Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/03/2024, 11:43

General

  • Target

    @STD_WOMGame.exe

  • Size

    11.0MB

  • MD5

    4b7f0bb933d320e888971d735c505165

  • SHA1

    55a8b7e9efc693e187a30e8a2ea0f36104b07fff

  • SHA256

    dcdf03a4f596d8472aeb7817ec98a84b2b407abb57c40ac292e4a9da1659ad5b

  • SHA512

    42be671198704fc11c7a5d15cc08965b779c67321436772927b1515f09f38c75c03711734a7420de586a1f419ba3933be440c3f96a541449e67f3088044d4e10

  • SSDEEP

    196608:z/Zv5m73JoP1HOXfZ8bnt0gBF7x/A1PTv0T4G1dVSKzm/guPC6WkSSFY5cJCuk:zhv5m6P1IR8JrxodTvAVSKzmS6Wt5gC

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\@STD_WOMGame.exe
    "C:\Users\Admin\AppData\Local\Temp\@STD_WOMGame.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1064
    • C:\Users\Admin\AppData\Local\Temp\@STD_WOMGame.exe
      "C:\Users\Admin\AppData\Local\Temp\@STD_WOMGame.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      PID:2040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI10642\BSR.exe.manifest

    Filesize

    1KB

    MD5

    01bdde983c4747e5576351e061fd7c19

    SHA1

    f961f3ee46babe14ba1e39bd52c13b3d14db9305

    SHA256

    34e6001975dc7e2dd8533a7e23b5bccaea3c8da6dac3e3292fb0d891fd6af81f

    SHA512

    0c85aed2bad807dd4a3b080e8d815353c3d0f57a3fb6f5fbf7c9215e60256f0e357482cf8c3a672a638bac0b2459907493aa7e338f61fcb9a3feb254e9389c93

  • C:\Users\Admin\AppData\Local\Temp\_MEI10642\VCRUNTIME140.dll

    Filesize

    81KB

    MD5

    aeab74db6bc6c914997f1a8a9ff013ec

    SHA1

    6b717f23227d158d6aa566498c438b8f305a29b5

    SHA256

    18ccb2dd8af853f4e6221bb5513e3154ef67ae61cee6ec319a8a97615987dc4b

    SHA512

    a2832b7720599361e2537f79a2597acb1a2d5633fdfe20a0d1075e9457683fdb1d5676d121c0bf1a825ff99512dcd924254f1151b50aae922acc0cc10f461036

  • C:\Users\Admin\AppData\Local\Temp\_MEI10642\_ctypes.pyd

    Filesize

    102KB

    MD5

    10861d3fa19d7dc3b41eb6f837340782

    SHA1

    b258d223b444ab994ec2fec95acaa9f82dc3938c

    SHA256

    6255bab0b7f3e2209a9c8b89a3e1ec1bbc7a29849a18e70c0cf582a63c90bed1

    SHA512

    ec83134c9bce9cedeee8ebdb8e382fb7f944a7bc9d3bb47c7e3144ef2ef95114a36ac1cc8c0d52f434ee4c359d938a2d7c035e699c4407df728e200de7da4af9

  • C:\Users\Admin\AppData\Local\Temp\_MEI10642\base_library.zip

    Filesize

    763KB

    MD5

    ed5693db3c4b5bae528fedfbbd6c2f5c

    SHA1

    9280745fd41919c5481222e0befcdeb96e64b15e

    SHA256

    55af9a743d986aa7e42b8e51e44a91685b4b7320430e8488e2c0893841e8dd4a

    SHA512

    1739fa335d55211ee32a7da4ad61fe6ac505830fd200914a5ca70f27c5d379bd17c3670b91d14be9ccb8744579ef401ce0b8fdea80770d6f1cdf3b90a90ccbdc

  • C:\Users\Admin\AppData\Local\Temp\_MEI10642\python37.dll

    Filesize

    3.3MB

    MD5

    465089eaced8159ec533e4a37033e227

    SHA1

    074596adae6f53f33b8297f02e21f6a6f7ac6ff1

    SHA256

    2b29ae140cb9f08af872acf9e17f785ef99398ef3367549b55242bc064d6ae40

    SHA512

    55eca0922074162c22fff2b4f97bd2972540fa893b9b02b7d9bfa26345186dbbdaf1fbc37a9eba6366743d0d42fb5bb88e708877dfd57cb02ca4d3a6953cfb81