Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    31/12/2023, 03:14

General

  • Target

    25fcd80371653728042c60d466078360.exe

  • Size

    6.8MB

  • MD5

    25fcd80371653728042c60d466078360

  • SHA1

    c799dc8fe2a79fa29a396acb3d13236d17f424ed

  • SHA256

    2f2bb1763bc205bc21816b238d83131153dcd6a7b6cab6eac9cd500e862ea9ab

  • SHA512

    c622b088357298d1e491b59387e6f88b19cebe705a3f95e3b6ca4db6b523f75bc36ab3717d986fe0ce0a9d7aacf1d5870f364bfac07aab0847896e6b1f906eda

  • SSDEEP

    98304:c/SO/vuFH/7JNu2AK//uEnGj7tNCBhNm+AHEA7pzDuMn57PTY0hI:JguFHJAsmBXG9AHEsa6T7K

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 24 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\25fcd80371653728042c60d466078360.exe
    "C:\Users\Admin\AppData\Local\Temp\25fcd80371653728042c60d466078360.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1620
    • C:\Users\Admin\AppData\Local\Temp\25fcd80371653728042c60d466078360.exe
      "C:\Users\Admin\AppData\Local\Temp\25fcd80371653728042c60d466078360.exe"
      2⤵
      • Loads dropped DLL
      PID:2692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI16202\VCRUNTIME140.dll

    Filesize

    84KB

    MD5

    ae96651cfbd18991d186a029cbecb30c

    SHA1

    18df8af1022b5cb188e3ee98ac5b4da24ac9c526

    SHA256

    1b372f064eacb455a0351863706e6326ca31b08e779a70de5de986b5be8069a1

    SHA512

    42a58c17f63cf0d404896d3b4bb16b2c9270cc2192aa4c9be265ed3970dfc2a4115e1db08f35c39e403b4c918be4ed7d19d2e2e015cb06b33d26a6c6521556e7

  • C:\Users\Admin\AppData\Local\Temp\_MEI16202\_asyncio.pyd

    Filesize

    54KB

    MD5

    4e406cbfbfb77d6155b814e9f344165c

    SHA1

    8eddac97fe2e3dccc9d466c5d70d572ddeccd4ae

    SHA256

    47998cdec5d134dd351947d94ad5ca5a234130d22dff7dae1a12b8c06daf2891

    SHA512

    9519d3d729cb49bbf9b6889a096b2b6e2871a4ddb767b946f426871d89031aeb9bb993eff4add27909620a2647293dd59c4fba0e245e62eb62de04eb1615ddf7

  • C:\Users\Admin\AppData\Local\Temp\_MEI16202\_bz2.pyd

    Filesize

    60KB

    MD5

    2998bb3969ead801ae5c9b4c872725ae

    SHA1

    d034bf04080e592555c4148091f34be5deb8eaa1

    SHA256

    4817a7c1f974c7427c2e2106359e13c21eb025826990a94e6151ba89e0344e14

    SHA512

    4c43273dddbc3eb5b36859c9d255e4dfcbf0ab771df185a20078877b99345d6acd5eb16d7e462b6f3810c826061b8513a12d7c2beb1ff59970d83a8ae6c40d75

  • C:\Users\Admin\AppData\Local\Temp\_MEI16202\_hashlib.pyd

    Filesize

    36KB

    MD5

    aaa99ffb90ec5985be0face4f0a40892

    SHA1

    0ad00c83ff86d7cd4694f2786034282386a39c38

    SHA256

    b118b6ef5486a65c41fdf049ef3c30d90f39097b5ef4c0b9f61824acfde50b6a

    SHA512

    e9df4a5480910172ec18e6de2f09eb83152db968dd974bf2e552de2349caa8e66f82110fdf511c7f3dd8436c03212f66d6720bb71306bb811392baed92c78b7d

