Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    424s
  • max time network
    427s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-fr
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-frlocale:fr-fros:windows10-2004-x64systemwindows
  • submitted
    21/07/2024, 11:44

General

  • Target

    Atdz56x_.exe

  • Size

    12.3MB

  • MD5

    3b0c401c92259543235c3107b5404ad8

  • SHA1

    abfbac5bbbbf48d602656c1ca9563ac6cd14ce80

  • SHA256

    55e65149970f909c5487df061dced47a508e4b3c1eee2c7329d44897829ce29e

  • SHA512

    e6b052912d03e37eddf8fec1bb9f917489f5718a4c9070d64e9619b12b4488a4c1cda6e79ccda76011c1f0376bb9acd564d5f4fd4bd02c450536bce46d74ced5

  • SSDEEP

    393216:H3u8Uol39JaOB0MDTQ9jmeWacXR7t7zb:YWNQA0MDTC7c9t7v

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 45 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Atdz56x_.exe
    "C:\Users\Admin\AppData\Local\Temp\Atdz56x_.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1708
    • C:\Users\Admin\AppData\Local\Temp\Atdz56x_.exe
      "C:\Users\Admin\AppData\Local\Temp\Atdz56x_.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:644

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI17082\Cryptodome\Cipher\_raw_cbc.pyd

    Filesize

    9KB

    MD5

    d942db2187dbddf6a691af5a11eea175

    SHA1

    12862998269e1b9c9cfa0a4c2cfe3b7c79be6640

    SHA256

    ecdf4e6c42cfa892e2d38e6d75cf95ac02136938dcc13858b14e688b0402b67e

    SHA512

    e48ec578148b4507ef95fe5749242d31e05987334a11e68b2a8c51a0552ad33ce0c2ae4390199c1803149c27fad9774e047a1e273e962b9b2997bf880eb8ccf2

  • C:\Users\Admin\AppData\Local\Temp\_MEI17082\Cryptodome\Cipher\_raw_cfb.pyd

    Filesize

    10KB

    MD5

    5f15fc832d76fe0704faeb0a73e0afd0

    SHA1

    6f5b945b51c916fa92c5c0f4fb4147dcfc93f2fe

    SHA256

    617e987baa16bc7e669325c1aefa68a17f7edf016e1d610cfd07060a6d392d77

    SHA512

    eac596fee298f35d19f7e603e15afb59898bd4d3f547f4b7aa0f5ff84f26b8d9d91a0a127b5c35980944f70d84c80a503facb58e1ccd7fdc38e51c9d187e5427

  • C:\Users\Admin\AppData\Local\Temp\_MEI17082\Cryptodome\Cipher\_raw_ecb.pyd

    Filesize

    8KB

    MD5

    36eae458f7e1b1acdc616714a0c4d926

    SHA1

    623fa38dc123d2bf6f0497150246593672854d61

    SHA256

    e36f0ce43324efff18bada8d32f664a66034912157fe9d275d716f7272488921

    SHA512

    1eda434c21e014c5b1a54b3663a3f46b085c39a03755e011a148416969abad0e59ed2b6239aec713c9e7dbbeda7f67de5173c82f4c5002e85497aa6fda2025e3

  • C:\Users\Admin\AppData\Local\Temp\_MEI17082\Cryptodome\Cipher\_raw_ofb.pyd

    Filesize

    9KB

    MD5

    0d441965e3aa8c971dd65648016448f3

    SHA1

    9d1e5510046d6b7f95b2a9094aed6a7a3486d574

    SHA256

    50d630cf4223d0f366e02842d32e48cb74024f815a98a393e478160f19bf719d

    SHA512

    97d0e871dbeebd86a4143660c916b911b9d8d3072b8f66df06e0e45bae7686db4009f85aafa4de6459195bfc9d284183e1de5b81b5d98b23835d836d2ff5b6e6

  • C:\Users\Admin\AppData\Local\Temp\_MEI17082\VCRUNTIME140.dll

    Filesize

    81KB

    MD5

    4c360f78de1f5baaa5f110e65fac94b4

    SHA1

    20a2e66fd577293b33ba1c9d01ef04582deaf3a5

    SHA256

    ad1b0992b890bfe88ef52d0a830873acc0aecc9bd6e4fc22397dbccf4d2b4e37

    SHA512

    c6bba093d2e83b178a783d1ddfd1530c3adcb623d299d56db1b94ed34c0447e88930200bf45e5fb961f8fd7ad691310b586a7d754d7a6d7d27d58b74986a4db8

