bc8f8f0631ae9c112bd04badf200edbf7ea0c48d012843b4a9fb9f1e6d3a9674fd3d4eb6f0fa78fd1121fad1f01f3b981028538b666

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI25402\_ssl.pyd
    Filesize

    156KB

    MD5

    7910fb2af40e81bee211182cffec0a06

    SHA1

    251482ed44840b3c75426dd8e3280059d2ca06c6

    SHA256

    d2a7999e234e33828888ad455baa6ab101d90323579abc1095b8c42f0f723b6f

    SHA512

    bfe6506feb27a592fe9cf1db7d567d0d07f148ef1a2c969f1e4f7f29740c6bb8ccf946131e65fe5aa8ede371686c272b0860bd4c0c223195aaa1a44f59301b27

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI25402\base_library.zip
    Filesize

    1.0MB

    MD5

    f9fc08cb2176d8d2e61fe6fbeac58d64

    SHA1

    58d0f2a1cb9884ef3f66acc907172bf0a0f31822

    SHA256

    14984dcf4d8dfc0f0306aaa6092c50d205ae8242480ef711c1f6622f7408c15f

    SHA512

    bdb7c21868521bf3ad0bff1db92f9b982cbe0130f8bfb424c7cb84cb2263b703235acd2a105c8b1dea12bc82dcb7a098c27d7550157ded9e49f9590359d1bb82

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI25402\certifi\cacert.pem
    Filesize

    268KB

    MD5

    59a15f9a93dcdaa5bfca246b84fa936a

    SHA1

    7f295ea74fc7ed0af0e92be08071fb0b76c8509e

    SHA256

    2c11c3ce08ffc40d390319c72bc10d4f908e9c634494d65ed2cbc550731fd524

    SHA512

    746157a0fcedc67120c2a194a759fa8d8e1f84837e740f379566f260e41aa96b8d4ea18e967e3d1aa1d65d5de30453446d8a8c37c636c08c6a3741387483a7d7

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI25402\libcrypto-1_1.dll
    Filesize

    3.3MB

    MD5

    9d7a0c99256c50afd5b0560ba2548930

    SHA1

    76bd9f13597a46f5283aa35c30b53c21976d0824

    SHA256

    9b7b4a0ad212095a8c2e35c71694d8a1764cd72a829e8e17c8afe3a55f147939

    SHA512

    cb39aa99b9d98c735fdacf1c5ed68a4d09d11f30262b91f6aa48c3f8520eff95e499400d0ce7e280ca7a90ff6d7141d2d893ef0b33a8803a1cadb28ba9a9e3e2

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI25402\libssl-1_1.dll
    Filesize

    688KB

    MD5

    bec0f86f9da765e2a02c9237259a7898

    SHA1

    3caa604c3fff88e71f489977e4293a488fb5671c

    SHA256

    d74ce01319ae6f54483a19375524aa39d9f5fd91f06cf7df238ca25e043130fd

    SHA512

    ffbc4e5ffdb49704e7aa6d74533e5af76bbe5db297713d8e59bd296143fe5f145fbb616b343eed3c48eceaccccc2431630470d8975a4a17c37eafcc12edd19f4

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI25402\python310.dll
    Filesize

    4.3MB

    MD5

    63a1fa9259a35eaeac04174cecb90048

    SHA1

    0dc0c91bcd6f69b80dcdd7e4020365dd7853885a

    SHA256

    14b06796f288bc6599e458fb23a944ab0c843e9868058f02a91d4606533505ed

    SHA512

    896caa053f48b1e4102e0f41a7d13d932a746eea69a894ae564ef5a84ef50890514deca6496e915aae40a500955220dbc1b1016fe0b8bcdde0ad81b2917dea8b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI25402\select.pyd
    Filesize

    29KB

    MD5

    a653f35d05d2f6debc5d34daddd3dfa1

    SHA1

    1a2ceec28ea44388f412420425665c3781af2435

    SHA256

    db85f2f94d4994283e1055057372594538ae11020389d966e45607413851d9e9

    SHA512

    5aede99c3be25b1a962261b183ae7a7fb92cb0cb866065dc9cd7bb5ff6f41cc8813d2cc9de54670a27b3ad07a33b833eaa95a5b46dad7763ca97dfa0c1ce54c9

