Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    437s
  • max time network
    1160s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    05/08/2024, 20:59

General

  • Target

    Myro V5.6.exe

  • Size

    20.2MB

  • MD5

    83865dddb05aed591cbb87457fb275dc

  • SHA1

    a2d1e9d0f36e9b97c080e17f573527ac7bcd302d

  • SHA256

    58459374fb21debdc139b4b4396247ff369748b417622cb20d3c2b8900d96882

  • SHA512

    b0c46ff2c35048d77f792a37a0cf2c6e9987d148144e84058d33e87146297aeac3f40a670761ce944db2c3fd10dc227a84103219f850bcaeab709bff6a9af7a7

  • SSDEEP

    393216:JML/39QDD2xfaUX47d4hBaw22W8T26+J8IcVFz/CGdj4aD:JMLfdFaUI7d4hB22W8T6cV9b4a

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 56 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Myro V5.6.exe
    "C:\Users\Admin\AppData\Local\Temp\Myro V5.6.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1720
    • C:\Users\Admin\AppData\Local\Temp\Myro V5.6.exe
      "C:\Users\Admin\AppData\Local\Temp\Myro V5.6.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1640
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
          PID:2708
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c cls
          3⤵
            PID:2372
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c cls
            3⤵
              PID:852
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c cls
              3⤵
                PID:3864

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\_MEI17202\VCRUNTIME140.dll

            Filesize

            106KB

            MD5

            870fea4e961e2fbd00110d3783e529be

            SHA1

            a948e65c6f73d7da4ffde4e8533c098a00cc7311

            SHA256

            76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644

            SHA512

            0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

          • C:\Users\Admin\AppData\Local\Temp\_MEI17202\_asyncio.pyd

            Filesize

            63KB

            MD5

            42b1b82a77f4179b66262475ba5a8332

            SHA1

            9f6c979e2c59e27cc1e7494fc1cc1b0536aa3c22

            SHA256

            8ec1af6be27a49e3dc70075d0b5ef9255fad52cbbdab6a5072080085b4e45e89

            SHA512

            2ee9fc9079714cb2ae2226c87c9c790b6f52b110667dbe0f1677eedb27335949b41df200daf7f67aa5c90db63e369b4904aac986c040706f8a3f542c44daf1d0

          • C:\Users\Admin\AppData\Local\Temp\_MEI17202\_bz2.pyd

            Filesize

            82KB

            MD5

            a8a37ba5e81d967433809bf14d34e81d

            SHA1

            e4d9265449950b5c5a665e8163f7dda2badd5c41

            SHA256

            50e21ce62f8d9bab92f6a7e9b39a86406c32d2df18408bb52ffb3d245c644c7b

            SHA512

            b50f4334acb54a6fba776fc77ca07de4940810da4378468b3ca6f35d69c45121ff17e1f9c236752686d2e269bd0b7bce31d16506d3896b9328671049857ed979

          • C:\Users\Admin\AppData\Local\Temp\_MEI17202\_ctypes.pyd

            Filesize

            120KB

            MD5

            496dcf8821ffc12f476878775999a8f3

            SHA1

            6b89b8fdd7cd610c08e28c3a14b34f751580cffd

            SHA256

            b59e103f8ec6c1190ded21eef27bea01579220909c3968eeec37d46d2ed39e80

            SHA512

            07118f44b83d58f333bc4b853e9be66dffb3f7db8e65e0226975297bf5794ebdaa2c7a51ef84971faf4d4233a68a6b5e9ac02e737d16c0ac19a6cf65fad9443f

          • C:\Users\Admin\AppData\Local\Temp\_MEI17202\_hashlib.pyd

            Filesize

            63KB

            MD5

            1c88b53c50b5f2bb687b554a2fc7685d

            SHA1

            bfe6fdb8377498bbefcaad1e6b8805473a4ccbf3

            SHA256

            19dd3b5ebb840885543974a4cb6c8ea4539d76e3672be0f390a3a82443391778

            SHA512

            a312b11c85aaa325ab801c728397d5c7049b55fa00f24d30f32bf5cc0ad160678b40f354d9d5ec34384634950b5d6eda601e21934c929b4bc7f6ef50f16e3f59