  • C:\Users\Admin\AppData\Local\Temp\_MEI17082\_asyncio.pyd

    Filesize

    55KB

    MD5

    5435ce08f40fbe43230cae8d3dff232c

    SHA1

    273472cac7263056762d0c08e8676b902700efb1

    SHA256

    79fda30cbfc95db2ba60646ff53dff45b5add57c12241c4a82fa798cb3b543df

    SHA512

    f34718ceb0668f94eeee2016d20fa29b70a3c84f76bcb7dd8eac4f4a44e88a8895297b6e7eeed01da2e2c9de809f3ea291f94eb7e8b9c2a227fb14e2b324ee46

  • C:\Users\Admin\AppData\Local\Temp\_MEI17082\_bz2.pyd

    Filesize

    76KB

    MD5

    0f75c236c4ccfea1b16f132f6c139236

    SHA1

    710bb157b01cafe8607400773b3940674506013b

    SHA256

    5dc26dcbf58cc7f5bfdec0badd5240d6724db3e34010aaf35a31876fe4057158

    SHA512

    5849ea147ada06c8b7a9fd523917009c173ace07ba1dbd320d7dda7f6d910b75ba4b7372f22bb56101c9dd836ce1a590b7715a7f34a67a489d70439b88998dd9

  • C:\Users\Admin\AppData\Local\Temp\_MEI17082\_cffi_backend.cp38-win32.pyd

    Filesize

    151KB

    MD5

    0430b925af08c2a400c9cdf6749215ca

    SHA1

    e5d3876c057edbe0f3f7da99bef49be5dc1e6b4e

    SHA256

    5e19921801974d6848952d982eac32e6f1be9f957e128c9e4c7e75b1ab091ad4

    SHA512

    864cf27f74f75abfdbe9a17b76ed5dec62f2f82f3bafafa7a2403e5e37a04866951d83ab2683e3f5f0226d70ef8c4cc415296128684b94b916ce984114894b8a

  • C:\Users\Admin\AppData\Local\Temp\_MEI17082\_ctypes.pyd

    Filesize

    113KB

    MD5

    3a2e78784b929003a6baceebdb0efa4d

    SHA1

    abb48b6a96e22b9bd6d2a8443f5811088c540922

    SHA256

    f205948b01b29cb244ae09c5b57fd4b6c8f356dfcd2f8cb49e7cfd177a748cf9

    SHA512

    ad5a9a5143b7e452d92cc7ea5db12967b2073b626be3437d17041d7ae6d82ee24b15d161d2f708639d3bbf8c657202cd845009a219657557203497ea355876ce

  • C:\Users\Admin\AppData\Local\Temp\_MEI17082\_decimal.pyd

    Filesize

    223KB

    MD5

    8601c853146a4be85238a57c9fd56865

    SHA1

    617ccd67b1a4d2d646dd90c33a56fceb624be528

    SHA256

    2a57023d4f355e3857187c02577fa4641a4d1dff195196b3c33b90322edf9fd4

    SHA512

    72a0b4bda2dab4c2d4e76d0d9c9c2569f465ec5f1af6d317c33b6e6a8833a3348d2f018b067305897fdb6125da80d5001769d3f65916c6cd147252bb22024f1b

  • C:\Users\Admin\AppData\Local\Temp\_MEI17082\_hashlib.pyd

    Filesize

    37KB

    MD5

    05362add80824b06014645a7951337d8

    SHA1

    76699e6dae7df93626906e488ef6218f9afcf8b5

    SHA256

    20b3a3d3350b3d4d57911ecfdb15f77512a6e73c3bf72b410724f81c79a5b1af

    SHA512

    061562b46e38c9bb83d49a9983d9848669ce2a20970451157b6474ef5dcc4ff38cc2a837b03cff89eacb4eae2063d2c1f43fccd6bd481dbbcabc5527f8489f0f

  • C:\Users\Admin\AppData\Local\Temp\_MEI17082\_lzma.pyd

    Filesize

    182KB

    MD5

    54f12e2385a77d825ae4d41a4ac515fe

    SHA1

    5ba526ac1c5f16fb7db225a4876996ab01ee979f

    SHA256

    08de18fba635822f3bb89c9429f175e3680b7261546430ba9e2ed09bb31f5218

    SHA512

    ea88774fd63a3d806f96e99255705ac68f615508c5887ae18b8d488bdf87268a634c12eb167c13199f4a0fb31795531b1f7d48bdacbd46cf8affa694a630d259

