Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
36s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
13/05/2024, 12:02
Behavioral task
behavioral1
Sample
emblemhubexternal.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
emblemhubexternal.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
g�KYJ�'.pyc
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
g�KYJ�'.pyc
Resource
win10v2004-20240426-en
General
-
Target
emblemhubexternal.exe
-
Size
7.4MB
-
MD5
a3d7ee1dbd187c9366ded19c8bdd655b
-
SHA1
38ad1fbbadac02758eb1b4e870426334917a7b31
-
SHA256
19583b8506d04cf7c5b2e60141b372486457043bee81104daa28f6f4d4b56200
-
SHA512
9f2efb3769c0cf1d2f6bb2262a5e1d4f7bcdd21843e7ea50f50deb3c54135201efe29d730c3fda96af873a0394281e32727c11fe145010eeedfe5a095e80c309
-
SSDEEP
196608:br9n0cDe1ULjv+bhqNVoBKUh8mz4Iv9Plu1D7A6:qieWL+9qz8/b4IzuRA6
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2148 emblemhubexternal.exe -
resource yara_rule behavioral1/files/0x0006000000016d4a-21.dat upx behavioral1/memory/2148-23-0x000007FEF5B20000-0x000007FEF6109000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2196 wrote to memory of 2148 2196 emblemhubexternal.exe 28 PID 2196 wrote to memory of 2148 2196 emblemhubexternal.exe 28 PID 2196 wrote to memory of 2148 2196 emblemhubexternal.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\emblemhubexternal.exe"C:\Users\Admin\AppData\Local\Temp\emblemhubexternal.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\emblemhubexternal.exe"C:\Users\Admin\AppData\Local\Temp\emblemhubexternal.exe"2⤵
- Loads dropped DLL
PID:2148
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD50b66c50e563d74188a1e96d6617261e8
SHA1cfd778b3794b4938e584078cbfac0747a8916d9e
SHA25602c665f77db6b255fc62f978aedbe2092b7ef1926836290da68fd838dbf2a9f2
SHA51237d710cb5c0ceb5957d11b61684cfbc65951c1d40ab560f3f3cb8feca42f9d43bd981a0ff44c3cb7562779264f18116723457e79e0e23852d7638b1a954a258f