Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
86s -
max time network
88s -
platform
windows11-21h2_x64 -
resource
win11-20231222-en -
resource tags
arch:x64arch:x86image:win11-20231222-enlocale:en-usos:windows11-21h2-x64system -
submitted
24/01/2024, 03:11
Behavioral task
behavioral1
Sample
capa.exe
Resource
win11-20231222-en
Behavioral task
behavioral2
Sample
main.pyc
Resource
win11-20231215-en
General
-
Target
capa.exe
-
Size
30.0MB
-
MD5
21dc36681c30aeb8e0e615d02105cb11
-
SHA1
8e6782379741b55fab8090b348e5ee5ffc7eb816
-
SHA256
28456074020e4982cb2c7d0f8c7aeec3d8470e4625bb6f12dc9bb6a794bd9fc6
-
SHA512
f1eadd147dfe986a3220c0f214f7dfa0639fccc986f50605abcd0feefe56b69a54dab8ca3cd02c2cbe6e996d527ae2edbd901ed2a83570e9bfd24b9c148d62ce
-
SSDEEP
786432:Q2DjsCED74EaEizozeyAZWXBiFhOfBhqcnrmUNZ:vDjsCk5aEizozQOgFhmFrV
Malware Config
Signatures
-
Loads dropped DLL 22 IoCs
pid Process 408 capa.exe 408 capa.exe 408 capa.exe 408 capa.exe 408 capa.exe 408 capa.exe 408 capa.exe 408 capa.exe 408 capa.exe 408 capa.exe 408 capa.exe 408 capa.exe 408 capa.exe 408 capa.exe 408 capa.exe 408 capa.exe 408 capa.exe 408 capa.exe 408 capa.exe 408 capa.exe 408 capa.exe 408 capa.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3740 wrote to memory of 408 3740 capa.exe 81 PID 3740 wrote to memory of 408 3740 capa.exe 81 PID 408 wrote to memory of 792 408 capa.exe 82 PID 408 wrote to memory of 792 408 capa.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\capa.exe"C:\Users\Admin\AppData\Local\Temp\capa.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\capa.exe"C:\Users\Admin\AppData\Local\Temp\capa.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵PID:792
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
93KB
MD54a365ffdbde27954e768358f4a4ce82e
SHA1a1b31102eee1d2a4ed1290da2038b7b9f6a104a3
SHA2566a0850419432735a98e56857d5cfce97e9d58a947a9863ca6afadd1c7bcab27c
SHA51254e4b6287c4d5a165509047262873085f50953af63ca0dcb7649c22aba5b439ab117a7e0d6e7f0a3e51a23e28a255ffd1ca1ddce4b2ea7f87bca1c9b0dbe2722
-
Filesize
63KB
MD50400b1958d0f7aa0d2ad409ea12ffec7
SHA1ce1a5c61192ffe489a53f029ac0a95d4abb3d2b9
SHA2566e25aa5931f175b971dfd05aab7a24cef29edd8f4b524341c414d0577c07a200
SHA5128790f3f9c69823d55350ea63a1b8ebb3dad64942b6e6752109d2932b3bb848a5101e2a9a4645e93a476a8c4e5c8b27e15eb39b33fcc772a876b0e8ab9fd5eefa
-
Filesize
85KB
MD5a49c5f406456b79254eb65d015b81088
SHA1cfc2a2a89c63df52947af3610e4d9b8999399c91
SHA256ce4ef8ed1e72c1d3a6082d500a17a009eb6e8ed15022bf3b68a22291858feced
SHA512bbafeff8c101c7425dc9b8789117fe4c5e516d217181d3574d9d81b8fec4b0bd34f1e1fe6e406ae95584dc671f788cd7b05c8d700baf59fbf21de9c902edf7ae
-
Filesize
124KB
MD5291a0a9b63bae00a4222a6df71a22023
SHA17a6a2aad634ec30e8edb2d2d8d0895c708d84551
SHA256820e840759eed12e19f3c485fd819b065b49d9dc704ae3599a63077416d63324