          • C:\Users\Admin\AppData\Local\Temp\_MEI17202\_lzma.pyd

            Filesize

            155KB

            MD5

            bc07d7ac5fdc92db1e23395fde3420f2

            SHA1

            e89479381beeba40992d8eb306850977d3b95806

            SHA256

            ab822f7e846d4388b6f435d788a028942096ba1344297e0b7005c9d50814981b

            SHA512

            b6105333bb15e65afea3cf976b3c2a8a4c0ebb09ce9a7898a94c41669e666ccfa7dc14106992502abf62f1deb057e926e1fd3368f2a2817bbf6845eada80803d

          • C:\Users\Admin\AppData\Local\Temp\_MEI17202\_overlapped.pyd

            Filesize

            49KB

            MD5

            8b3d764024c447853b2f362a4e06cfc6

            SHA1

            a8fd99268cea18647bfa6592180186731bff6051

            SHA256

            ca131fc4a8c77daff8cff1b7e743b564745f6d2b4f9bb371b1286eb383c0692e

            SHA512

            720d58c3db8febd66e3bc372b7b0a409185e9722402ee49e038ade2141a70ec209b79cde7c4d67a90e5b3b35ed545b3400c8dbe73124299a266be2b036934e3e

          • C:\Users\Admin\AppData\Local\Temp\_MEI17202\_queue.pyd

            Filesize

            31KB

            MD5

            e0cc8c12f0b289ea87c436403bc357c1

            SHA1

            e342a4a600ef9358b3072041e66f66096fae4da4

            SHA256

            9517689d7d97816dee9e6c01ffd35844a3af6cde3ff98f3a709d52157b1abe03

            SHA512

            4d93f23db10e8640cd33e860241e7ea6a533daf64c36c4184844e6cca7b9f4bd41db007164a549e30f5aa9f983345318ff02d72815d51271f38c2e8750df4d77

          • C:\Users\Admin\AppData\Local\Temp\_MEI17202\_socket.pyd

            Filesize

            77KB

            MD5

            290dbf92268aebde8b9507b157bef602

            SHA1

            bea7221d7abbbc48840b46a19049217b27d3d13a

            SHA256

            e05c5342d55cb452e88e041061faba492d6dd9268a7f67614a8143540aca2bfe

            SHA512

            9ae02b75e722a736b2d76cec9c456d20f341327f55245fa6c5f78200be47cc5885cb73dc3e42e302c6f251922ba7b997c6d032b12a4a988f39bc03719f21d1a5

          • C:\Users\Admin\AppData\Local\Temp\_MEI17202\_ssl.pyd

            Filesize

            157KB

            MD5

            0a7eb5d67b14b983a38f82909472f380

            SHA1

            596f94c4659a055d8c629bc21a719ce441d8b924

            SHA256

            3bac94d8713a143095ef8e2f5d2b4a3765ebc530c8ca051080d415198cecf380

            SHA512

            3b78fd4c03ee1b670e46822a7646e668fbaf1ef0f2d4cd53ccfcc4abc2399fcc74822f94e60af13b3cdcb522783c008096b0b265dc9588000b7a46c0ed5973e1

          • C:\Users\Admin\AppData\Local\Temp\_MEI17202\_tkinter.pyd

            Filesize

            62KB

            MD5

            645b5b6d1b589d0fa165eaa4f94936bc

            SHA1

            20673a3768611b25ee2f56a92362e1ff60e344ba

            SHA256

            1af5a43b1051828f9cee087f6017456c4993a06db4b08ca205e3481cbf11112a

            SHA512

            688e43d2775905ddd1d9a3488ec8b66cc0a092a7267e799996b12b69500ba928cd1c58ff3517486c1be90938d0e1bb2192d8641f96710e703f5daae0bd30731c

          • C:\Users\Admin\AppData\Local\Temp\_MEI17202\_uuid.pyd

            Filesize

            24KB

            MD5

            a16b1acfdaadc7bb4f6ddf17659a8d12

            SHA1

            482982d623d88627c447f96703e4d166f9e51db4

            SHA256

            8af17a746533844b0f1b8f15f612e1cf0df76ac8f073388e80cfc60759e94de0

            SHA512

            03d65f37efc6aba325109b5a982be71380210d41dbf8c068d6a994228888d805adac1264851cc6f378e61c3aff1485cc6c059e83218b239397eda0cec87bd533

          • C:\Users\Admin\AppData\Local\Temp\_MEI17202\aiohttp\_helpers.cp311-win_amd64.pyd