  • C:\Users\Admin\AppData\Local\Temp\_MEI17082\_multiprocessing.pyd

    Filesize

    25KB

    MD5

    8901e96bb7a8eead994af2bdf54a2447

    SHA1

    4cef6d364599fe1015e7216e1185a520dc6d2150

    SHA256

    823a96f080a3424f4c5327cf61ff517723e19a69679ebe93ea97061063d8d593

    SHA512

    5dcea55f8b9d4c759089171852265c4f0daaeb45a10a0221b06471597acf6c9acc097a0c59c1f006657ef5179e46e5c5afba3ce740346f8036d09b1553906f3b

  • C:\Users\Admin\AppData\Local\Temp\_MEI17082\_overlapped.pyd

    Filesize

    37KB

    MD5

    aa428e44a78a280ec8152c43d8284f6f

    SHA1

    4cf4631b86036e44f55cf8990f076f2a3aaab0e3

    SHA256

    f8fda2a6e3ff0069e634feec4854ee7a8c24134c747de3211ac2ba26e0188c79

    SHA512

    94485bab2531cdcddf23db51b7a40a53eaf47bc5b690f5ed4592adf7879a94369df642cede0d280a02acb0368f3a234593f95d09d841fa727dcf1255d5bef40a

  • C:\Users\Admin\AppData\Local\Temp\_MEI17082\_queue.pyd

    Filesize

    24KB

    MD5

    bc5fce7b8de6ca765cbf79f9d0587164

    SHA1

    d4d56e53ddc6bb5d21697a3460f310e9655525c0

    SHA256

    a5db4d041f40fb01761b5baa907099db89cf891b0df0251d92da2fbf9dc3897b

    SHA512

    23b616ce997eddaafd4c61da7c6d5da1210d0a0373b3df75750843951008234eb2cbe4c6c9a33a4f1cdfe2d115e6c7569d0a97a83ed9c5e85205dba43c5d4363

  • C:\Users\Admin\AppData\Local\Temp\_MEI17082\_socket.pyd

    Filesize

    67KB

    MD5

    cea329ce0935e99a8bc01070f07fefaf

    SHA1

    9d81307e9559d0661633530e5756957b05d84268

    SHA256

    d1a4d66c557c2fe7dc441614ca62e67f37ec44bef5a762bac41bac15d491a930

    SHA512

    b6aea9c2221bf35b0895c35942cf3c9613ec7919540b4c24a3b97d7a0846256e9ba654e8f233fadca1b15ff0b7d30d73adfaec85bcadb6100fd73e62d3a068ab

  • C:\Users\Admin\AppData\Local\Temp\_MEI17082\_sqlite3.pyd

    Filesize

    67KB

    MD5

    ef20e3dd0fdb3104077a32941b085c83

    SHA1

    d4fa58e0092b2a0bf97ffa2236b6d6488fcc2749

    SHA256

    759c1594fd1e4dffe604711436f203727184479d6c01a95b752195047995fe33

    SHA512

    7ab7d715fb623f5760fd45806afb5f6616e8de0974c7847dee71816156a30315bd0f8f43aebe02664220790c90a19ca97cbd24af4a59afb3e975bdb9e7848793

  • C:\Users\Admin\AppData\Local\Temp\_MEI17082\_ssl.pyd

    Filesize

    139KB

    MD5

    b9ecf769fc63a542a113ca1552dc7a7b

    SHA1

    04bd2c2f6f3ae7d8d996c0166d98e0d6aae7b514

    SHA256

    e0bdb16cffc7b5a19c5af22d8a33d3c999d55a3117f2da07ed3171ca9487927e

    SHA512

    593075258548d3ab125ea2f71822662d5ab19c8e036edaf2b92eb63fe721af09fbeae27fdb36e033f654fb55e78a5922a18d5a527fd1c815f691950ba6adcb85

  • C:\Users\Admin\AppData\Local\Temp\_MEI17082\base_library.zip

    Filesize

    822KB

    MD5

    c77bdad2083abb1068d8d06fdfa97940

    SHA1

    206c4aeb6363e30910ce74940d838bcefb46c286

    SHA256

    43803ece53589b03a5a4d578dfa15630acb717820e219434b2254a4eed25e776

    SHA512

    aead8309b7728a2760c16a7b00c0cfe5ebdd03b1f2357213c3251e282094427f643c93b780fc76b82b054bed24c16b6794fa56673929ef01afb87d810dc75d4e

  • C:\Users\Admin\AppData\Local\Temp\_MEI17082\charset_normalizer\md.cp38-win32.pyd

    Filesize

    8KB

    MD5

    ce9a43f60815b8d138e9d3de400d7173

    SHA1

    e84e9ab3e34be3c370794e5e157ed48f7910ea9a

    SHA256

    bb2bfaa8a2f2dd14b40658b3437a1ea684d67810da98b22985fc732b689f7909

    SHA512

    59b50780a9d5009d6662e1698b121ed902cb42c15c53e08bf3d2a7cdbcff3c0f606403358b36c5fa233b56098dcfa97dd66878b77cf07ff5bd62bb277ab63563

