Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

25cb812515...b7.exe

windows7-x64

7

25cb812515...b7.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    119s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    19/08/2023, 09:34

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    25cb812515bf78fe1c97f4f24416cbda140eda96a81f10a85908a58dc13982b7.exe

  • Size

    6.6MB

  • MD5

    a4f78bbdc1fba0478f631f66d03075b4

  • SHA1

    aad5d0c2499630e22d196049d2505a195a46cac2

  • SHA256

    25cb812515bf78fe1c97f4f24416cbda140eda96a81f10a85908a58dc13982b7

  • SHA512

    592f44d802ea1af2ab4673eb544008a4ad90f2da472b737ba490351da0c5c27ebe5ecc1059f0e61cb27daebe3058e2fd34e64fc9d54ab69d516c9dc929aa7dcc

  • SSDEEP

    196608:dZpwnOpffvDOCIweI+X7AfWWqSmePD/5:HyOpffvPsEfWLSFR

Score
7/10
upx

Malware Config

Signatures

  • Loads dropped DLL 7 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\25cb812515bf78fe1c97f4f24416cbda140eda96a81f10a85908a58dc13982b7.exe
    "C:\Users\Admin\AppData\Local\Temp\25cb812515bf78fe1c97f4f24416cbda140eda96a81f10a85908a58dc13982b7.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2536
    • C:\Users\Admin\AppData\Local\Temp\25cb812515bf78fe1c97f4f24416cbda140eda96a81f10a85908a58dc13982b7.exe
      "C:\Users\Admin\AppData\Local\Temp\25cb812515bf78fe1c97f4f24416cbda140eda96a81f10a85908a58dc13982b7.exe"
      2⤵
      • Loads dropped DLL
      PID:2472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI25362\api-ms-win-core-file-l1-2-0.dll
    Filesize

    11KB

    MD5

    5a72a803df2b425d5aaff21f0f064011

    SHA1

    4b31963d981c07a7ab2a0d1a706067c539c55ec5

    SHA256

    629e52ba4e2dca91b10ef7729a1722888e01284eed7dda6030d0a1ec46c94086

    SHA512

    bf44997c405c2ba80100eb0f2ff7304938fc69e4d7ae3eac52b3c236c3188e80c9f18bda226b5f4fde0112320e74c198ad985f9ffd7cea99aca22980c39c7f69

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI25362\api-ms-win-core-file-l2-1-0.dll
    Filesize

    11KB

    MD5

    721b60b85094851c06d572f0bd5d88cd

    SHA1

    4d0ee4d717aeb9c35da8621a545d3e2b9f19b4e7

    SHA256

    dac867476caa42ff8df8f5dfe869ffd56a18dadee17d47889afb69ed6519afbf

    SHA512

    430a91fcecde4c8cc4ac7eb9b4c6619243ab244ee88c34c9e93ca918e54bd42b08aca8ea4475d4c0f5fa95241e4aacb3206cbae863e92d15528c8e7c9f45601b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI25362\api-ms-win-core-localization-l1-2-0.dll
    Filesize

    14KB

    MD5

    1ed0b196ab58edb58fcf84e1739c63ce

    SHA1

    ac7d6c77629bdee1df7e380cc9559e09d51d75b7

    SHA256

    8664222823e122fca724620fd8b72187fc5336c737d891d3cef85f4f533b8de2

    SHA512

    e1fa7f14f39c97aaa3104f3e13098626b5f7cfd665ba52dcb2312a329639aaf5083a9177e4686d11c4213e28acc40e2c027988074b6cc13c5016d5c5e9ef897b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI25362\api-ms-win-core-processthreads-l1-1-1.dll
    Filesize

    11KB

    MD5

    7e8b61d27a9d04e28d4dae0bfa0902ed

    SHA1

    861a7b31022915f26fb49c79ac357c65782c9f4b

    SHA256

    1ef06c600c451e66e744b2ca356b7f4b7b88ba2f52ec7795858d21525848ac8c

    SHA512

    1c5b35026937b45beb76cb8d79334a306342c57a8e36cc15d633458582fc8f7d9ab70ace7a92144288c6c017f33ecfc20477a04432619b40a21c9cda8d249f6d

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI25362\api-ms-win-core-timezone-l1-1-0.dll
    Filesize

    11KB

    MD5

    91a2ae3c4eb79cf748e15a58108409ad

    SHA1

    d402b9df99723ea26a141bfc640d78eaf0b0111b

    SHA256

    b0eda99eabd32fefecc478fd9fe7439a3f646a864fdab4ec3c1f18574b5f8b34

    SHA512

    8527af610c1e2101b6f336a142b1a85ac9c19bb3af4ad4a245cfb6fd602dc185da0f7803358067099475102f3a8f10a834dc75b56d3e6ded2ed833c00ad217ed

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI25362\python39.dll
    Filesize

    1.5MB

    MD5

    07cbe5aaa270d8308aa54451e7e894f0

    SHA1

    c8b7f7d7dad8a4efc5747c20ba256a8317cbfd7f

    SHA256

    35c47141e0bcc45e0c0bb608921be9fe6ab935edcac3bdf4738de65a4fdd6262

    SHA512

    7fbf379745404803ccff3a2e3338d9e9a47f4b0ea63844c1a5b6c1142a9ff27d4f73e3c10b9285fc33332a40baf1ab1e9e1d6d1b219b9b995c86866a5d4d6013