            Filesize

            37KB

            MD5

            4b5dcc46170e4ac810a59ca5b7533462

            SHA1

            1eacf60fdfd427909b54f83518612a4638930225

            SHA256

            704cdcfca773ac658b8f84335f29630707c216f739f7fa5970b1be57f13a5b82

            SHA512

            c2e5b9b40f267f375234be9a562882faa1a0e82f32a951233464d27879d0b1620099bb800de3e96be277bb3bb44ff421a98a2f0c125f28652c2b6415d0fb4dea

          • C:\Users\Admin\AppData\Local\Temp\_MEI17202\aiohttp\_http_parser.cp311-win_amd64.pyd

            Filesize

            203KB

            MD5

            a7b4711c5ba1866745485abe14101ac7

            SHA1

            c37158cbd0fe67f8acd61596f63cf62bd2985431

            SHA256

            6688f3dd5b7efa8008c5ba776f32cecf5b42887b1b9ee21555ae3e0d4f13d2e0

            SHA512

            f952ad3c21b649e13e64540713a61db6d49b394ca5d62add7a5fec2186a8d27131ba038d449561b77670d3deb2358a8254e4e205ef20228e27b1eb8234d0e843

          • C:\Users\Admin\AppData\Local\Temp\_MEI17202\aiohttp\_http_writer.cp311-win_amd64.pyd

            Filesize

            34KB

            MD5

            2f2a2b2343549e990419df0977e3fac9

            SHA1

            5724b63e32bda7d36285f79dc9ad57fc97ba5415

            SHA256

            9569b0b501a0235388d075baa4c84e5d571169ac6ce3ae9220cde31a5f208b94

            SHA512

            a1b99dcaf01666c3ab9755d55001f3a18344cd70c386ce1b2233b5c6b8248b59d95804b450f9ee9c2f51d6293c4e748b9347540ae3f247418a1673bbd6ef466a

          • C:\Users\Admin\AppData\Local\Temp\_MEI17202\aiohttp\_websocket.cp311-win_amd64.pyd

            Filesize

            23KB

            MD5

            aa40ac7a7d1d9a10da426701ea49508d

            SHA1

            bbd083535e20ea00bcc40de7b9e625ff5c74851e

            SHA256

            b892cbaf1a5b363fb66768194cd4d466916e81981bcb63c2989277114a4b0c10

            SHA512

            eaf14159f5f1b70dcb5e6416804f306ec5f4c235abf431a27bc421861117be8c6ec5326c8c703c4c3764b771e5dbac37e6b93ac05f9a632bc83788c476eed8e2

          • C:\Users\Admin\AppData\Local\Temp\_MEI17202\base_library.zip

            Filesize

            1.7MB

            MD5

            948430bbba768d83a37fc725d7d31fbb

            SHA1

            e00d912fe85156f61fd8cd109d840d2d69b9629b

            SHA256

            65ebc074b147d65841a467a49f30a5f2f54659a0cc5dc31411467263a37c02df

            SHA512

            aad73403964228ed690ce3c5383e672b76690f776d4ff38792544c67e6d7b54eb56dd6653f4a89f7954752dae78ca35f738e000ffff07fdfb8ef2af708643186

          • C:\Users\Admin\AppData\Local\Temp\_MEI17202\charset_normalizer\md.cp311-win_amd64.pyd

            Filesize

            10KB

            MD5

            b7262254fcc94b031065cee9ef965983

            SHA1

            3d2be33ff9a8ecfaaa5ee25d99cfc21a2f3544a9

            SHA256

            8d1c0618dc9d666de3df50884246ff534d79eb29a9bcf9f04f618f2e0a7ac4e5

            SHA512

            5df83f7dacc6821177f8f9a8c13f1a995ae136349685504dcb7745969bf7ce3d1d13b24df266086855bf567cb7bac407c6c3703c991526bc3f6b6d486eb627d7

          • C:\Users\Admin\AppData\Local\Temp\_MEI17202\charset_normalizer\md__mypyc.cp311-win_amd64.pyd

            Filesize

            113KB

            MD5

            c16b82c4312e882d7acd36621e5d0e01

            SHA1

            9ab05e1da7954bead989d5897ba645a4d0317f9f

            SHA256

            7eabcaaa64b60b64b47e513b253d5c92ce527a3426da6108899390d07b308433

            SHA512

            bd3d595b431744ad8960c83f2a1f62023846306a61ae07bd6c8309956726ef8a6cb5388c123ac4288f868db254171df0f2ae40da07f97e8f2b48de3b6e6323a9