  • C:\Users\Admin\AppData\Local\Temp\_MEI17082\charset_normalizer\md__mypyc.cp38-win32.pyd

    Filesize

    98KB

    MD5

    2d7eab39e0a7588792b84ea0714faec8

    SHA1

    37088cfae8543419ee5ba695065cec77d16af43f

    SHA256

    ac6faf33dae52f3345eac1fda80d3258de5fcd8cb237cea87de14be02bd903c1

    SHA512

    48ad25bce58732eba210dc3294ec77c8698a73c105e31436489fc24d6f6f1b06967282b6d7b96157650cf8e503533f650310b4d1d709d51d1d8e5714b90e0b27

  • C:\Users\Admin\AppData\Local\Temp\_MEI17082\libcrypto-1_1.dll

    Filesize

    2.1MB

    MD5

    73def838c090acd4be070c649cbd3bf1

    SHA1

    3dd16cf7740119e7a1d4f56b4c4934a724682e84

    SHA256

    52d89fac9e42d87300e1427cb41c331f78a7e488d0cbbed8db4adf9d930c89d1

    SHA512

    1a1e799cce4986059b53856761810f63829cbc5ead197032ce02e9d3905804d34c8d4d8fcf8a0fe5ac9e5f2f30883f7d4181d0551d4195c2356baf3ff5bd0da8

  • C:\Users\Admin\AppData\Local\Temp\_MEI17082\libffi-7.dll

    Filesize

    28KB

    MD5

    bc20614744ebf4c2b8acd28d1fe54174

    SHA1

    665c0acc404e13a69800fae94efd69a41bdda901

    SHA256

    0c7ec6de19c246a23756b8550e6178ac2394b1093e96d0f43789124149486f57

    SHA512

    0c473e7070c72d85ae098d208b8d128b50574abebba874dda2a7408aea2aabc6c4b9018801416670af91548c471b7dd5a709a7b17e3358b053c37433665d3f6b

  • C:\Users\Admin\AppData\Local\Temp\_MEI17082\libssl-1_1.dll

    Filesize

    528KB

    MD5

    ad77250dbaa7faf0c2c9e13d717faec7

    SHA1

    d6450be5a28caac59d47ac620cd128febfbf95ab

    SHA256

    ccba760e6607fb6b08215452a8c0b6f84b2cb13937e86514995e9e86352f487a

    SHA512

    ae89207cd3831b8d0be8b336a9336b69541d1d86e9b9b331d0a64a5bb97c2c9481e735b72bc958bfdb0458f49311b2bd4fcf6d4ca255b7ef510d02de1573c096

  • C:\Users\Admin\AppData\Local\Temp\_MEI17082\psutil\_psutil_windows.pyd

    Filesize

    57KB

    MD5

    c96194dd5f828acfb65b3064ce246579

    SHA1

    981bcf2744fa76640ddbe1ae6947d4a1988a445a

    SHA256

    eecb092a5bc05168a560da5248bfcbe4381bee5c12fce3f227863debf7be9c53

    SHA512

    e350bace1a2a71b06d648a344cdaed06614521fb08909c75bfe7e6e2f793ee1874df2aebdf75fec4111dda154de091018291e42fc5ec8a5bb8a3e14b76d98592

  • C:\Users\Admin\AppData\Local\Temp\_MEI17082\pyexpat.pyd

    Filesize

    165KB

    MD5

    e8da8cabc1dd0d5b66f575236e0225e2

    SHA1

    f0d06fdc3620696ee98e2f0e6da8594b6bcfd878

    SHA256

    79a0e4e86126af297594c76f4d855e36070fad50b62e62f569a45114ef5432fe

    SHA512

    69ba16197508de74e943cad146eee3cae38bdb30016d9d431bfe19274dbb4296aadd9db97fe9b9b11a0e5feff24885e54c4d73b9a2641286afe984717a57b8f3

  • C:\Users\Admin\AppData\Local\Temp\_MEI17082\python3.dll

    Filesize

    57KB

    MD5

    05a80bfc12e9e8b3a7aca85cde621607

    SHA1

    5ea32181e0d45445457881ba3785de80733787af

    SHA256

    b95bb79988557ac18365e9785558645a3336a95e9245180711c4784928303b67

    SHA512

    472908ec9c5b292bee433e39176fa46af59536d0fe4fd7b51a1cb0f03d6b3858aa386d974c321e073608e4239138ef70a5c46a0923f0afbba306e7ee167d0071

