Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
24/04/2024, 17:11
Behavioral task
behavioral1
Sample
YeIoxi.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
YeIoxi.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
9 1G�O_.pyc
Resource
win7-20240215-en
Behavioral task
behavioral4
Sample
9 1G�O_.pyc
Resource
win10v2004-20240412-en
General
-
Target
YeIoxi.exe
-
Size
6.0MB
-
MD5
b907fdffcf20892db3eeb81abb14930c
-
SHA1
ad94b36fbcc1a3ff67c5cb430915ffe29f095228
-
SHA256
25e5364b68dd722918c975cb1c14104bcca9bd74be7d34a80d6c7aa46e1093a4
-
SHA512
ef1670a4585d8525751d1a485c4a6684a8814d169aac5ff38c96d6b6df2ac003524917d96431947b7b5dc39392c752e930549da7ebcf74835924c54a289bdf36
-
SSDEEP
98304:RrMJEtdFBG9YamaHl3Ne4i3gmtfXJOLhx9fZAzDJ4wzQgsRuGK4R2OuAKkfePyyu:RrMIFE9ZeN/FJMIDJf0gsAGK4RFuAKkj
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2920 YeIoxi.exe -
resource yara_rule behavioral1/files/0x00060000000164ec-21.dat upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2372 wrote to memory of 2920 2372 YeIoxi.exe 28 PID 2372 wrote to memory of 2920 2372 YeIoxi.exe 28 PID 2372 wrote to memory of 2920 2372 YeIoxi.exe 28
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5178a0f45fde7db40c238f1340a0c0ec0
SHA1dcd2d3d14e06da3e8d7dc91a69b5fd785768b5fe
SHA2569fcb5ad15bd33dd72122a171a5d950e8e47ceda09372f25df828010cde24b8ed
SHA5124b790046787e57b9414a796838a026b1530f497a75c8e62d62b56f8c16a0cbedbefad3d4be957bc18379f64374d8d3bf62d3c64b53476c7c5005a7355acd2cee