  • C:\Users\Admin\AppData\Local\Temp\_MEI16202\_lzma.pyd

    Filesize

    99KB

    MD5

    69ede480afc6a038ff3977db8e5919ee

    SHA1

    86cf188556f1393a5831c8179fac6ae8784383f2

    SHA256

    fac0cbbbc70e35157c9582787b593dc473ea557dc068c69a45d0790aa6fbeb14

    SHA512

    075eb4ba584046900a5b7b1f076c3eea3ba99e9dbd6bfba0c2d3ec00078d7c4c77b064bd1d4974e8157185d2cfbb957ca5ac63a74235501cca996e9b2f9738ca

  • C:\Users\Admin\AppData\Local\Temp\_MEI16202\_overlapped.pyd

    Filesize

    37KB

    MD5

    54c6149ab1c0a621b22be4f4046386b6

    SHA1

    1d2e8da6a76e6d2ba0b8fb70954d06fdef1ebc1e

    SHA256

    44d896e8aa8887bad398b03dfdb8cf72aa3c0d87730a2ac0d92763722a426a7f

    SHA512

    61e0c6571f90856baca950e9aac0835a0726e41e516fc3728c81117d9ee248cf0ab3d47c70b34906cbfd9e37583049b7307d53a8981361bdea1095e3f9271896

  • C:\Users\Admin\AppData\Local\Temp\_MEI16202\_queue.pyd

    Filesize

    23KB

    MD5

    1fcf6bcb3c0aa42dde707dd1de33a62d

    SHA1

    63f544dae8e3cc64a5daa297a8ce339469060c7e

    SHA256

    acdc144f80b11b8b66f79b6c5ca6e32fa207431d557a14ab4571388e1c2e2a1b

    SHA512

    6101548557426a010c0c136241f8b03aee284020bdb78c6aa76199e848b5fe460c42675ab205594c3cb7ee90aa352ea909a3619739482a382ae0fe74436ad5ee

  • C:\Users\Admin\AppData\Local\Temp\_MEI16202\_socket.pyd

    Filesize

    15KB

    MD5

    48f766499796c8ff582408b0a722b8cc

    SHA1

    2a15aad69a84fcd6c9b9f99584b71ba571f959bd

    SHA256

    b42eddfbee3e54e6490163197a8d9afc616912809ac63fb2f97b8d5f9f76bce3

    SHA512

    9fbb0597de4c705423558d20c1d20a9e0e5b238d633e4c4aca7dd6012de8a44442912723759342e6a933fdede09583bea2627b5b5515e88ed1debb49335a7d77

  • C:\Users\Admin\AppData\Local\Temp\_MEI16202\aiohttp\_frozenlist.cp38-win32.pyd

    Filesize

    4KB

    MD5

    d68e4395ef59d37c51ed16170f9847bf

    SHA1

    40c4566a34069d014c155f030e287b34c8846280

    SHA256

    c9b8b3fa32681b0c19564c90bacab8cea43d1b58b60427d53521cf4573c5467e

    SHA512

    15e85ad15af4490be3acaf547009ccd72a637c532cdccaf402106cb38e6f5900f80b309e44725be3cf6baa6c5dab8c4b8d348b26b164337e68294393c8353752

  • C:\Users\Admin\AppData\Local\Temp\_MEI16202\aiohttp\_http_parser.cp38-win32.pyd

    Filesize

    8KB

    MD5

    3ef3af51bf497a5176b9e04c2fe65286

    SHA1

    256da04449401bdf027c400400044f7a9ec000bd

    SHA256

    89475dbfd471d6dc113cc82964cd080169d9a08cfd6b18f1111a45686b212717

    SHA512

    f24e69dde2af9c2c07f149030028c8490766a9cfbd9b470174bc0e7e989dde6af1f0939432a651648ead59e68c0956b12621aa8ba58265695842e1cf83395063

  • C:\Users\Admin\AppData\Local\Temp\_MEI16202\aiohttp\_http_writer.cp38-win32.pyd

