Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    27s
  • max time network
    30s
  • platform
    windows7_x64
  • resource
    win7-20230621-en
  • resource tags

    arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
  • submitted
    30/06/2023, 21:15

General

  • Target

    ntokrnl.exe

  • Size

    7.8MB

  • MD5

    c19184bceaabb8ede17cf36c913345a4

  • SHA1

    8cc33de9b25e1624e009dac03bbc229ee51c763d

  • SHA256

    5732affc1ba8e455d627a9bb2356c89a4741959221ee491cc8200be84a538261

  • SHA512

    e49bbb265d882cf72a422cd19a9d81d62d572fac77bd775799861aa89bdbd0ed6287b62928f9ccccda30fe4c048820a58789a28a0ce08dfebfe134218611e1f4

  • SSDEEP

    196608:klMldQmRJ8dA6loVCy1ArqkVpKCX+PrF4ZIeghQiATF2MJh:6cdQusloVrAZYCuPJOIegtCQW

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ntokrnl.exe
    "C:\Users\Admin\AppData\Local\Temp\ntokrnl.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1588
    • C:\Users\Admin\AppData\Local\Temp\ntokrnl.exe
      "C:\Users\Admin\AppData\Local\Temp\ntokrnl.exe"
      2⤵
      • Loads dropped DLL
      PID:1656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI15882\python310.dll

    Filesize

    4.3MB

    MD5

    54f8267c6c116d7240f8e8cd3b241cd9

    SHA1

    907b965b6ce502dad59cde70e486eb28c5517b42

    SHA256

    c30589187be320bc8e65177aeb8dc1d39957f7b7dcda4c13524dd7f436fb0948

    SHA512

    f6c865c8276fe1a1a0f3267b89fb6745a3fc82972032280dce8869006feb2b168516e017241a0c82bdae0f321fab388523691769f09a502fc3bd530c1c4cacf1

  • \Users\Admin\AppData\Local\Temp\_MEI15882\python310.dll

    Filesize

    4.3MB

    MD5

    54f8267c6c116d7240f8e8cd3b241cd9

    SHA1

    907b965b6ce502dad59cde70e486eb28c5517b42

    SHA256

    c30589187be320bc8e65177aeb8dc1d39957f7b7dcda4c13524dd7f436fb0948

    SHA512

    f6c865c8276fe1a1a0f3267b89fb6745a3fc82972032280dce8869006feb2b168516e017241a0c82bdae0f321fab388523691769f09a502fc3bd530c1c4cacf1