  • C:\Users\Admin\AppData\Local\Temp\_MEI17082\python38.dll

    Filesize

    3.9MB

    MD5

    7e771d92e814a9fe3520b9f1af6176e0

    SHA1

    2b1d2fc31fdc2d1940d3835e1e62214414e6cffd

    SHA256

    54326ecd163c7fffcdd02620490b6bde727c6a3153bff9706cf086510e4aa36d

    SHA512

    547bdf9048d3b3bc88741ce2307ed4a48b10407d17dbb9f5ba5a727d59d208069abddb90d24b3d4bf0aa5ced2bdcabec3230baf73f2576652035afe5a1297667

  • C:\Users\Admin\AppData\Local\Temp\_MEI17082\pywin32_system32\pywintypes38.dll

    Filesize

    111KB

    MD5

    920f8f697951b59e71c7952823154b8d

    SHA1

    94918152e1ab20031429e9f25ccd5fc83a17f65f

    SHA256

    2ae71270fe6e6bdc73bcf420833ce76cf538a8b2230119892fd055603804573b

    SHA512

    f496fe4ddb04037b7547e84872d460f783cf991c2da3d50c5e3cfb98f1dc351e11faada6accbf35c3f646347841a8252b215b0ffc70cc19767e3110c20e9eb1c

  • C:\Users\Admin\AppData\Local\Temp\_MEI17082\select.pyd

    Filesize

    23KB

    MD5

    26bc7e9826bc13a4d0cf681b0e5cf3c8

    SHA1

    effff42e88cdd66bc4397de1a6d3b5ae540f820b

    SHA256

    8e7366cf6e128f977f8977a8db45a714ba72e643b31bd26b7676f33d3d8df612

    SHA512

    16d92785a234e60301aa6c4c5d508bdaff805689d4f160ab3c0c4d0c2376dd3616f676ad2fa81c08ea80e4fb862c3a15e1b59212508dddb388c8a768726b018a

  • C:\Users\Admin\AppData\Local\Temp\_MEI17082\sqlite3.dll

    Filesize

    1.1MB

    MD5

    418fd5ea9929763150f3b0f5a6a44db0

    SHA1

    ae4174c660a5c9ee3f00ffdac399594d649f2576

    SHA256

    bb41596566cfba46c6afe257bcbc0774a942158b750cda71af8d2bd11443ba4e

    SHA512

    01af594c45ada3b5429d577acd303dd3af447ce60729bebf85f52ae69e482f2b1dae1a44302f192d1ee26aa303cc7ad810110a6c8fd535270d7838bc323122a4

  • C:\Users\Admin\AppData\Local\Temp\_MEI17082\unicodedata.pyd

    Filesize

    1.0MB

    MD5

    7d24a6d7f45ee7190d867cc92a818ba8

    SHA1

    5ff89024f541670d7846cf8cab3747b6a3a9dc1c

    SHA256

    b3df52727dddd333076299f2f8148d1a13bbd39e4481a0ad9a8d88f638d7385b

    SHA512

    28a4af7c30caa116db00790f1f0584b0a0b42dde07f410dddda9caee123bd7082a62c8779bb7aab4931ee0b44343b8e26d5559e63eebe9c581347bb17809da5b

  • C:\Users\Admin\AppData\Local\Temp\_MEI17082\win32\win32api.pyd

    Filesize

    108KB

    MD5

    908bb8aae998d27e997f2a6b9c4655c7

    SHA1

    63ff8e9699aba8792ffda458cac17c44cca98c27

    SHA256

    4776e752dab37e0540f4f3b66a6686e549a9eba42ddfe2f22ee8bcd8e11d215e

    SHA512

    e4848d2e71b3f9b66f5197c52fd997953b0d08298cdb6fca5a34c3daaecbf3062292b95adb7bbad8d93c8fdf691e3e88f7c713bc8cea1cd5e7f119f6696942f6

  • C:\Users\Admin\AppData\Local\Temp\_MEI17082\win32\win32gui.pyd

    Filesize

    171KB

    MD5

    5a9fa4aadd4481cf12bc9a485bf6ca7f

    SHA1

    2c9b43a9b4bd48b26522948ca3d8389e7533541a

    SHA256

    0b449965f4f7ec54cfc51599a874f9edcf2961ce348a98de769a6e9d5416fbdd

    SHA512

    a5fce573783e55f5336f122a99bc7b5f8fc1b6bce042210bf6631d5817b222dce065eaa41ce76773547683288add06ab4cbe522b8ef925589f20b63a30353de1