SHA512d43ef6fc2595936b17b0a689a00be04968f11d7c28945af4c3a74589bd05f415bf4cb3b4e22ac496490daff533755999a69d5962ccffd12e09c16130ed57fd09
-
Filesize
137KB
MD5ede7e476595429fd2ac8597052767fd7
SHA13874182aa89cf1edfe90ebc1d42c0c6795b15e30
SHA2562024a005d575914b4a95a1eac660d1c3afa2ccb6162ac0e4fa17ecf595b2c519
SHA512c7142afe3587e940cfcad9f66104ff69af1e448ca9f70a9af7af8f62d5b15db90e760e7dcf01b81816b708fe00aa2a83503c746fc5d257b15161999a3103e944
-
Filesize
243KB
MD525fefc2e62f083e1f60c92d74e611fe1
SHA1047f4791322858aaab2a286f2c6a803fe2e52ad8
SHA256cc1377d47a82c74b889edd0492851b1f3f77ff7013ec0322e06d4f78dc28eef3
SHA512ebebc2f78a5681fe5d83436382b719ec7a4e1b00c7b93d8b4cef47b4b9035c73a18d0cb466e44e3072444732edfcb143696d2afa760a9922f55832251d26c187
-
Filesize
46KB
MD55e5af52f42eaf007e3ac73fd2211f048
SHA11a981e66ab5b03f4a74a6bac6227cd45df78010b
SHA256a30cf1a40e0b09610e34be187f1396ac5a44dcfb27bc7ff9b450d1318b694c1b
SHA512bc37625005c3dad1129b158a2f1e91628d5c973961e0efd61513bb6c7b97d77922809afca8039d08c11903734450bc098c6e7b63655ff1e9881323e5cfd739fd
-
Filesize
159KB
MD5cf9fd17b1706f3044a8f74f6d398d5f1
SHA1c5cd0debbde042445b9722a676ff36a0ac3959ad
SHA2569209ccc60115727b192bf7771551040ca6fdd50f9bf8c3d2eacbfd424e8245e4
SHA5125fe922c00c6f7fd3cd9bc56fc51de1f44adffbdb0afc0583f1bb08008be628b9ac16f8560b0c3ba16138e1cdcaf1c525ef24241bed804804cdeb5961aed6385a
-
Filesize
45KB
MD57d5bb2a3e4fbceaddfeef929a21e610c
SHA1942b69e716ee522ef01bde792434c638e3d5497a
SHA2565f92c163b9fe6abb0f8b106a972f6a86f84271b2e32c67f95737387c85719837
SHA5128c44f1683fdea0d8121ff2fe36f2582313980ef20ee1985af7ff36acb022acbb7617e85d2dd3b8e75715444dc0cfc4487c81b43d0222bd832aac867875afbe30
-
Filesize
28KB
MD5dd146e2fa08302496b15118bf47703cf
SHA1d06813e2fcb30cbb00bb3893f30c2661686cf4b7
SHA25667e4e888559ea2c62ff267b58d7a7e95c2ec361703b5aa232aa8b2a1f96a2051
SHA5125b93a782c9562370fc5b3f289ca422b4d1a1c532e81bd6c95a0063f2e3889ecf828003e42b674439fc7cd0fa72f64ad607bab6910abe9d959a4fb9fb08df263c
-
Filesize
167KB
MD59ee33fa77a04bc3822e503c3f0de2e05
SHA1787532122627b506c33de7caa356f66de197871d
SHA256978c511b3331c7f985f2e79d372b417bb0ff555f7758b1a203027b77b4a7aa3a
SHA51225e60b81ff4ae7bb33aa6159ef3bd3c3f99a310cd176e05f8ea8c0f49acde8cec9aefaecacc8f888cbe4f422b0c1ff31ebff1536ecb57b1d8a4d7b68e3d8e3ec
-
Filesize
176KB
MD5e33e6149f99566ff04887037f4ce80d2
SHA182950b5351ab3c076c48f16ee5fa6c263f518928
SHA256acd60c6e3f30112aa8d305de66635d92e39a20fab838305517956708e7ea2563
SHA512bebff659793cd1fcd325f4e971515b6a7b08fae04edd965a232702c94e76951f4d47394a44f3420f6312ac6431fc193cdbd10a4fb803bb419d8d088af6f5c04c
-
Filesize
78KB
MD54827652de133c83fa1cae839b361856c
SHA1182f9a04bdc42766cfd5fb352f2cb22e5c26665e
SHA25687832a3b89e2ada8f704a8f066013660d591d9ce01ce901cc57a3b973f0858ba
SHA5128d66d68613fdba0820257550de3c39b308b1dce659dca953d10a95ff2cf89c31afe512d30ed44422b31117058dc9fa15279e5ac84694da89b47f99b0ad7e338a