    Filesize

    34KB

    MD5

    c55c0d34371072dc5770e637298878f8

    SHA1

    e115e22e073869638576048622785d038ec20da6

    SHA256

    5e23d565de05989cc2de809a2f843101a1afbb0a7450ee7795ba86e306586290

    SHA512

    0e79701d63d2686b40dd356bb9b88d3a3e9d61ba15be12c5ddf80af861d9257d20a18f85772af8b1d6be09a6e35145f03f496be8f1cd70bc7f89c6340ed81d05

  • C:\Users\Admin\AppData\Local\Temp\_MEI16202\aiohttp\_websocket.cp38-win32.pyd

    Filesize

    8KB

    MD5

    b9380e152841f346e6bdea253cda976d

    SHA1

    57c8af8439566901628de5eecf7df1b89808f9a1

    SHA256

    fc88df6db5da800f39fd146f0d59088555748ce3263d0a47fbd149a1271e40a6

    SHA512

    5cf2f8f5492f1d772e6a297a97641bf87b8950df3941288e93f5e988290a73f3a42c744f89a3d402a1a9f6a576e52e57d0498592f63bbb618722ae0a07e5c1c0

  • C:\Users\Admin\AppData\Local\Temp\_MEI16202\certifi\cacert.pem

    Filesize

    11KB

    MD5

    cf3bb3cafe2029303a27cb75018c69d8

    SHA1

    ece88cb87fed89cc12a83aad27143db0f7ab3834

    SHA256

    11b2dc32175f502014bf7c2d153013d61f1fcdef56741332a765200da0d4cfed

    SHA512

    9cae1b35cbf741af1b9f6a2b94d931e31531d67fa47c0091081854071f1a6ed5df47ae9cf9267f478e74cf35089fc0ca8f1b5405a9a72339daa3b3fcb03094db

  • C:\Users\Admin\AppData\Local\Temp\_MEI16202\libssl-1_1.dll

    Filesize

    128KB

    MD5

    b36d2d7d1486c0324a9044dc1370d5cb

    SHA1

    8603cfa08651c1a28ea834d4f893c753eec26e09

    SHA256

    944f97c65a7e1458488e1bc12703492abda0c35c8080f43af4267b54546aa6b4

    SHA512

    822ce147b174d8bd1e65a2d59d6778d2cc1ca3bb8bdd3de64fc5179d0f13c9a97717b2b862172bce78ff455122ab3b2d0c0fdcf1688587a24f78c13fb2433db0

  • C:\Users\Admin\AppData\Local\Temp\_MEI16202\python38.dll

    Filesize

    456KB

    MD5

    96205277ce41091857420f38c4b66dd9

    SHA1

    aaa75502d149bb02d6b9e3c7ae885f4b761289fb

    SHA256

    5ff4dac5fbdb2b4a18c907ab0b27c9df7129a208a2f79c9d0b5ab7dd64bdc600

    SHA512

    02eba787dae3714c8847e8bc1106d3166304feaf6b76c0b5c7c32be331d9c07d9fe6cebe8672d75c4d59b90294c8dd56212b40f3f32c3689aa4aef5fe5087c28

  • C:\Users\Admin\AppData\Local\Temp\_MEI16202\unicodedata.pyd

    Filesize

    64KB

    MD5

    5267b8401caad4acf58f6431d8cd17f1

    SHA1

    68ada8c1868c42179ffd9438a3c8a5a9d0f84414

    SHA256

    e928f9e0190c889ac7b457a16e82d50b99a993b04eb006e060589a60938dab77

    SHA512

    f79d8ddb7ad74cb2a1a71f411765e4ffc8f9aee6493cf0daace9aabc0b557fbe678b0100426bfe84cb40fcfe56c11dbd96f3c46a8d1eecd573f10befa1b1163e

  • C:\Users\Admin\AppData\Local\Temp\_MEI16202\yarl\_quoting_c.cp38-win32.pyd

    Filesize

    51KB

    MD5

    207ec7677394e1247e4e111180e445c3

    SHA1

    1d368ae0798c8661d3cc22557029c2bf10406533

    SHA256

    686dd02988b5897623309388e846add329f58b7ccd57ea98d7b6e951ecf0c034

    SHA512

    35ef91a2158066868ebe12083d8995c34651ccf8a907ccbfae7a875ae42664e23aaf75b0878ae419ca0b79c17492c958c5627914780c12fd4a1d20cb3744c29d

