Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    33s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    13/06/2023, 16:50

General

  • Target

    柒点工具.exe

  • Size

    52KB

  • MD5

    3711098b0cb58c228557c79331a6c358

  • SHA1

    6326c0db7b658c751ada072c9c63a7304cb4a83f

  • SHA256

    d51926e554664bcfb0dc9276401c6e49a8d656c7b451934f849ccb5daf3d5a47

  • SHA512

    fd9124aa3e5eb09dbdf5d6e444355c6415bc18d1c77d837f03c31beea6e06e2121e9b663ac8d9f1d0e95ac0758838655b9b89386a6bf918d19a1ad0687f2983f

  • SSDEEP

    768:Q+71YtumFohRdfdcq4dkbXirwZtF7Mr/jzmMN7OJv9EpxfcfpPEL7:LhiFo7dJokSwZbA3mMNnePEL

Score
7/10
upx

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\柒点工具.exe
    "C:\Users\Admin\AppData\Local\Temp\柒点工具.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1144
    • \??\c:\qdnet\tools\ServerTool.dll
      "c:\qdnet\tools\ServerTool.dll"
      2⤵
      • Executes dropped EXE
      PID:2036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\qdnet\tools\ServerTool.dll

    Filesize

    37KB

    MD5

    4bd0cd7f349d64acbb79734e3897c2b9

    SHA1

    5e37d1bc570eb1a0663f5c69524b2fcca6c570f5

    SHA256

    ef2c3a207c131e0875d2d83cc3908a4db02ba68f401aacef2625a84f5fe8b68c

    SHA512

    12c5aef76165c37aaf095d304352961a80147d3cbe45199beb5d9bb42faa1b71b97da750e841e5a3868ccdcf3e31badad636e18726b056b4d71e908ea7dcf373

  • C:\qdnet\tools\ServerTool.dll

    Filesize

    37KB

    MD5

    4bd0cd7f349d64acbb79734e3897c2b9

    SHA1

    5e37d1bc570eb1a0663f5c69524b2fcca6c570f5

    SHA256

    ef2c3a207c131e0875d2d83cc3908a4db02ba68f401aacef2625a84f5fe8b68c

    SHA512

    12c5aef76165c37aaf095d304352961a80147d3cbe45199beb5d9bb42faa1b71b97da750e841e5a3868ccdcf3e31badad636e18726b056b4d71e908ea7dcf373

  • \qdnet\tools\ServerTool.dll

    Filesize

    37KB

    MD5

    4bd0cd7f349d64acbb79734e3897c2b9

    SHA1

    5e37d1bc570eb1a0663f5c69524b2fcca6c570f5

    SHA256

    ef2c3a207c131e0875d2d83cc3908a4db02ba68f401aacef2625a84f5fe8b68c

    SHA512

    12c5aef76165c37aaf095d304352961a80147d3cbe45199beb5d9bb42faa1b71b97da750e841e5a3868ccdcf3e31badad636e18726b056b4d71e908ea7dcf373

  • \qdnet\tools\ServerTool.dll

    Filesize

    37KB

    MD5

    4bd0cd7f349d64acbb79734e3897c2b9

    SHA1

    5e37d1bc570eb1a0663f5c69524b2fcca6c570f5

    SHA256

    ef2c3a207c131e0875d2d83cc3908a4db02ba68f401aacef2625a84f5fe8b68c

    SHA512

    12c5aef76165c37aaf095d304352961a80147d3cbe45199beb5d9bb42faa1b71b97da750e841e5a3868ccdcf3e31badad636e18726b056b4d71e908ea7dcf373

  • memory/1144-54-0x0000000000400000-0x0000000000427000-memory.dmp

    Filesize

    156KB

  • memory/1144-63-0x0000000000400000-0x0000000000427000-memory.dmp

    Filesize

    156KB

  • memory/2036-64-0x0000000000400000-0x000000000041A000-memory.dmp

    Filesize

    104KB