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI25402\unicodedata.pyd
    Filesize

    1.1MB

    MD5

    81d62ad36cbddb4e57a91018f3c0816e

    SHA1

    fe4a4fc35df240b50db22b35824e4826059a807b

    SHA256

    1fb2d66c056f69e8bbdd8c6c910e72697874dae680264f8fb4b4df19af98aa2e

    SHA512

    7d15d741378e671591356dfaad4e1e03d3f5456cbdf87579b61d02a4a52ab9b6ecbffad3274cede8c876ea19eaeb8ba4372ad5986744d430a29f50b9caffb75d

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI25402\VCRUNTIME140.dll
    Filesize

    95KB

    MD5

    f34eb034aa4a9735218686590cba2e8b

    SHA1

    2bc20acdcb201676b77a66fa7ec6b53fa2644713

    SHA256

    9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1

    SHA512

    d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI25402\_bz2.pyd
    Filesize

    81KB

    MD5

    86d1b2a9070cd7d52124126a357ff067

    SHA1

    18e30446fe51ced706f62c3544a8c8fdc08de503

    SHA256

    62173a8fadd4bf4dd71ab89ea718754aa31620244372f0c5bbbae102e641a60e

    SHA512

    7db4b7e0c518a02ae901f4b24e3860122acc67e38e73f98f993fe99eb20bb3aa539db1ed40e63d6021861b54f34a5f5a364907ffd7da182adea68bbdd5c2b535

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI25402\_hashlib.pyd
    Filesize

    63KB

    MD5

    d4674750c732f0db4c4dd6a83a9124fe

    SHA1

    fd8d76817abc847bb8359a7c268acada9d26bfd5

    SHA256

    caa4d2f8795e9a55e128409cc016e2cc5c694cb026d7058fc561e4dd131ed1c9

    SHA512

    97d57cfb80dd9dd822f2f30f836e13a52f771ee8485bc0fd29236882970f6bfbdfaac3f2e333bba5c25c20255e8c0f5ad82d8bc8a6b6e2f7a07ea94a9149c81e

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI25402\_lzma.pyd
    Filesize

    154KB

    MD5

    7447efd8d71e8a1929be0fac722b42dc

    SHA1

    6080c1b84c2dcbf03dcc2d95306615ff5fce49a6

    SHA256

    60793c8592193cfbd00fd3e5263be4315d650ba4f9e4fda9c45a10642fd998be

    SHA512

    c6295d45ed6c4f7534c1a38d47ddc55fea8b9f62bbdc0743e4d22e8ad0484984f8ab077b73e683d0a92d11bf6588a1ae395456cfa57da94bb2a6c4a1b07984de

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI25402\_queue.pyd
    Filesize

    30KB

    MD5

    d8c1b81bbc125b6ad1f48a172181336e

    SHA1

    3ff1d8dcec04ce16e97e12263b9233fbf982340c

    SHA256

    925f05255f4aae0997dc4ec94d900fd15950fd840685d5b8aa755427c7422b14

    SHA512

    ccc9f0d3aca66729832f26be12f8e7021834bbee1f4a45da9451b1aa5c2e63126c0031d223af57cf71fad2c85860782a56d78d8339b35720194df139076e0772

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI25402\_socket.pyd
    Filesize

    77KB

    MD5

    819166054fec07efcd1062f13c2147ee

    SHA1

    93868ebcd6e013fda9cd96d8065a1d70a66a2a26

    SHA256

    e6deb751039cd5424a139708475ce83f9c042d43e650765a716cb4a924b07e4f

    SHA512

    da3a440c94cb99b8af7d2bc8f8f0631ae9c112bd04badf200edbf7ea0c48d012843b4a9fb9f1e6d3a9674fd3d4eb6f0fa78fd1121fad1f01f3b981028538b666

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI25402\_ssl.pyd
    Filesize