-
Filesize
152KB
MD5d4dfd8c2894670e9f8d6302c09997300
SHA1c3a6cc8d8079a06a4cac8950e0baba2b43fb1f8e
SHA2560a721fc230eca278a69a2006e13dfa00e698274281378d4df35227e1f68ea3e0
SHA5121422bf45d233e2e3f77dce30ba0123625f2a511f73dfdf42ee093b1755963d9abc371935111c28f0d2c02308c5e82867de2546d871c35e657da32a7182026048
-
Filesize
237KB
MD5302b8475e73733c8ec7994e267c328b4
SHA14b411ec550ddcffac526b0f3704d6e3d510c8a04
SHA256e3afbd79e3bf688bc28277630dc7279e76580a7083a0d1899815549c340d3203
SHA5125579aaafced3e0eea3d2e863d2d776a34ced9e84efac5e895b28467cf1cc16a70fd00a0c0364eccda51b7b2e49c6566e1d7a5c2977fc53ba12940a0479e520df
-
Filesize
202KB
MD5a2f14d1542b2f23cb767021c9411d0c3
SHA1c0b8c9635de24a8e4053cf881aa899ec6f158a0d
SHA256b7783325ae471efba5b14d71894bc6ae1f20d3d5c988535534996bb04003ebbf
SHA51288f60282ed1efe69d89fc4e0d2dca7e6f749a9410855f57549634f54dd86ebce7d84856421e4bf1dab799e46375aebca12ca1148f074f043427e16ef0e4465f0
-
Filesize
145KB
MD59c494995d2ec65893e890e65b390f7f1
SHA1a89a3808dc57079eef6d98568ffa5f1ef1042289
SHA2568ccafc982d2e35c43151f174587940206fb8acb9ef5502c910187b43a6494cbb
SHA512dc0f9919f4fe8ddc762dfafff9b406e9cea0dacc2eedee158f06a5d3949b2712ee3dcddcb5abea0800b7395ae20fe6c2427307b903a70bb548bc1814cf65e4f1
-
Filesize
32KB
MD5eef7981412be8ea459064d3090f4b3aa
SHA1c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
-
Filesize
194KB
MD55899225ae6ebf8a2176187955d09f0cf
SHA15bffb62bb865b3871b31d65365c7e94dca860de6
SHA2566f1bd869ab62548e98ae41514d4ce8d5a3cd5bc08f9e0df7b6037b9017585a53
SHA512065e0de14ce2fa6f250ef307dc6c6b3058b0e9de0ceb7793c3b714a0d2f02debb27d319e15678f3e4d4b8ed744b31593bb0c5ee85d66afe1110a6811db9828a4
-
Filesize
268KB
MD51251f5c7ac371891e99860fd6b80ba48
SHA12b5e7c221bf78fbc01447324438c328880aaae6a
SHA256422d3663313b31aecb4490733934b8ec8de7129cdca4da7cf67f998e8b918956
SHA5129d3dce8fa3b4d3df01b5df444886663ecb6f90513d306a36dc7c7d858ea60c4deb21456136eb6c80ca413c67d544f767453dd4a8cdcd69b56507e56fb9a743ac
-
Filesize
107KB
MD515e3a1dff5ad55188349b8a935ab99a7
SHA1108ce5fe5d959bf729c86f9c534bc173772909bd
SHA256ff1422e6614770940ef4e614075c4479fff5c8cbbcac9391f59f4fb3d83c8a83
SHA512ebad55055a5e180027a175137961b457ed124bf24d16268287e9f5108f43bfcab81e6d8c68113d1b2fc4a7806f8a0377388b97199c35b306c6814b0b312c2a6d
-
Filesize
82KB
MD50eddd814b8cf790f40e89901adf5f701
SHA1ac7fc2cdd4d39c973e4725d7c939c82431cde7a2
SHA25673bb19ef6106cd1c6b03199340f780e9f015acd9b8b444dabed033c2f4321201
SHA5120d66f70a0d4b979defafe9d9f95eac1e7a058e00a3a5f8acd47d81bda243e82d63ca1c299ca72cbdbfd663ce07126257ce805e31cb6c7c8990de28d476ddb1c9
-
Filesize
187KB
MD52ae23047648257afa90d0ca96811979f
SHA10833cf7ccae477faa4656c74d593d0f59844cadd
SHA2565caf51f12406bdb980db1361fab79c51be8cac0a2a0071a083adf4d84f423e95
