Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

4

Static

static

1

pokemmo-in...ws.exe

windows7-x64

4

pokemmo-in...ws.exe

windows10-2004-x64

4

Analysis

  • max time kernel
    143s
  • max time network
    77s
  • platform
    windows7_x64
  • resource
    win7-20230703-en
  • resource tags

    arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
  • submitted
    06/07/2023, 23:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    pokemmo-installer-windows.exe

  • Size

    95.0MB

  • MD5

    8c175ab44a499dba26dcd4f91fd39b2d

  • SHA1

    8da1eee8f095241830d74f0ab2c7c020cd5d7f7d

  • SHA256

    77632a2acb67d5d55b4a243216c24cd79e3c8b53fbeb07834ec4e1f55bf54844

  • SHA512

    3dc8d87e5fbd25d36ecef092898cc79d2990b16d03dcad2f83324083c547b28b3c96f608b5d7855badf4e1e5962e7f93a81f90e1928dfdd2c449858a6d195201

  • SSDEEP

    1572864:5gy6ONvi/l5FmGgFNvqPkj7BPw5vzLuIRt2wT0DJRlKBVSN1G4kvnvxqdLGsx1c1:5gyLvi3IG4NvqM/BPw5JIlyVS+4I8Gsa

Score
4/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\pokemmo-installer-windows.exe
    "C:\Users\Admin\AppData\Local\Temp\pokemmo-installer-windows.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2244
    • C:\Users\Admin\AppData\Local\Temp\is-AUP8S.tmp\pokemmo-installer-windows.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-AUP8S.tmp\pokemmo-installer-windows.tmp" /SL5="$90122,98821335,721408,C:\Users\Admin\AppData\Local\Temp\pokemmo-installer-windows.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: GetForegroundWindowSpam
      PID:784

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-AUP8S.tmp\pokemmo-installer-windows.tmp
    Filesize

    2.4MB

    MD5

    84db4b4205f705da71471dc6ecc061f5

    SHA1

    b90bac8c13a1553d58feef95a2c41c64118b29cf

    SHA256

    647983ebde53e0501ff1af8ef6190dfeea5ccc64caf7dce808f1e3d98fb66a3c

    SHA512

    c5803b63d33bb409433b496b83ca2a7359b4b1835815386206283b3af5c54d7d1cb9e80244a888638c7703c4bf54e1b2c11be6836f20b9fea157ab92bfbf365a

    Download Submit

  • \Users\Admin\AppData\Local\Temp\is-AUP8S.tmp\pokemmo-installer-windows.tmp
    Filesize

    2.4MB

    MD5

    84db4b4205f705da71471dc6ecc061f5

    SHA1

    b90bac8c13a1553d58feef95a2c41c64118b29cf

    SHA256

    647983ebde53e0501ff1af8ef6190dfeea5ccc64caf7dce808f1e3d98fb66a3c

    SHA512

    c5803b63d33bb409433b496b83ca2a7359b4b1835815386206283b3af5c54d7d1cb9e80244a888638c7703c4bf54e1b2c11be6836f20b9fea157ab92bfbf365a

    Download Submit

  • memory/784-61-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

    Download

  • memory/784-62-0x0000000002530000-0x0000000002531000-memory.dmp

    Filesize

    4KB

    Download

  • memory/784-64-0x0000000000400000-0x0000000000679000-memory.dmp

    Filesize

    2.5MB

    Download

  • memory/2244-54-0x0000000000400000-0x00000000004BE000-memory.dmp

    Filesize

    760KB

    Download

  • memory/2244-63-0x0000000000400000-0x00000000004BE000-memory.dmp

    Filesize

    760KB

    Download