Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

main2_finished.exe

windows7-x64

7

main2_finished.exe

windows10-2004-x64

7

Resubmissions

17/08/2023, 18:37

230817-w9fr1adg7x 7

Analysis

  • max time kernel
    25s
  • max time network
    33s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/08/2023, 18:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    main2_finished.exe

  • Size

    5.8MB

  • MD5

    9e0d0f68ead98c407f09b4a1fcff88e4

  • SHA1

    489fc04c7d24af90e1723e61488ed8345bc354be

  • SHA256

    fa15b07b2ed7c5c0ab26c5d6b6d68f307f8ff5568646607d84d23d6b60fc815f

  • SHA512

    bdf7bd07f255a1d4915f658e96983e03a186eac7311524eace7d1ee80017dbcc0efd9c07136f87996640c1def04e66e813bce1ce6a3cf7e5d52a2683eed40c27

  • SSDEEP

    98304:mD8vIfoZMD/x/0feyGut9LQ940BDlgwdnpka9R/k9t+2oGt+Z9ZtcG25/8tQ+g+:mDAPuDfyGkwBdnpkYRM25tcDV8t/

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 6 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\main2_finished.exe
    "C:\Users\Admin\AppData\Local\Temp\main2_finished.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4788
    • C:\Users\Admin\AppData\Local\Temp\main2_finished.exe
      "C:\Users\Admin\AppData\Local\Temp\main2_finished.exe"
      2⤵
      • Loads dropped DLL
      PID:2284

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI47882\VCRUNTIME140.dll
    Filesize

    95KB

    MD5

    f34eb034aa4a9735218686590cba2e8b

    SHA1

    2bc20acdcb201676b77a66fa7ec6b53fa2644713

    SHA256

    9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1

    SHA512

    d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI47882\VCRUNTIME140.dll
    Filesize

    95KB

    MD5

    f34eb034aa4a9735218686590cba2e8b

    SHA1

    2bc20acdcb201676b77a66fa7ec6b53fa2644713

    SHA256

    9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1

    SHA512

    d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI47882\_socket.pyd
    Filesize

    77KB

    MD5

    819166054fec07efcd1062f13c2147ee

    SHA1

    93868ebcd6e013fda9cd96d8065a1d70a66a2a26

    SHA256

    e6deb751039cd5424a139708475ce83f9c042d43e650765a716cb4a924b07e4f

    SHA512

    da3a440c94cb99b8af7d2bc8f8f0631ae9c112bd04badf200edbf7ea0c48d012843b4a9fb9f1e6d3a9674fd3d4eb6f0fa78fd1121fad1f01f3b981028538b666

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI47882\_socket.pyd
    Filesize

    77KB

    MD5

    819166054fec07efcd1062f13c2147ee

    SHA1

    93868ebcd6e013fda9cd96d8065a1d70a66a2a26

    SHA256

    e6deb751039cd5424a139708475ce83f9c042d43e650765a716cb4a924b07e4f

    SHA512

    da3a440c94cb99b8af7d2bc8f8f0631ae9c112bd04badf200edbf7ea0c48d012843b4a9fb9f1e6d3a9674fd3d4eb6f0fa78fd1121fad1f01f3b981028538b666

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI47882\base_library.zip
    Filesize

    1.0MB

    MD5

    74d9978ca995426f1ee329a7ac3601ae

    SHA1

    936abd817865d3e289bc42d8fead70a2bf00a9ed

    SHA256

    86583275720df1f84c58960285b6d2f1075f0d07964fa86d0f531e7ce794144f

    SHA512

    fa91cbe3b446cfd94e2d932e6ab8594ffb703016c4253172f0d94f1db13f8de3656e4bc4ab9cf71904ba11bba68a21143c73a8fda9046bc5ea0464b512fcdcbb

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI47882\netifaces.cp310-win_amd64.pyd
    Filesize

    21KB

    MD5

    15de01b1994ea3e038c003c2e2511ab2

    SHA1

    d5436229997dbba53e677f6cb920d6cef44c2007

    SHA256

    08caefb829325c18f776109014d2a0458e5c7daeb4d0f8cc191d32ac98627ff1

    SHA512

    0ab0ecacdee5c3d3b64b2382d33499883ac83fc3e6b1ee6843fcf59250132e0ef7c9606b4547adefaa4ac6e512fd2a041d2369c80142093c52c7767bfa2d10ec