    156KB

    MD5

    7910fb2af40e81bee211182cffec0a06

    SHA1

    251482ed44840b3c75426dd8e3280059d2ca06c6

    SHA256

    d2a7999e234e33828888ad455baa6ab101d90323579abc1095b8c42f0f723b6f

    SHA512

    bfe6506feb27a592fe9cf1db7d567d0d07f148ef1a2c969f1e4f7f29740c6bb8ccf946131e65fe5aa8ede371686c272b0860bd4c0c223195aaa1a44f59301b27

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI25402\libcrypto-1_1.dll
    Filesize

    3.3MB

    MD5

    9d7a0c99256c50afd5b0560ba2548930

    SHA1

    76bd9f13597a46f5283aa35c30b53c21976d0824

    SHA256

    9b7b4a0ad212095a8c2e35c71694d8a1764cd72a829e8e17c8afe3a55f147939

    SHA512

    cb39aa99b9d98c735fdacf1c5ed68a4d09d11f30262b91f6aa48c3f8520eff95e499400d0ce7e280ca7a90ff6d7141d2d893ef0b33a8803a1cadb28ba9a9e3e2

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI25402\libcrypto-1_1.dll
    Filesize

    3.3MB

    MD5

    9d7a0c99256c50afd5b0560ba2548930

    SHA1

    76bd9f13597a46f5283aa35c30b53c21976d0824

    SHA256

    9b7b4a0ad212095a8c2e35c71694d8a1764cd72a829e8e17c8afe3a55f147939

    SHA512

    cb39aa99b9d98c735fdacf1c5ed68a4d09d11f30262b91f6aa48c3f8520eff95e499400d0ce7e280ca7a90ff6d7141d2d893ef0b33a8803a1cadb28ba9a9e3e2

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI25402\libssl-1_1.dll
    Filesize

    688KB

    MD5

    bec0f86f9da765e2a02c9237259a7898

    SHA1

    3caa604c3fff88e71f489977e4293a488fb5671c

    SHA256

    d74ce01319ae6f54483a19375524aa39d9f5fd91f06cf7df238ca25e043130fd

    SHA512

    ffbc4e5ffdb49704e7aa6d74533e5af76bbe5db297713d8e59bd296143fe5f145fbb616b343eed3c48eceaccccc2431630470d8975a4a17c37eafcc12edd19f4

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI25402\python310.dll
    Filesize

    4.3MB

    MD5

    63a1fa9259a35eaeac04174cecb90048

    SHA1

    0dc0c91bcd6f69b80dcdd7e4020365dd7853885a

    SHA256

    14b06796f288bc6599e458fb23a944ab0c843e9868058f02a91d4606533505ed

    SHA512

    896caa053f48b1e4102e0f41a7d13d932a746eea69a894ae564ef5a84ef50890514deca6496e915aae40a500955220dbc1b1016fe0b8bcdde0ad81b2917dea8b

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI25402\select.pyd
    Filesize

    29KB

    MD5

    a653f35d05d2f6debc5d34daddd3dfa1

    SHA1

    1a2ceec28ea44388f412420425665c3781af2435

    SHA256

    db85f2f94d4994283e1055057372594538ae11020389d966e45607413851d9e9

    SHA512

    5aede99c3be25b1a962261b183ae7a7fb92cb0cb866065dc9cd7bb5ff6f41cc8813d2cc9de54670a27b3ad07a33b833eaa95a5b46dad7763ca97dfa0c1ce54c9

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI25402\unicodedata.pyd
    Filesize

    1.1MB

    MD5

    81d62ad36cbddb4e57a91018f3c0816e

    SHA1

    fe4a4fc35df240b50db22b35824e4826059a807b

    SHA256

    1fb2d66c056f69e8bbdd8c6c910e72697874dae680264f8fb4b4df19af98aa2e

    SHA512

    7d15d741378e671591356dfaad4e1e03d3f5456cbdf87579b61d02a4a52ab9b6ecbffad3274cede8c876ea19eaeb8ba4372ad5986744d430a29f50b9caffb75d

    Download Submit