Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

AntiSchedules.exe

windows10-1703-x64

7

Resubmissions

17/04/2024, 01:49

240417-b86xksad92 7

17/04/2024, 01:48

240417-b735asad66 7

Analysis

  • max time kernel
    2s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    17/04/2024, 01:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    AntiSchedules.exe

  • Size

    7.4MB

  • MD5

    375548d9e1e7552f6358d36cd684ff35

  • SHA1

    44eee6f61faf888b4a5615b6153018f9f87d3347

  • SHA256

    2092e9c1c24f6e63f5ab7aeab1684ba5b27f29b9646e407f1d3e394717c7288a

  • SHA512

    814a52b6e9aed1787675720461f8a9b5ffdd41f6b3ae6eadd5f1f3872193d1fee7d8b84be0964910390249bb9a390e648d1599ff5877a655b92d20d68509c788

  • SSDEEP

    196608:HnH4FMIZETSRjPePdrQJ/Bd1WEtYP3EatE:nQETSRvJH1WwIEyE

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 6 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\AntiSchedules.exe
    "C:\Users\Admin\AppData\Local\Temp\AntiSchedules.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3872
    • C:\Users\Admin\AppData\Local\Temp\AntiSchedules.exe
      "C:\Users\Admin\AppData\Local\Temp\AntiSchedules.exe"
      2⤵
      • Loads dropped DLL
      PID:3480

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI38722\VCRUNTIME140.dll
    Filesize

    106KB

    MD5

    4585a96cc4eef6aafd5e27ea09147dc6

    SHA1

    489cfff1b19abbec98fda26ac8958005e88dd0cb

    SHA256

    a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736

    SHA512

    d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI38722\_ctypes.pyd
    Filesize

    120KB

    MD5

    bd36f7d64660d120c6fb98c8f536d369

    SHA1

    6829c9ce6091cb2b085eb3d5469337ac4782f927

    SHA256

    ee543453ac1a2b9b52e80dc66207d3767012ca24ce2b44206804767f37443902

    SHA512

    bd15f6d4492ddbc89fcbadba07fc10aa6698b13030dd301340b5f1b02b74191faf9b3dcf66b72ecf96084656084b531034ea5cadc1dd333ef64afb69a1d1fd56

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI38722\_socket.pyd
    Filesize

    77KB

    MD5

    1eea9568d6fdef29b9963783827f5867

    SHA1

    a17760365094966220661ad87e57efe09cd85b84

    SHA256

    74181072392a3727049ea3681fe9e59516373809ced53e08f6da7c496b76e117

    SHA512

    d9443b70fcdc4d0ea1cb93a88325012d3f99db88c36393a7ded6d04f590e582f7f1640d8b153fe3c5342fa93802a8374f03f6cd37dd40cdbb5ade2e07fad1e09

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI38722\base_library.zip
    Filesize

    1.8MB

    MD5

    83b06d6f90f33c512eee102a649279f6

    SHA1

    96e5734c6d26b9ae9ed3fc3251e8c56ed9d468db

    SHA256

    1a2fd2bb30f1250cb552cb17839f806602da1559e29adbee5508b6e490306a73

    SHA512

    3404d4a06e75837b4b3b3bc53141e517feca93362e35cb1a18fee8d3799b4ca2e7c4c4a121d535446d05abd09bb9a0eb5577c748db65c544283575e065e64845

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI38722\libffi-8.dll
    Filesize

    38KB

    MD5

    0f8e4992ca92baaf54cc0b43aaccce21

    SHA1

    c7300975df267b1d6adcbac0ac93fd7b1ab49bd2

    SHA256

    eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a

    SHA512

    6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI38722\python311.dll
    Filesize

    5.5MB

    MD5

    5a5dd7cad8028097842b0afef45bfbcf

    SHA1

    e247a2e460687c607253949c52ae2801ff35dc4a

    SHA256

    a811c7516f531f1515d10743ae78004dd627eba0dc2d3bc0d2e033b2722043ce

    SHA512

    e6268e4fad2ce3ef16b68298a57498e16f0262bf3531539ad013a66f72df471569f94c6fcc48154b7c3049a3ad15cbfcbb6345dacb4f4ed7d528c74d589c9858

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI38722\select.pyd
    Filesize

    29KB

    MD5

    c97a587e19227d03a85e90a04d7937f6

    SHA1

    463703cf1cac4e2297b442654fc6169b70cfb9bf

    SHA256

    c4aa9a106381835cfb5f9badfb9d77df74338bc66e69183757a5a3774ccdaccf

    SHA512

    97784363f3b0b794d2f9fd6a2c862d64910c71591006a34eedff989ecca669ac245b3dfe68eaa6da621209a3ab61d36e9118ebb4be4c0e72ce80fab7b43bde12

    Download Submit