Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

Tools-Invoice.pdf.exe

windows7-x64

10

Tools-Invoice.pdf.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    12/04/2024, 00:27 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Tools-Invoice.pdf.exe

  • Size

    272.0MB

  • MD5

    19ec298f977fdc71f195a4782fa8b156

  • SHA1

    4a6035ce7510a7cc02bb785244e2cfcaec89131d

  • SHA256

    32b42c8c10ce7ec03005931d079fe7bb7f0e5b36bcf57a789081c6f7787e630c

  • SHA512

    d8cd8e043c24998d41b06ed0de8a8628389dab04be583094e68f5660ccc666dc260367297d373c800869fe36878aa8730fe35c2eb0b1e6631c0c2fec338b2391

  • SSDEEP

    49152:Uj+t6IRUEFX1PVv3Gfbs8HuQq1nvHol6Kz3DfjkJO:Uj+tNtV/AAFBH9yzLt

Score
10/10
jupyterbackdoorstealertrojan

Malware Config

Extracted

Family

jupyter

C2

http://146.70.71.174

Signatures

  • Jupyter, SolarMarker

    Jupyter is a backdoor and infostealer first seen in mid 2020.

    backdoortrojanstealerjupyter
  • Drops startup file 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Tools-Invoice.pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\Tools-Invoice.pdf.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1964
    • C:\Users\Admin\AppData\Local\Temp\TvtuziedoTs.exe
      "C:\Users\Admin\AppData\Local\Temp\TvtuziedoTs.exe"
      2⤵
      • Executes dropped EXE
      PID:2740
    • C:\Users\Admin\AppData\Local\Temp\Tools-Invoice.pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\Tools-Invoice.pdf.exe" /s
      2⤵
      • Drops startup file
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      PID:3000

Network

    No results found
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     80 B
     3
    2
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    152 B
     120 B
     3
    3
  • 146.70.71.174:80
    Tools-Invoice.pdf.exe
    52 B
     40 B
     1
    1
No results found

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\TvtuziedoTs.exe
    Filesize

    997KB

    MD5

    dbc534854dd385e59a3f1906ddfb9020

    SHA1

    2b3062d82232ce10a8713829199769ff0d12e0fc

    SHA256

    06486febb76aaa7bf469ba1bf46a92c4eafc42a5626646184e8865c862d09dd0

    SHA512

    1506fbc8fca0a3ca06e24fdae2fb9e8cb345fd6197f5cbbaa990490cc20a25b72906ab9668725f29c0bfce6528bd7dca5dc15ca0ac3c0327d1876e58e3d47951

    Download Submit

  • memory/1964-0-0x0000000000A40000-0x0000000000C7E000-memory.dmp

    Filesize

    2.2MB

    Download

  • memory/1964-1-0x000007FEF5A30000-0x000007FEF641C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/1964-9-0x000007FEF5A30000-0x000007FEF641C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2740-27-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2740-11-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2740-25-0x0000000000400000-0x0000000000500000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/2740-20-0x0000000000400000-0x0000000000500000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/3000-16-0x0000000002290000-0x0000000002336000-memory.dmp

    Filesize

    664KB

    Download

  • memory/3000-15-0x0000000000300000-0x0000000000308000-memory.dmp

    Filesize

    32KB

    Download

  • memory/3000-14-0x00000000004C0000-0x0000000000508000-memory.dmp

    Filesize

    288KB

    Download

  • memory/3000-17-0x00000000009E0000-0x0000000000A14000-memory.dmp

    Filesize

    208KB

    Download

  • memory/3000-18-0x0000000002180000-0x00000000021CA000-memory.dmp

    Filesize

    296KB

    Download

  • memory/3000-19-0x0000000000590000-0x00000000005A6000-memory.dmp

    Filesize

    88KB

    Download

  • memory/3000-13-0x00000000002E0000-0x00000000002FC000-memory.dmp

    Filesize

    112KB

    Download

  • memory/3000-21-0x000000001BF90000-0x000000001C010000-memory.dmp

    Filesize

    512KB

    Download

  • memory/3000-24-0x000000001AE70000-0x000000001AF24000-memory.dmp

    Filesize

    720KB

    Download

  • memory/3000-12-0x000000001B5E0000-0x000000001B8C2000-memory.dmp

    Filesize

    2.9MB

    Download

  • memory/3000-26-0x000007FEF5A30000-0x000007FEF641C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/3000-10-0x000007FEF5A30000-0x000007FEF641C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/3000-30-0x000000001BF90000-0x000000001C010000-memory.dmp

    Filesize

    512KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.