Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    73s
  • max time network
    75s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/07/2024, 21:45

General

  • Target

    tool.exe

  • Size

    20.8MB

  • MD5

    78e81ec71651ac0911dc8bf1ba1cd841

  • SHA1

    9555a1a83b720adbb3d8921f04f219412a9dd5d2

  • SHA256

    70d6359805318ec5b875a7924f0e433e479da8b1cdd757f4211616dcdb417221

  • SHA512

    e3be8d8986364aed9b3ef00bd8f2967bb68228ff7013eb66f6ac00e35777f25eb66254f9e7b6da7a63a21a586e03c7e0ae0122603553e57844caba4b0f4fa60e

  • SSDEEP

    393216:MSvk3TPDq3o0pEV7qmVFfFhbXjU1PDKgDO4CqYM6jfG15D7dhSlctZjmOd:MSETPDq3o087rVFfFJTU17lgJjC5DRPR

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 24 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\tool.exe
    "C:\Users\Admin\AppData\Local\Temp\tool.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4356
    • C:\Users\Admin\AppData\Local\Temp\onefile_4356_133661583486229453\tool.exe
      "C:\Users\Admin\AppData\Local\Temp\tool.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:3972

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_decimal.pyd

    Filesize

    248KB

    MD5

    20c77203ddf9ff2ff96d6d11dea2edcf

    SHA1

    0d660b8d1161e72c993c6e2ab0292a409f6379a5

    SHA256

    9aac010a424c757c434c460c3c0a6515d7720966ab64bad667539282a17b4133

    SHA512

    2b24346ece2cbd1e9472a0e70768a8b4a5d2c12b3d83934f22ebdc9392d9023dcb44d2322ada9edbe2eb0e2c01b5742d2a83fa57ca23054080909ec6eb7cf3ca

  • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_hashlib.pyd

    Filesize

    63KB

    MD5

    d4674750c732f0db4c4dd6a83a9124fe

    SHA1

    fd8d76817abc847bb8359a7c268acada9d26bfd5

    SHA256

    caa4d2f8795e9a55e128409cc016e2cc5c694cb026d7058fc561e4dd131ed1c9

    SHA512

    97d57cfb80dd9dd822f2f30f836e13a52f771ee8485bc0fd29236882970f6bfbdfaac3f2e333bba5c25c20255e8c0f5ad82d8bc8a6b6e2f7a07ea94a9149c81e

  • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_queue.pyd

    Filesize

    30KB

    MD5

    d8c1b81bbc125b6ad1f48a172181336e

    SHA1

    3ff1d8dcec04ce16e97e12263b9233fbf982340c

    SHA256

    925f05255f4aae0997dc4ec94d900fd15950fd840685d5b8aa755427c7422b14

    SHA512

    ccc9f0d3aca66729832f26be12f8e7021834bbee1f4a45da9451b1aa5c2e63126c0031d223af57cf71fad2c85860782a56d78d8339b35720194df139076e0772

  • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_socket.pyd

    Filesize

    77KB

    MD5

    819166054fec07efcd1062f13c2147ee

    SHA1

    93868ebcd6e013fda9cd96d8065a1d70a66a2a26

    SHA256

    e6deb751039cd5424a139708475ce83f9c042d43e650765a716cb4a924b07e4f

    SHA512

    da3a440c94cb99b8af7d2bc8f8f0631ae9c112bd04badf200edbf7ea0c48d012843b4a9fb9f1e6d3a9674fd3d4eb6f0fa78fd1121fad1f01f3b981028538b666

  • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ssl.pyd

    Filesize

    156KB

    MD5

    7910fb2af40e81bee211182cffec0a06

    SHA1

    251482ed44840b3c75426dd8e3280059d2ca06c6

    SHA256

    d2a7999e234e33828888ad455baa6ab101d90323579abc1095b8c42f0f723b6f

    SHA512

    bfe6506feb27a592fe9cf1db7d567d0d07f148ef1a2c969f1e4f7f29740c6bb8ccf946131e65fe5aa8ede371686c272b0860bd4c0c223195aaa1a44f59301b27

  • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libcrypto-1_1.dll

    Filesize

    3.3MB

    MD5

    9d7a0c99256c50afd5b0560ba2548930

    SHA1

    76bd9f13597a46f5283aa35c30b53c21976d0824

    SHA256

    9b7b4a0ad212095a8c2e35c71694d8a1764cd72a829e8e17c8afe3a55f147939

    SHA512

    cb39aa99b9d98c735fdacf1c5ed68a4d09d11f30262b91f6aa48c3f8520eff95e499400d0ce7e280ca7a90ff6d7141d2d893ef0b33a8803a1cadb28ba9a9e3e2

  • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libssl-1_1.dll

    Filesize

    688KB

    MD5

    bec0f86f9da765e2a02c9237259a7898

    SHA1

    3caa604c3fff88e71f489977e4293a488fb5671c

    SHA256

    d74ce01319ae6f54483a19375524aa39d9f5fd91f06cf7df238ca25e043130fd

    SHA512

    ffbc4e5ffdb49704e7aa6d74533e5af76bbe5db297713d8e59bd296143fe5f145fbb616b343eed3c48eceaccccc2431630470d8975a4a17c37eafcc12edd19f4

  • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\pythoncom310.dll

    Filesize

    653KB

    MD5

    65dd753f51cd492211986e7b700983ef

    SHA1

    f5b469ec29a4be76bc479b2219202f7d25a261e2

    SHA256

    c3b33ba6c4f646151aed4172562309d9f44a83858ddfd84b2d894a8b7da72b1e

    SHA512

    8bd505e504110e40fa4973feff2fae17edc310a1ce1dc78b6af7972efdd93348087e6f16296bfd57abfdbbe49af769178f063bb0aa1dee661c08659f47a6216d

  • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\tls_client\dependencies\tls-client-64.dll

    Filesize

    17.8MB

    MD5

    181458ffd109573a1cde903e187b0b46

    SHA1

    6822c8b9cad8f13f3c0921205ada08efd693d93e

    SHA256

    b177778656455f6b8482154238d323a3de4d74f2a8b7a62bd973251a259edb87

    SHA512

    0f771e01e5f89dd83a8e46d129a7975b6ca395369d82411c9864805f1efa9ab7051e6caa24a5fad121391a25cb84dc991845da976265f3d67f8528aa01a280a8

  • C:\Users\Admin\AppData\Local\Temp\onefile_4356_133661583486229453\VCRUNTIME140.dll

    Filesize

    95KB

    MD5

    f34eb034aa4a9735218686590cba2e8b

    SHA1

    2bc20acdcb201676b77a66fa7ec6b53fa2644713

    SHA256

    9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1

    SHA512

    d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af

  • C:\Users\Admin\AppData\Local\Temp\onefile_4356_133661583486229453\_ctypes.pyd

    Filesize

    120KB

    MD5

    1635a0c5a72df5ae64072cbb0065aebe

    SHA1

    c975865208b3369e71e3464bbcc87b65718b2b1f

    SHA256

    1ea3dd3df393fa9b27bf6595be4ac859064cd8ef9908a12378a6021bba1cb177

    SHA512

    6e34346ea8a0aacc29ccd480035da66e280830a7f3d220fd2f12d4cfa3e1c03955d58c0b95c2674aea698a36a1b674325d3588483505874c2ce018135320ff99

