Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10/03/2024, 04:34
Behavioral task
behavioral1
Sample
Mega.nz.Checker.by.Arboff.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Mega.nz.Checker.by.Arboff.exe
Resource
win10v2004-20240226-en
General
-
Target
Mega.nz.Checker.by.Arboff.exe
-
Size
10.0MB
-
MD5
0fd5d52134361e0e4e871998aacb175b
-
SHA1
7ce789c6e6e8dfafec6a30d72015a50e23ff5c34
-
SHA256
3a5e9191fbcefddfe8633d8d8cc38d3db5001bcec58fef278d57c764be036fed
-
SHA512
bdcec38cb5dc25d7bd91cf744178b61fae7f56a33008611f52a622f5cd145407254e78a4797e834c88708258b5346642947e32ad3a6516b8823c0dc360f57c8c
-
SSDEEP
196608:BvdzUjpRz6wdQmRJ8dA6lSuqaycBIGpEogayJUSBzmytDaLt3/kllL2+LU/9+VT:7oVRrdQuslSq9NriDuolL2+ya
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2472 Mega.nz.Checker.by.Arboff.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2968 wrote to memory of 2472 2968 Mega.nz.Checker.by.Arboff.exe 29 PID 2968 wrote to memory of 2472 2968 Mega.nz.Checker.by.Arboff.exe 29 PID 2968 wrote to memory of 2472 2968 Mega.nz.Checker.by.Arboff.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\Mega.nz.Checker.by.Arboff.exe"C:\Users\Admin\AppData\Local\Temp\Mega.nz.Checker.by.Arboff.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\Mega.nz.Checker.by.Arboff.exe"C:\Users\Admin\AppData\Local\Temp\Mega.nz.Checker.by.Arboff.exe"2⤵
- Loads dropped DLL
PID:2472
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.3MB
MD5deaf0c0cc3369363b800d2e8e756a402
SHA13085778735dd8badad4e39df688139f4eed5f954
SHA256156cf2b64dd0f4d9bdb346b654a11300d6e9e15a65ef69089923dafc1c71e33d
SHA5125cac1d92af7ee18425b5ee8e7cd4e941a9ddffb4bc1c12bb8aeabeed09acec1ff0309abc41a2e0c8db101fee40724f8bfb27a78898128f8746c8fe01c1631989