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI25362\ucrtbase.dll
    Filesize

    1011KB

    MD5

    849959a003fa63c5a42ae87929fcd18b

    SHA1

    d1b80b3265e31a2b5d8d7da6183146bbd5fb791b

    SHA256

    6238cbfe9f57c142b75e153c399c478d492252fda8cb40ee539c2dcb0f2eb232

    SHA512

    64958dabdb94d21b59254c2f074db5d51e914ddbc8437452115dff369b0c134e50462c3fdbbc14b6fa809a6ee19ab2fb83d654061601cc175cddcb7d74778e09

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI25362\api-ms-win-core-file-l1-2-0.dll
    Filesize

    11KB

    MD5

    5a72a803df2b425d5aaff21f0f064011

    SHA1

    4b31963d981c07a7ab2a0d1a706067c539c55ec5

    SHA256

    629e52ba4e2dca91b10ef7729a1722888e01284eed7dda6030d0a1ec46c94086

    SHA512

    bf44997c405c2ba80100eb0f2ff7304938fc69e4d7ae3eac52b3c236c3188e80c9f18bda226b5f4fde0112320e74c198ad985f9ffd7cea99aca22980c39c7f69

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI25362\api-ms-win-core-file-l2-1-0.dll
    Filesize

    11KB

    MD5

    721b60b85094851c06d572f0bd5d88cd

    SHA1

    4d0ee4d717aeb9c35da8621a545d3e2b9f19b4e7

    SHA256

    dac867476caa42ff8df8f5dfe869ffd56a18dadee17d47889afb69ed6519afbf

    SHA512

    430a91fcecde4c8cc4ac7eb9b4c6619243ab244ee88c34c9e93ca918e54bd42b08aca8ea4475d4c0f5fa95241e4aacb3206cbae863e92d15528c8e7c9f45601b

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI25362\api-ms-win-core-localization-l1-2-0.dll
    Filesize

    14KB

    MD5

    1ed0b196ab58edb58fcf84e1739c63ce

    SHA1

    ac7d6c77629bdee1df7e380cc9559e09d51d75b7

    SHA256

    8664222823e122fca724620fd8b72187fc5336c737d891d3cef85f4f533b8de2

    SHA512

    e1fa7f14f39c97aaa3104f3e13098626b5f7cfd665ba52dcb2312a329639aaf5083a9177e4686d11c4213e28acc40e2c027988074b6cc13c5016d5c5e9ef897b

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI25362\api-ms-win-core-processthreads-l1-1-1.dll
    Filesize

    11KB

    MD5

    7e8b61d27a9d04e28d4dae0bfa0902ed

    SHA1

    861a7b31022915f26fb49c79ac357c65782c9f4b

    SHA256

    1ef06c600c451e66e744b2ca356b7f4b7b88ba2f52ec7795858d21525848ac8c

    SHA512

    1c5b35026937b45beb76cb8d79334a306342c57a8e36cc15d633458582fc8f7d9ab70ace7a92144288c6c017f33ecfc20477a04432619b40a21c9cda8d249f6d

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI25362\api-ms-win-core-timezone-l1-1-0.dll
    Filesize

    11KB

    MD5

    91a2ae3c4eb79cf748e15a58108409ad

    SHA1

    d402b9df99723ea26a141bfc640d78eaf0b0111b

    SHA256

    b0eda99eabd32fefecc478fd9fe7439a3f646a864fdab4ec3c1f18574b5f8b34

    SHA512

    8527af610c1e2101b6f336a142b1a85ac9c19bb3af4ad4a245cfb6fd602dc185da0f7803358067099475102f3a8f10a834dc75b56d3e6ded2ed833c00ad217ed

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI25362\python39.dll
    Filesize

    1.5MB

    MD5

    07cbe5aaa270d8308aa54451e7e894f0

    SHA1

    c8b7f7d7dad8a4efc5747c20ba256a8317cbfd7f

    SHA256

    35c47141e0bcc45e0c0bb608921be9fe6ab935edcac3bdf4738de65a4fdd6262

    SHA512

    7fbf379745404803ccff3a2e3338d9e9a47f4b0ea63844c1a5b6c1142a9ff27d4f73e3c10b9285fc33332a40baf1ab1e9e1d6d1b219b9b995c86866a5d4d6013

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI25362\ucrtbase.dll
    Filesize

    1011KB

    MD5

    849959a003fa63c5a42ae87929fcd18b

    SHA1

    d1b80b3265e31a2b5d8d7da6183146bbd5fb791b

    SHA256

    6238cbfe9f57c142b75e153c399c478d492252fda8cb40ee539c2dcb0f2eb232

    SHA512

    64958dabdb94d21b59254c2f074db5d51e914ddbc8437452115dff369b0c134e50462c3fdbbc14b6fa809a6ee19ab2fb83d654061601cc175cddcb7d74778e09

    Download Submit

  • memory/2472-163-0x000007FEF6010000-0x000007FEF64A1000-memory.dmp

    Filesize

    4.6MB

    Download