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI47882\netifaces.cp310-win_amd64.pyd
    Filesize

    21KB

    MD5

    15de01b1994ea3e038c003c2e2511ab2

    SHA1

    d5436229997dbba53e677f6cb920d6cef44c2007

    SHA256

    08caefb829325c18f776109014d2a0458e5c7daeb4d0f8cc191d32ac98627ff1

    SHA512

    0ab0ecacdee5c3d3b64b2382d33499883ac83fc3e6b1ee6843fcf59250132e0ef7c9606b4547adefaa4ac6e512fd2a041d2369c80142093c52c7767bfa2d10ec

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI47882\python310.dll
    Filesize

    4.3MB

    MD5

    63a1fa9259a35eaeac04174cecb90048

    SHA1

    0dc0c91bcd6f69b80dcdd7e4020365dd7853885a

    SHA256

    14b06796f288bc6599e458fb23a944ab0c843e9868058f02a91d4606533505ed

    SHA512

    896caa053f48b1e4102e0f41a7d13d932a746eea69a894ae564ef5a84ef50890514deca6496e915aae40a500955220dbc1b1016fe0b8bcdde0ad81b2917dea8b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI47882\python310.dll
    Filesize

    4.3MB

    MD5

    63a1fa9259a35eaeac04174cecb90048

    SHA1

    0dc0c91bcd6f69b80dcdd7e4020365dd7853885a

    SHA256

    14b06796f288bc6599e458fb23a944ab0c843e9868058f02a91d4606533505ed

    SHA512

    896caa053f48b1e4102e0f41a7d13d932a746eea69a894ae564ef5a84ef50890514deca6496e915aae40a500955220dbc1b1016fe0b8bcdde0ad81b2917dea8b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI47882\select.pyd
    Filesize

    29KB

    MD5

    a653f35d05d2f6debc5d34daddd3dfa1

    SHA1

    1a2ceec28ea44388f412420425665c3781af2435

    SHA256

    db85f2f94d4994283e1055057372594538ae11020389d966e45607413851d9e9

    SHA512

    5aede99c3be25b1a962261b183ae7a7fb92cb0cb866065dc9cd7bb5ff6f41cc8813d2cc9de54670a27b3ad07a33b833eaa95a5b46dad7763ca97dfa0c1ce54c9

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI47882\select.pyd
    Filesize

    29KB

    MD5

    a653f35d05d2f6debc5d34daddd3dfa1

    SHA1

    1a2ceec28ea44388f412420425665c3781af2435

    SHA256

    db85f2f94d4994283e1055057372594538ae11020389d966e45607413851d9e9

    SHA512

    5aede99c3be25b1a962261b183ae7a7fb92cb0cb866065dc9cd7bb5ff6f41cc8813d2cc9de54670a27b3ad07a33b833eaa95a5b46dad7763ca97dfa0c1ce54c9

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI47882\tinyaes.cp310-win_amd64.pyd
    Filesize

    31KB

    MD5

    5f7048fcba6e2bd21c71ce07b52e0891

    SHA1

    da0ba80e7e12ec5852567664150cd04c177adc62

    SHA256

    522abac5cbddc8a97814896ad78909bd4d7458310376b1c44754b29bb449f148

    SHA512

    a6b09304f0c5852eebd7ce127a4877a93f3ef0cf589726ee92ebf90f8da266ececf50ea4561116de371fa6bff942be9c5b2b44466c98a9597b50cb45c56b9f48

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI47882\tinyaes.cp310-win_amd64.pyd
    Filesize

    31KB

    MD5

    5f7048fcba6e2bd21c71ce07b52e0891

    SHA1

    da0ba80e7e12ec5852567664150cd04c177adc62

    SHA256

    522abac5cbddc8a97814896ad78909bd4d7458310376b1c44754b29bb449f148

    SHA512

    a6b09304f0c5852eebd7ce127a4877a93f3ef0cf589726ee92ebf90f8da266ececf50ea4561116de371fa6bff942be9c5b2b44466c98a9597b50cb45c56b9f48

    Download Submit