  • C:\Users\Admin\AppData\Local\Temp\onefile_4356_133661583486229453\_uuid.pyd

    Filesize

    24KB

    MD5

    b68c98113c8e7e83af56ba98ff3ac84a

    SHA1

    448938564559570b269e05e745d9c52ecda37154

    SHA256

    990586f2a2ba00d48b59bdd03d3c223b8e9fb7d7fab6d414bac2833eb1241ca2

    SHA512

    33c69199cba8e58e235b96684346e748a17cc7f03fc068cfa8a7ec7b5f9f6fa90d90b5cdb43285abf8b4108e71098d4e87fb0d06b28e2132357964b3eea3a4f8

  • C:\Users\Admin\AppData\Local\Temp\onefile_4356_133661583486229453\_win32sysloader.pyd

    Filesize

    14KB

    MD5

    f9c9445be13026f8db777e2bbc26651d

    SHA1

    e1d58c30e94b00b32ad1e9b806465643f4afe980

    SHA256

    c953db1f67bbd92114531ff44ee4d76492fdd3cf608da57d5c04e4fe4fdd1b96

    SHA512

    587d9e8521c246865e16695e372a1675cfbc324e6258dd03479892d3238f634138ebb56985ed34e0c8c964c1ab75313182a4e687b598bb09c07fc143b506e9a8

  • C:\Users\Admin\AppData\Local\Temp\onefile_4356_133661583486229453\libffi-7.dll

    Filesize

    32KB

    MD5

    eef7981412be8ea459064d3090f4b3aa

    SHA1

    c60da4830ce27afc234b3c3014c583f7f0a5a925

    SHA256

    f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

    SHA512

    dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

  • C:\Users\Admin\AppData\Local\Temp\onefile_4356_133661583486229453\python3.DLL

    Filesize

    64KB

    MD5

    fd4a39e7c1f7f07cf635145a2af0dc3a

    SHA1

    05292ba14acc978bb195818499a294028ab644bd

    SHA256

    dc909eb798a23ba8ee9f8e3f307d97755bc0d2dc0cb342cedae81fbbad32a8a9

    SHA512

    37d3218bc767c44e8197555d3fa18d5aad43a536cfe24ac17bf8a3084fb70bd4763ccfd16d2df405538b657f720871e0cd312dfeb7f592f3aac34d9d00d5a643

  • C:\Users\Admin\AppData\Local\Temp\onefile_4356_133661583486229453\python310.dll

    Filesize

    4.3MB

    MD5

    63a1fa9259a35eaeac04174cecb90048

    SHA1

    0dc0c91bcd6f69b80dcdd7e4020365dd7853885a

    SHA256

    14b06796f288bc6599e458fb23a944ab0c843e9868058f02a91d4606533505ed

    SHA512

    896caa053f48b1e4102e0f41a7d13d932a746eea69a894ae564ef5a84ef50890514deca6496e915aae40a500955220dbc1b1016fe0b8bcdde0ad81b2917dea8b

  • C:\Users\Admin\AppData\Local\Temp\onefile_4356_133661583486229453\pywintypes310.dll

    Filesize

    131KB

    MD5

    ceb06a956b276cea73098d145fa64712

    SHA1

    6f0ba21f0325acc7cf6bf9f099d9a86470a786bf

    SHA256

    c8ec6429d243aef1f78969863be23d59273fa6303760a173ab36ab71d5676005

    SHA512

    05bab4a293e4c7efa85fa2491c32f299afd46fdb079dcb7ee2cc4c31024e01286daaf4aead5082fc1fd0d4169b2d1be589d1670fcf875b06c6f15f634e0c6f34

  • C:\Users\Admin\AppData\Local\Temp\onefile_4356_133661583486229453\select.pyd

    Filesize

    29KB

    MD5

    a653f35d05d2f6debc5d34daddd3dfa1

    SHA1

    1a2ceec28ea44388f412420425665c3781af2435

    SHA256

    db85f2f94d4994283e1055057372594538ae11020389d966e45607413851d9e9

    SHA512

    5aede99c3be25b1a962261b183ae7a7fb92cb0cb866065dc9cd7bb5ff6f41cc8813d2cc9de54670a27b3ad07a33b833eaa95a5b46dad7763ca97dfa0c1ce54c9