  • \Users\Admin\AppData\Local\Temp\_MEI16202\_asyncio.pyd

    Filesize

    14KB

    MD5

    7569a28b381b2b7e7dd0eb746b8582a9

    SHA1

    79d7b4750919246ddc22fcfa014fdda1077708d8

    SHA256

    d78aaed8e04784fcff8ab42211786de3335acd7154d44724e2358a48476c9ec8

    SHA512

    ec2185c7b22beb2d1800db02de7fd5b5247cef4eca2cd019436aaf3aa3361a0f7700256ae3d6ae91f9f0a0d1904f1e8bdf92732a3bf2db2516425550d10fae6c

  • \Users\Admin\AppData\Local\Temp\_MEI16202\_bz2.pyd

    Filesize

    72KB

    MD5

    1c7f3f37a067019b7926c0f92f3a3aa7

    SHA1

    ab6562aaa8cfa2dd49c1779a6374cecaf0e0d151

    SHA256

    bbc7f102b547180ea8ca5ff496f1bd419bfefd360be15610ae6b08837076f5dc

    SHA512

    840b095cdbb09b20f5d6db9962f4769734e0be425c9f094571df0df2d28888708072952792faded660c3e8f3db2513b6b42032e18cc681d909993fc6500b3e6e

  • \Users\Admin\AppData\Local\Temp\_MEI16202\_hashlib.pyd

    Filesize

    35KB

    MD5

    c64581889130e9fa725e0a08a00f0dfc

    SHA1

    0d697fa5437226d8fcbe4731255ea211a42ec719

    SHA256

    e03cf92f40adb1bae99c1bfcab25bbef22efde030825dc72d05b47dc2383f56c

    SHA512

    12c5faa990438b3079b0e2f86c59c6a025353cab4c24f7fbed22b48054a71ec8f6f4fdd53b3abffd6ab38a59cc8b030ba8c720902eafc9d932ca5364f6b695cf

  • \Users\Admin\AppData\Local\Temp\_MEI16202\_lzma.pyd

    Filesize

    68KB

    MD5

    4b0d72a97100b768971dc7e0a8f56633

    SHA1

    f8fa02e2ea05faa14f304b151a29c7a5dd7d37dc

    SHA256

    e2323bffa88ebd2513bacbcd04e88f512cc4c75b91dae924698d92c380ab1aa8

    SHA512

    3a082040d68fb607135a2ba3d57e3b59d1b032543ecdf2400e9e517a6dfa948b7b12dfec1628c23ca40f7358fed75f35829df26ca0ae89adae8ef006fe682c03

  • \Users\Admin\AppData\Local\Temp\_MEI16202\_overlapped.pyd

    Filesize

    28KB

    MD5

    0b5d6f52e2377c265c45984592b75256

    SHA1

    353ea3cb8f61ea12a735e323aec88f035e92315c

    SHA256

    64c7bc28d360dc8f4edb66026b822bca05c989234a6041822aa2ec1d779e8527

    SHA512

    d25be96c8ef3f8c1f3f692a0a772b7dad35b3aba95d571c5cbb60d3c9451e8b43f9112b74bf34a78c15f5dba4a79b517d22ec68154e4be36aea34a4331f1c62b

  • \Users\Admin\AppData\Local\Temp\_MEI16202\_queue.pyd

    Filesize

    24KB

    MD5

    8a21a5ccb136e6c265975ce1e91cb870

    SHA1

    c6b1ec3deac2e8e091679beda44f896e9fabea06

    SHA256

    7f43dfb5ba9f4afa82630cd3e234ede0596abe3584f107b9855747ef1cde9acc

    SHA512

    a215f1674a0ce89324e82e88245201ce5c0bb56193b732527a8f8ca72377dce8b2f1dead380fcab070182eb58c43cf55c2b4c26588e856c1f390a953dbc9de0b