          • C:\Users\Admin\AppData\Local\Temp\_MEI17202\frozenlist\_frozenlist.cp311-win_amd64.pyd

            Filesize

            50KB

            MD5

            34c2dd52c9e920e035444d6cbddeb555

            SHA1

            3ff99987b968261e88032652917f137d4a6a0493

            SHA256

            55814d323ee1ec6cd6145ae8f43dbf44d9481e3592aa17b5a17010f7e401ff42

            SHA512

            8f0be0a3e2588bdeff9f5c4eb728ae43a58a19b91596adca0c931d5425a591178f13dcef68b1b949a2c805e1b9963800397f661688fd3c299d7084efe45adaf7

          • C:\Users\Admin\AppData\Local\Temp\_MEI17202\libcrypto-1_1.dll

            Filesize

            3.3MB

            MD5

            80b72c24c74d59ae32ba2b0ea5e7dad2

            SHA1

            75f892e361619e51578b312605201571bfb67ff8

            SHA256

            eb975c94e5f4292edd9a8207e356fe4ea0c66e802c1e9305323d37185f85ad6d

            SHA512

            08014ee480b5646362c433b82393160edf9602e4654e12cd9b6d3c24e98c56b46add9bf447c2301a2b2e782f49c444cb8e37ee544f38330c944c87397bdd152a

          • C:\Users\Admin\AppData\Local\Temp\_MEI17202\libffi-8.dll

            Filesize

            37KB

            MD5

            d86a9d75380fab7640bb950aeb05e50e

            SHA1

            1c61aaf9022cd1f09a959f7b2a65fb1372d187d7

            SHA256

            68fba9dd89bfad35f8fd657b9af22a8aebda31bffda35058a7f5ae376136e89b

            SHA512

            18437e64061221be411a1587f634b4b8efa60e661dbc35fd96a6d0e7eff812752de0ada755c01f286efefc47fb5f2daf07953b4cfc4119121b6bee7756c88d0f

          • C:\Users\Admin\AppData\Local\Temp\_MEI17202\libssl-1_1.dll

            Filesize

            686KB

            MD5

            86f2d9cc8cc54bbb005b15cabf715e5d

            SHA1

            396833cba6802cb83367f6313c6e3c67521c51ad

            SHA256

            d98dd943517963fd0e790fde00965822aa4e4a48e8a479afad74abf14a300771

            SHA512

            0013d487173b42e669a13752dc8a85b838c93524f976864d16ec0d9d7070d981d129577eda497d4fcf66fc6087366bd320cff92ead92ab79cfcaa946489ac6cb

          • C:\Users\Admin\AppData\Local\Temp\_MEI17202\multidict\_multidict.cp311-win_amd64.pyd

            Filesize

            45KB

            MD5

            b92f8efb672c383ab60b971b3c6c87de

            SHA1

            acb671089a01d7f1db235719c52e6265da0f708f

            SHA256

            b7376b5d729115a06b1cab60b251df3efc3051ebba31524ea82f0b8db5a49a72

            SHA512

            680663d6c6cd7b9d63160c282f6d38724bd8b8144d15f430b28b417dda0222bfff7afefcb671e863d1b4002b154804b1c8af2d8a28fff11fa94972b207df081b

          • C:\Users\Admin\AppData\Local\Temp\_MEI17202\pyexpat.pyd

            Filesize

            194KB

            MD5

            c5c1ca1b3641772e661f85ef0166fd6c

            SHA1

            759a34eca7efa25321a76788fb7df74cfac9ee59

            SHA256

            3d81d06311a8a15967533491783ea9c7fc88d594f40eee64076723cebdd58928

            SHA512

            4f0d2a6f15ebeeb4f9151827bd0c2120f3ca17e07fca4d7661beece70fdcf1a0e4c4ff5300251f2550451f98ea0fdbf45e8903225b7d0cb8da2851cdf62cb8d0

