Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

03/07/2024, 15:38

240703-s26rnswhnh 10

03/07/2024, 15:33

240703-szn4vawfle 10

Analysis

  • max time kernel
    120s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    03/07/2024, 15:38

General

  • Target

    source_prepared.exe

  • Size

    80.7MB

  • MD5

    151d7708e147957fb7d0fb4dd9cadd6f

  • SHA1

    60b73ba56f2b502aebd183806c64e40081db4dc0

  • SHA256

    b11384a3db715c4ed6c9dda48c0a07543f1eddc98031d6329b41269564545e91

  • SHA512

    e7c20767ec74791bf6c3edec77c89404e9e72601f74104c7509d0ffdde4bcc446ab654e6278baf3ea89538ce92d5fab6327b4f743d5d88477cf0c5d0a4d63d3e

  • SSDEEP

    1572864:EvxZQglKSk8IpG7V+VPhqYdfCE70lgLiYgj+h58sMwFWuWDxNwJk:EvxZxwSkB05awcfAeF55HM3

Score
7/10
upx

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
    "C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1660
    • C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
      "C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
      2⤵
      • Loads dropped DLL
      PID:2744
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:320
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      1⤵
        PID:1740

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\_MEI16602\python311.dll

        Filesize

        1.6MB

        MD5

        548809b87186356c7ac6421562015915

        SHA1

        8fa683eed7f916302c2eb1a548c12118bea414fa

        SHA256

        6c65da37cf6464507ad9d187a34f5b5d61544b83d831547642d17c01852599a1

        SHA512

        c0b63bf9908e23457cf6c2551219c7951bc1a164f3a585cde750b244fa628753ee43fde35f2aa76223fd9f90cf5ea582241ab510f7373a247eae0b26817198fc

      • memory/2744-1262-0x000007FEF5960000-0x000007FEF5F52000-memory.dmp

        Filesize

        5.9MB