Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    43s
  • max time network
    34s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    05/06/2023, 13:08

General

  • Target

    fb78762d6f78f68ab8814d60b3b47a4d.exe

  • Size

    103.2MB

  • MD5

    fb78762d6f78f68ab8814d60b3b47a4d

  • SHA1

    d2c1ad9dd1300b0914a5fcb1d3d9ce315a1b5c25

  • SHA256

    ac446b92a1dc73aeb847bb09f48fa6109adc05d491987851c2e715bfbef16424

  • SHA512

    9a0c24263acda506f7a951e9338e3fc99f8d54ef5f2ea8a6172889e38542d6435dc5bf9052318977ca8fbf41470cb862134e6ebf18e159cf888552fcb3917f5d

  • SSDEEP

    3145728:rr0ZLH46uMDhrPKAai+nCduskFmmySb+I6de4f2N1zW4f/gweyW:rr0ZLGtDi+CjkFmmButf2/znfHW

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fb78762d6f78f68ab8814d60b3b47a4d.exe
    "C:\Users\Admin\AppData\Local\Temp\fb78762d6f78f68ab8814d60b3b47a4d.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:876
    • C:\Users\Admin\AppData\Local\Temp\fb78762d6f78f68ab8814d60b3b47a4d.exe
      "C:\Users\Admin\AppData\Local\Temp\fb78762d6f78f68ab8814d60b3b47a4d.exe"
      2⤵
      • Loads dropped DLL
      PID:2028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI8762\python311.dll

    Filesize

    5.5MB

    MD5

    e2bd5ae53427f193b42d64b8e9bf1943

    SHA1

    7c317aad8e2b24c08d3b8b3fba16dd537411727f

    SHA256

    c4844b05e3a936b130adedb854d3c04d49ee54edb43e9d36f8c4ae94ccb78400

    SHA512

    ae23a6707e539c619fd5c5b4fc6e4734edc91f89ebe024d25ff2a70168da6105ac0bd47cf6bf3715af6411963caf0acbb4632464e1619ca6361abf53adfe7036

  • \Users\Admin\AppData\Local\Temp\_MEI8762\python311.dll

    Filesize

    5.5MB

    MD5

    e2bd5ae53427f193b42d64b8e9bf1943

    SHA1

    7c317aad8e2b24c08d3b8b3fba16dd537411727f

    SHA256

    c4844b05e3a936b130adedb854d3c04d49ee54edb43e9d36f8c4ae94ccb78400

    SHA512

    ae23a6707e539c619fd5c5b4fc6e4734edc91f89ebe024d25ff2a70168da6105ac0bd47cf6bf3715af6411963caf0acbb4632464e1619ca6361abf53adfe7036