SHA51213052eb183bb7eb8bb2740ff39f63805b69e920f2e21b482657a9995aa002579a88296b81ec415942511d2ed146689d1868b446f7e698e72da22f5c182706030
-
Filesize
64KB
MD586ab163bbdb95dba223e23649222fe63
SHA17e03ee86410303fd5bc2811941c6a462f622c3cb
SHA256f897a21506b9626b619ac7693571ba77da1ec59c01e922164a22457dd058ef38
SHA512a2c9a0864e4b58d95a92b37ee073374f5f6cef79559afd6a2225310ecbedbfeb93a1780596d7ca4bfbe8ef1c977b5375d4994175c2d36f08db40a22a4d4a38ab
-
Filesize
218KB
MD5aa65593251a50a55573a1da488569add
SHA1c83aaf3555a2e4263ebc5b05957407f261b6cd7c
SHA25693f4d4976d0de4b62d16da28e4793dc20f464ee4f1ac2d13efe4c71205b27737
SHA5128d8c59252f280f204651bdc1ea011618bb6805ef1d0a6fe5037b0343363c4038ff04a99e851e9483cad580dab38b8493cadf71d7174f5798142f38d71a1035a4
-
Filesize
27KB
MD5e21cff76db11c1066fd96af86332b640
SHA1e78ef7075c479b1d218132d89bf4bec13d54c06a
SHA256fcc2e09a2355a5546922874fb4cac92ee00a33c0ed6adbc440d128d1e9f4ec28
SHA512e86dba2326ca5ea3f5ef3af2abd3c23d5b29b6211acc865b6be5a51d5c8850b7cda8c069e6f631ac62f2047224c4b675bbe6ac97c7ba781de5b8016ebaffd46f
-
Filesize
384KB
MD5cb68fbf062696fff0d13de9a4d9161c4
SHA17c7f0528b6d2a3541172361e8d45ab1b7c7ff6cd
SHA2564c9fae552128d3deea855a9963d45f6696a79e149282c737f82ea88ac24d787c
SHA512ada1210a9079db81fb8845d4f9cf43bd20794dc39457945a4899129a1f340ca69a2f7cf5f39a27ae01a3fe3b50d248c05dd3927b14a52ae4a2101d4093ac37db
-
Filesize
99KB
MD54da04f6d79290b5a755e67bf7a736887
SHA1fb2011790a5828880f021ee200334729cbac5408
SHA2567d8f7de60a18362787e63906d6c5742dcb4327412fc8475a11f8227cb0bfb831
SHA5125e435047d2c86e7d788540f626bb2db81681be5613e1cf1a88a3b1e4ab0efac2c0a23e9a43cca9e86cb06e2974b0cbf02e4193eaec23ee891d39ce1b6fd4456b
-
Filesize
284KB
MD55c4036fb5a2c5393f757190d1464c13b
SHA14d9d95fb8740344a8702d1282912fda00017bc1b
SHA25645b6dfca39a9b7261e9478c6e03c43e2af725c376807fc0af3941200ed5e059a
SHA512cab8d675889213004a18c8bef608239936d5749e10e7b1bd1e803ac4448f73a3b9d5185c61be4ef890dc653a9978314dcd7a8aa113c3ef1eab48c1365d50334d
-
Filesize
393KB
MD506d1020af8b1b5eeed91a9636c02a129
SHA171f849b1baa70ac6a51ee8b3c8d30713e69b0a6d
SHA256657db1844b28cfdb1930b95b3bd6cf08643a8966381c60472b8c7b1d9412151d
SHA512ae267625930a304333898b68d54e6632494baf6fa862b1310cf4d74787260ca05adaa0f4a723535d2bc413cf97c4dafe6a47705bc61e01f503e6d5ad33e41ea4
-
Filesize
134KB
MD5cb8549c94ad343ca13aca1d71fc8c10e
SHA10a3fd14b51352e6dc998f056b62ff97930e6cf25
SHA256da5f911c363fb9e4500ac2672c993996fa667a11c8b011e69251af4886daeba0
SHA51267506d2e816de71adbf974efa3da3317b0035b89f0f50e36fb0ee8780e18baa6e9d02433907622b5ef8fdc4666fd5372bb59c3b942a8fd1b38abe7f555c05b97
-
Filesize
108KB
MD530674e612f0b663cf91392ba0fe55e01
SHA10076e757609dfc906632d6528eeb2734b58e0e60
SHA256b485d43eab18780fdfef82335ff5867090c0d3e4be29f13b8b1dc3b87b1d5646
SHA5120f6e88d66c5e6e005279bfd4ed8d2b747bcd54477c496cd111c6580ec9b605b5c2ba8b85bf20465a9c4d3f2f4458dd967447958bf4fa2843f4e5fc231df89aa2