Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
06/07/2023, 23:25
Static task
static1
Behavioral task
behavioral1
Sample
pokemmo-installer-windows.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
pokemmo-installer-windows.exe
Resource
win10v2004-20230703-en
General
-
Target
pokemmo-installer-windows.exe
-
Size
95.0MB
-
MD5
8c175ab44a499dba26dcd4f91fd39b2d
-
SHA1
8da1eee8f095241830d74f0ab2c7c020cd5d7f7d
-
SHA256
77632a2acb67d5d55b4a243216c24cd79e3c8b53fbeb07834ec4e1f55bf54844
-
SHA512
3dc8d87e5fbd25d36ecef092898cc79d2990b16d03dcad2f83324083c547b28b3c96f608b5d7855badf4e1e5962e7f93a81f90e1928dfdd2c449858a6d195201
-
SSDEEP
1572864:5gy6ONvi/l5FmGgFNvqPkj7BPw5vzLuIRt2wT0DJRlKBVSN1G4kvnvxqdLGsx1c1:5gyLvi3IG4NvqM/BPw5JIlyVS+4I8Gsa
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1328 pokemmo-installer-windows.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2664 wrote to memory of 1328 2664 pokemmo-installer-windows.exe 84 PID 2664 wrote to memory of 1328 2664 pokemmo-installer-windows.exe 84 PID 2664 wrote to memory of 1328 2664 pokemmo-installer-windows.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\pokemmo-installer-windows.exe"C:\Users\Admin\AppData\Local\Temp\pokemmo-installer-windows.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\is-JO10P.tmp\pokemmo-installer-windows.tmp"C:\Users\Admin\AppData\Local\Temp\is-JO10P.tmp\pokemmo-installer-windows.tmp" /SL5="$5022C,98821335,721408,C:\Users\Admin\AppData\Local\Temp\pokemmo-installer-windows.exe"2⤵
- Executes dropped EXE
PID:1328
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.4MB
MD584db4b4205f705da71471dc6ecc061f5
SHA1b90bac8c13a1553d58feef95a2c41c64118b29cf
SHA256647983ebde53e0501ff1af8ef6190dfeea5ccc64caf7dce808f1e3d98fb66a3c
SHA512c5803b63d33bb409433b496b83ca2a7359b4b1835815386206283b3af5c54d7d1cb9e80244a888638c7703c4bf54e1b2c11be6836f20b9fea157ab92bfbf365a