  • \Users\Admin\AppData\Local\Temp\_MEI16202\_socket.pyd

    Filesize

    67KB

    MD5

    e55a5618e14a01bac452b8399e281d0d

    SHA1

    feb071df789f02cdfc0059dfbea1e2394bfd08ef

    SHA256

    04e286e59facf3f1ddd54d92b45d7662044c0b17d370eb20eb9ca0c8c8e3cb9c

    SHA512

    1b2e57e681ea889aac680a9ae3b6c9f76ccf82cff3fc91f3c1b678851152282199172fd1900997163ae8db2a18ee385f1ecfe8230fcbc7bf1a3a896a869b2a9c

  • \Users\Admin\AppData\Local\Temp\_MEI16202\aiohttp\_frozenlist.cp38-win32.pyd

    Filesize

    36KB

    MD5

    e2d561cf050f901e0d940ca9aa73cbf0

    SHA1

    c1ff3050a788480a634b67a05a0f710ba32e2371

    SHA256

    81c8f79ee3013a7be50d530fbb0d6c4384869b70bed6b001361c9c474de7dbe0

    SHA512

    cdeb103d84a6273ec3de9c660d9f5f79df3fe2c3f00e9ab359ca72e2a6bd68f7284b726e291faa453a650665b84203495422d91a34848eba8282eca79ecb0e4f

  • \Users\Admin\AppData\Local\Temp\_MEI16202\aiohttp\_helpers.cp38-win32.pyd

    Filesize

    37KB

    MD5

    bc777d9ef65f8152782890d96e2d3ad9

    SHA1

    4341b6bac29b1c2fdd7b55460b537f71e6537a0c

    SHA256

    b09c14de25d8ca19360e59cf1624ed44837f2b417918905e61284a44637b7fa4

    SHA512

    04834c01ae996c4a529db8883127a15884df809b9ba50592f466a64febbf7764b87483dd8560756af7af0f7fb57bd89cc7af6848559f7002fd9ec2b45b5b049c

  • \Users\Admin\AppData\Local\Temp\_MEI16202\aiohttp\_http_parser.cp38-win32.pyd

    Filesize

    7KB

    MD5

    1ce60d10f502f63de93dc1dbf13fa660

    SHA1

    4efaa735e92b5b18bc4810a8cab865e529863063

    SHA256

    c47b27ca39a7cd0b509f59508d5ce572b2de3f32405072d829b99a8b066be11c

    SHA512

    ff2eb7bc4d1cd1822388ce1839b61b3d20c8323c1648682a2ff0be3d19b08d145cbc465a84be88d45608cfeec925619fc7129cfa7577e970909ef74b821366e4

  • \Users\Admin\AppData\Local\Temp\_MEI16202\aiohttp\_http_writer.cp38-win32.pyd

    Filesize

    28KB

    MD5

    a8370a3f086ca7af9255ecc28a16eca8

    SHA1

    5e21790d08300235eb1addd16c3d381dffdeb1d2

    SHA256

    cdeb02dd29c87bb800a0992bacb3b2dfe831f3cca4654426009139926cf97c53

    SHA512

    b9e8ad02b7ca56b3276b8f9c0bc1fc43b8da9f89debb2b9fd4f006036866a4e805d4a10b07760e0e16df22897b29d20744b7bbff47b132cf07290de38279280e

  • \Users\Admin\AppData\Local\Temp\_MEI16202\aiohttp\_websocket.cp38-win32.pyd

    Filesize

    22KB

    MD5

    49f4d3d8c92fb077ad09e04a8e0374f6

    SHA1

    04e59be90469a5fc167cc676460acb6efc3e96d3

    SHA256

    94c2125849736dce4b51c64262707e74ab65923616b2a6776403038b8dfc7bb2

    SHA512

    c4759c64fd648284df546b431032e12170d7b8adade91f76d239a3c293e96728ff8f08e9f7597f41378e4b9c861103bbfd5ca7c873049b3797184fd35c918298

