Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

1PGNZ8NZG6RCE9.exe

windows7-x64

7

1PGNZ8NZG6RCE9.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    121s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    04/08/2023, 17:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1PGNZ8NZG6RCE9.exe

  • Size

    10.1MB

  • MD5

    6e6339c7960e973ae81e0bf3a1530f23

  • SHA1

    21b3719fd440d59c5a57800c7a92fadf3c42a258

  • SHA256

    8d51d18c32bfc42a4e1722f885f3c1c03c3eb7de68f8f2df49a5fdb868e8e1ea

  • SHA512

    c5d9750de294db5dc7ee095adc2faa568ae4ee55e6e8db9a0e945f73f9a320a4d30ebda57bd291859a46111d836a7c0bcd4498ed8e8d19f8b7e7fa378117de9c

  • SSDEEP

    196608:+LDna+butR4FMIZETSt3jPePdrQJ2BNOq62gAqYPYgUFHN:MDnaOyRQETSBvJSOq62YHtFHN

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1PGNZ8NZG6RCE9.exe
    "C:\Users\Admin\AppData\Local\Temp\1PGNZ8NZG6RCE9.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1972
    • C:\Users\Admin\AppData\Local\Temp\1PGNZ8NZG6RCE9.exe
      "C:\Users\Admin\AppData\Local\Temp\1PGNZ8NZG6RCE9.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: GetForegroundWindowSpam
      PID:2932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI19722\python311.dll
    Filesize

    5.5MB

    MD5

    5a5dd7cad8028097842b0afef45bfbcf

    SHA1

    e247a2e460687c607253949c52ae2801ff35dc4a

    SHA256

    a811c7516f531f1515d10743ae78004dd627eba0dc2d3bc0d2e033b2722043ce

    SHA512

    e6268e4fad2ce3ef16b68298a57498e16f0262bf3531539ad013a66f72df471569f94c6fcc48154b7c3049a3ad15cbfcbb6345dacb4f4ed7d528c74d589c9858

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI19722\python311.dll
    Filesize

    5.5MB

    MD5

    5a5dd7cad8028097842b0afef45bfbcf

    SHA1

    e247a2e460687c607253949c52ae2801ff35dc4a

    SHA256

    a811c7516f531f1515d10743ae78004dd627eba0dc2d3bc0d2e033b2722043ce

    SHA512

    e6268e4fad2ce3ef16b68298a57498e16f0262bf3531539ad013a66f72df471569f94c6fcc48154b7c3049a3ad15cbfcbb6345dacb4f4ed7d528c74d589c9858

    Download Submit