Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
3dex.py
windows11-21h2-x64
index.html
windows11-21h2-x64
1launch.bat
windows11-21h2-x64
1objects.py
windows11-21h2-x64
3olympia.py
windows11-21h2-x64
3pyarmor_ru...t__.py
windows11-21h2-x64
3pyarmor_ru...12.pyc
windows11-21h2-x64
3pyarmor_ru...me.dll
windows11-21h2-x64
1synapse.py
windows11-21h2-x64
3Resubmissions
22/02/2024, 23:12
240222-2695bsgf99 322/02/2024, 23:07
240222-233wvagf86 822/02/2024, 23:03
240222-21plfagb6x 8Analysis
-
max time kernel
92s -
max time network
99s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
22/02/2024, 23:12
Static task
static1
Behavioral task
behavioral1
Sample
dex.py
Resource
win11-20240221-en
Behavioral task
behavioral2
Sample
index.html
Resource
win11-20240221-en
Behavioral task
behavioral3
Sample
launch.bat
Resource
win11-20240221-en
Behavioral task
behavioral4
Sample
objects.py
Resource
win11-20240221-en
Behavioral task
behavioral5
Sample
olympia.py
Resource
win11-20240221-en
Behavioral task
behavioral6
Sample
pyarmor_runtime_000000/__init__.py
Resource
win11-20240221-en
Behavioral task
behavioral7
Sample
pyarmor_runtime_000000/__pycache__/__init__.cpython-312.pyc
Resource
win11-20240221-en
Behavioral task
behavioral8
Sample
pyarmor_runtime_000000/pyarmor_runtime.dll
Resource
win11-20240221-en
Behavioral task
behavioral9
Sample
synapse.py
Resource
win11-20240221-en
General
-
Target
launch.bat
-
Size
55B
-
MD5
eba1cce2735dee5889cd301bd8d6920c
-
SHA1
8603ce6f40ca1e7c96e2d0f73bea0c7f2ce060d1
-
SHA256
1a657bd8ee49122a706ee9e7f59d53e8c052213d94febb48134b8e64789f5b92
-
SHA512
3c40369fe4755196579a1ac2783e6069d0a49bd159641973e3576b295351495ae7de87085915517e7e9da6f8a601d2658affe63dddaeef8e3869f5a44ce9521b
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3712 wrote to memory of 2884 3712 cmd.exe 79 PID 3712 wrote to memory of 2884 3712 cmd.exe 79 PID 3712 wrote to memory of 2884 3712 cmd.exe 79
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\launch.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exepython olympia.py2⤵PID:2884
-