  • \Users\Admin\AppData\Local\Temp\_MEI16202\libssl-1_1.dll

    Filesize

    132KB

    MD5

    a862bb0660d1f0cbf9c55cba6056937e

    SHA1

    6caa69ec563a5e722a603d7f9a768f813c8c1b76

    SHA256

    8ff6fb882ee2c79adc81e03efaf8a75c1c3a08e86485d3306fd4c677daa0fdae

    SHA512

    ac164b9d21e694514021bf327bdc86cfa8b83da5aed4b3d7cbc1120bfc2aa127e949a6617203636bb32e2d58d117d7f510cb3518d8bfb52f5620ab96e5c18821

  • \Users\Admin\AppData\Local\Temp\_MEI16202\multidict\_multidict.cp38-win32.pyd

    Filesize

    33KB

    MD5

    d0f3178fc97caaec743602605ff38483

    SHA1

    f7a10d4070c2d84e86634cb2690b2807d4f2ad7d

    SHA256

    f3861ad03d2430cc7573d0263babbb92829dcaa69459798711815d3e46251035

    SHA512

    81c934b59fefd02d48ba88c7cd6ccc2c4d1cbdd1318543b280b2e6e698dd9976068ca555469718ad8108d029fbb2d51275d92b8a86d8dbf1c10780359629f6aa

  • \Users\Admin\AppData\Local\Temp\_MEI16202\python38.dll

    Filesize

    92KB

    MD5

    f1b5656ab08ef9be368b9ce62569b114

    SHA1

    b2fc0f5f9e33310b225c666ad7eab1ab1831f7b9

    SHA256

    d1866c001e0738e7c950ccb3a13e8d10904aaf7eaaefe8d331552c62f65ffc71

    SHA512

    6821993593a7531c39bf7c1232ccbd1defda1ecc7f0a45f489be65a0133aeedeb698924b8461acede4f4c28c3f041f87d72249735506ce1d25c66a6f3f9ca483

  • \Users\Admin\AppData\Local\Temp\_MEI16202\select.pyd

    Filesize

    23KB

    MD5

    39f61824d4e3d4be2d938a827bae18eb

    SHA1

    b7614cfbcdbd55ef1e4e8266722088d51ae102b8

    SHA256

    c86c229e97b11cb74cc87bc595d4d936171c5d334e367f55b2ee3f9bcfbc6c92

    SHA512

    9a5926eafba32a2260521e3d11a4faf8701d3963454cfedf7046765ebbc62baf675944fe3fff3ecb70c80c47ffb1d2c9e2adcd385b8c291908ca3cb4d18a3caa

  • \Users\Admin\AppData\Local\Temp\_MEI16202\unicodedata.pyd

    Filesize

    60KB

    MD5

    68f33273c8722a07ee519d5d66c812ff

    SHA1

    0dfcffb7dff3b88527b8dc21854cec8059a76534

    SHA256

    d77160abcbd2205ff61e3956be36426f5f11f959c9d28d8ddb31856b0cce3986

    SHA512

    272c309fd179fd1641ce23ed9ec2ca2d8042a1bf7e2e51484e62bee9541350213831c010b60dddf1e37ed1a0f3d4238da9e7f9524d0be3a6e290bb7d16a81dfd

  • \Users\Admin\AppData\Local\Temp\_MEI16202\yarl\_quoting_c.cp38-win32.pyd

    Filesize

    65KB

    MD5

    38255be864b415f678ef192e51efbb22

    SHA1

    89cbe5fd25173361ad4d2bfe5d2799c8b6e2ad21

    SHA256

    94297107e10c5afb72660ae16aa2d9f614b7e03db85f677bf470f624cc52784f

    SHA512

    e137837de4351156b7fa75d35ca6b7fb7aa527dd3c7b0b6a847df4e0a2d0700de9cacc03a7355c8821373dbe3cf8c82f2e4829d65d0bfac49cd372e93a9ea67b