          • C:\Users\Admin\AppData\Local\Temp\_MEI17202\python3.DLL

            Filesize

            65KB

            MD5

            2ad3039bd03669f99e948f449d9f778b

            SHA1

            dae8f661990c57adb171667b9206c8d84c50ecad

            SHA256

            852b901e17022c437f8fc3039a5af2ee80c5d509c9ef5f512041af17c48fcd61

            SHA512

            8ffeaa6cd491d7068f9176fd628002c84256802bd47a17742909f561ca1da6a2e7c600e17cd983063e8a93c2bbe9b981bd43e55443d28e32dfb504d7f1e120c0

          • C:\Users\Admin\AppData\Local\Temp\_MEI17202\python311.dll

            Filesize

            5.5MB

            MD5

            1fe47c83669491bf38a949253d7d960f

            SHA1

            de5cc181c0e26cbcb31309fe00d9f2f5264d2b25

            SHA256

            0a9f2c98f36ba8974a944127b5b7e90e638010e472f2eb6598fc55b1bda9e7ae

            SHA512

            05cc6f00db128fbca02a14f60f86c049855f429013f65d91e14ea292d468bf9bfdeebc00ec2d54a9fb5715743a57ae3ab48a95037016240c02aabe4bfa1a2ff4

          • C:\Users\Admin\AppData\Local\Temp\_MEI17202\select.pyd

            Filesize

            29KB

            MD5

            4ac28414a1d101e94198ae0ac3bd1eb8

            SHA1

            718fbf58ab92a2be2efdb84d26e4d37eb50ef825

            SHA256

            b5d4d5b6da675376bd3b2824d9cda957b55fe3d8596d5675381922ef0e64a0f5

            SHA512

            2ac15e6a178c69115065be9d52c60f8ad63c2a8749af0b43634fc56c20220afb9d2e71ebed76305d7b0dcf86895ed5cdfb7d744c3be49122286b63b5ebce20c2

          • C:\Users\Admin\AppData\Local\Temp\_MEI17202\tcl86t.dll

            Filesize

            1.8MB

            MD5

            ac6cd2fb2cd91780db186b8d6e447b7c

            SHA1

            b387b9b6ca5f0a2b70028ab2147789c4fe24ef7a

            SHA256

            a91781fe13548b89817462b00058a75fb0b607ec8ce99d265719ced573ade7b6

            SHA512

            45b24ca07a44d8d90e5efeded2697a37f000b39d305fe63a67292fdd237de3f8efd5e85b139b5702faa695f9f27f12f24ac497e005e2f3c24c141d7cd85305b6

          • C:\Users\Admin\AppData\Local\Temp\_MEI17202\tk86t.dll

            Filesize

            1.5MB

            MD5

            499fa3dea045af56ee5356c0ce7d6ce2

            SHA1

            0444b7d4ecd25491245824c17b84916ee5b39f74

            SHA256

            20139f4c327711baf18289584fa0c8112f7bb3ba55475bded21f3d107672ed94

            SHA512

            d776749effa241ba1415b28d2fcff1d64ed903569a8c4e56dfddd672a53b2f44119734b1959b72a9b3f4060bb2c67b7dea959cc2d4a8e9f781f17009c6840fc1

          • C:\Users\Admin\AppData\Local\Temp\_MEI17202\unicodedata.pyd

            Filesize

            1.1MB

            MD5

            2ab7e66dff1893fea6f124971221a2a9

            SHA1

            3be5864bc4176c552282f9da5fbd70cc1593eb02

            SHA256

            a5db7900ecd5ea5ab1c06a8f94b2885f00dd2e1adf34bcb50c8a71691a97804f

            SHA512

            985480fffcc7e1a25c0070f44492744c3820334a35b9a72b9147898395ab60c7a73ea8bbc761de5cc3b6f8799d07a96c2880a7b56953249230b05dd59a1390ad

          • C:\Users\Admin\AppData\Local\Temp\_MEI17202\yarl\_quoting_c.cp311-win_amd64.pyd

            Filesize

            65KB

            MD5

            3b17f066462f21ae637f8be73e1f82b0

            SHA1

            f11920db843195975d877465f995b81ee3c3903e

            SHA256

            a9a4b2db416877b7ad9daece9fc9cbd500283bf47c198261343b86d7ed065c18

            SHA512

            eb15cb56500c6a02d75f6d29c288e1db47ab08d16cd0286491b90c2ec7f0f8776e62e615c8d05a708dbf927de8711459d684b90d13fba9fee2e5703f29e7656f