  • C:\Users\Admin\AppData\Local\Temp\onefile_4356_133661583486229453\simplejson\_speedups.pyd

    Filesize

    39KB

    MD5

    8c2f6bfed02d16308bb6bddde6759270

    SHA1

    7f944386b67c41f9a4acc0e1c1dfd193e99ba02f

    SHA256

    af9ed972ba7bc985a9941b114ab3e568121ba38039b9614eb05b74d419b5eb0f

    SHA512

    7d67f7f055108f4a9fb4a7810a875edc06c07097c87d97955b256b1f4b9aded1c4dfc46c538b2b74bdc4944e3a40b8c16e24b45f6a42b949bb88d17d26ee1955

  • C:\Users\Admin\AppData\Local\Temp\onefile_4356_133661583486229453\tool.exe

    Filesize

    18.9MB

    MD5

    4f965eda4f89095e489c8e52afe7f0f8

    SHA1

    4b217f0cb39f59b19a14ffd83fb99a6ce5c17130

    SHA256

    c5d961d2fcc8f68cdbcfd2b6bed09aabdd858b2d2e0ad845fbf1937670d79c3d

    SHA512

    927c901caa6ea2379feda63a70fc76f2eceb9529a9f19719a5b9cc6c475ef679d2c7072d757875f03448ebb195ad43f21cdb6bbc7e84f01d96abd29919aebe89

  • C:\Users\Admin\AppData\Local\Temp\onefile_4356_133661583486229453\unicodedata.pyd

    Filesize

    1.1MB

    MD5

    81d62ad36cbddb4e57a91018f3c0816e

    SHA1

    fe4a4fc35df240b50db22b35824e4826059a807b

    SHA256

    1fb2d66c056f69e8bbdd8c6c910e72697874dae680264f8fb4b4df19af98aa2e

    SHA512

    7d15d741378e671591356dfaad4e1e03d3f5456cbdf87579b61d02a4a52ab9b6ecbffad3274cede8c876ea19eaeb8ba4372ad5986744d430a29f50b9caffb75d

  • C:\Users\Admin\AppData\Local\Temp\onefile_4356_133661583486229453\vcruntime140_1.dll

    Filesize

    36KB

    MD5

    135359d350f72ad4bf716b764d39e749

    SHA1

    2e59d9bbcce356f0fece56c9c4917a5cacec63d7

    SHA256

    34048abaa070ecc13b318cea31425f4ca3edd133d350318ac65259e6058c8b32

    SHA512

    cf23513d63ab2192c78cae98bd3fea67d933212b630be111fa7e03be3e92af38e247eb2d3804437fd0fda70fdc87916cd24cf1d3911e9f3bfb2cc4ab72b459ba

  • C:\Users\Admin\AppData\Local\Temp\onefile_4356_133661583486229453\win32api.pyd

    Filesize

    130KB

    MD5

    00e5da545c6a4979a6577f8f091e85e1

    SHA1

    a31a2c85e272234584dacf36f405d102d9c43c05

    SHA256

    ac483d60a565cc9cbf91a6f37ea516b2162a45d255888d50fbbb7e5ff12086ee

    SHA512

    9e4f834f56007f84e8b4ec1c16fb916e68c3baadab1a3f6b82faf5360c57697dc69be86f3c2ea6e30f95e7c32413babbe5d29422d559c99e6cf4242357a85f31

  • memory/3972-80-0x00007FFE943B0000-0x00007FFE9553F000-memory.dmp

    Filesize

    17.6MB

  • memory/3972-79-0x00007FF7BC5A0000-0x00007FF7BD8F7000-memory.dmp

    Filesize

    19.3MB

  • memory/4356-88-0x00007FF6FA0F0000-0x00007FF6FB5DF000-memory.dmp

    Filesize

    20.9MB