Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
437s -
max time network
1160s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
05/08/2024, 20:59
Behavioral task
behavioral1
Sample
Myro V5.6.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
Myro V5.6.exe
Resource
win11-20240802-en
Behavioral task
behavioral3
Sample
Multi-Tool.pyc
Resource
win10v2004-20240802-en
Behavioral task
behavioral4
Sample
Multi-Tool.pyc
Resource
win11-20240802-en
General
-
Target
Myro V5.6.exe
-
Size
20.2MB
-
MD5
83865dddb05aed591cbb87457fb275dc
-
SHA1
a2d1e9d0f36e9b97c080e17f573527ac7bcd302d
-
SHA256
58459374fb21debdc139b4b4396247ff369748b417622cb20d3c2b8900d96882
-
SHA512
b0c46ff2c35048d77f792a37a0cf2c6e9987d148144e84058d33e87146297aeac3f40a670761ce944db2c3fd10dc227a84103219f850bcaeab709bff6a9af7a7
-
SSDEEP
393216:JML/39QDD2xfaUX47d4hBaw22W8T26+J8IcVFz/CGdj4aD:JMLfdFaUI7d4hB22W8T6cV9b4a
Malware Config
Signatures
-
Loads dropped DLL 56 IoCs
pid Process 1640 Myro V5.6.exe 1640 Myro V5.6.exe 1640 Myro V5.6.exe 1640 Myro V5.6.exe 1640 Myro V5.6.exe 1640 Myro V5.6.exe 1640 Myro V5.6.exe 1640 Myro V5.6.exe 1640 Myro V5.6.exe 1640 Myro V5.6.exe 1640 Myro V5.6.exe 1640 Myro V5.6.exe 1640 Myro V5.6.exe 1640 Myro V5.6.exe 1640 Myro V5.6.exe 1640 Myro V5.6.exe 1640 Myro V5.6.exe 1640 Myro V5.6.exe 1640 Myro V5.6.exe 1640 Myro V5.6.exe 1640 Myro V5.6.exe 1640 Myro V5.6.exe 1640 Myro V5.6.exe 1640 Myro V5.6.exe 1640 Myro V5.6.exe 1640 Myro V5.6.exe 1640 Myro V5.6.exe 1640 Myro V5.6.exe 1640 Myro V5.6.exe 1640 Myro V5.6.exe 1640 Myro V5.6.exe 1640 Myro V5.6.exe 1640 Myro V5.6.exe 1640 Myro V5.6.exe 1640 Myro V5.6.exe 1640 Myro V5.6.exe 1640 Myro V5.6.exe 1640 Myro V5.6.exe 1640 Myro V5.6.exe 1640 Myro V5.6.exe 1640 Myro V5.6.exe 1640 Myro V5.6.exe 1640 Myro V5.6.exe 1640 Myro V5.6.exe 1640 Myro V5.6.exe 1640 Myro V5.6.exe 1640 Myro V5.6.exe 1640 Myro V5.6.exe 1640 Myro V5.6.exe 1640 Myro V5.6.exe 1640 Myro V5.6.exe 1640 Myro V5.6.exe 1640 Myro V5.6.exe 1640 Myro V5.6.exe 1640 Myro V5.6.exe 1640 Myro V5.6.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
flow ioc 2 discord.com 3 discord.com 4 discord.com 5 discord.com 6 discord.com 1 discord.com -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1720 wrote to memory of 1640 1720 Myro V5.6.exe 82 PID 1720 wrote to memory of 1640 1720 Myro V5.6.exe 82 PID 1640 wrote to memory of 2708 1640 Myro V5.6.exe 84 PID 1640 wrote to memory of 2708 1640 Myro V5.6.exe 84 PID 1640 wrote to memory of 2372 1640 Myro V5.6.exe 86 PID 1640 wrote to memory of 2372 1640 Myro V5.6.exe 86 PID 1640 wrote to memory of 852 1640 Myro V5.6.exe 88 PID 1640 wrote to memory of 852 1640 Myro V5.6.exe 88 PID 1640 wrote to memory of 3864 1640 Myro V5.6.exe 90 PID 1640 wrote to memory of 3864 1640 Myro V5.6.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\Myro V5.6.exe"C:\Users\Admin\AppData\Local\Temp\Myro V5.6.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\Myro V5.6.exe"C:\Users\Admin\AppData\Local\Temp\Myro V5.6.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵PID:2708
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:2372
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:852
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:3864
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
106KB
MD5870fea4e961e2fbd00110d3783e529be
SHA1a948e65c6f73d7da4ffde4e8533c098a00cc7311
SHA25676fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644
SHA5120b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88
-
Filesize
63KB
MD542b1b82a77f4179b66262475ba5a8332
SHA19f6c979e2c59e27cc1e7494fc1cc1b0536aa3c22
SHA2568ec1af6be27a49e3dc70075d0b5ef9255fad52cbbdab6a5072080085b4e45e89
SHA5122ee9fc9079714cb2ae2226c87c9c790b6f52b110667dbe0f1677eedb27335949b41df200daf7f67aa5c90db63e369b4904aac986c040706f8a3f542c44daf1d0
-
Filesize
82KB
MD5a8a37ba5e81d967433809bf14d34e81d
SHA1e4d9265449950b5c5a665e8163f7dda2badd5c41
SHA25650e21ce62f8d9bab92f6a7e9b39a86406c32d2df18408bb52ffb3d245c644c7b
SHA512b50f4334acb54a6fba776fc77ca07de4940810da4378468b3ca6f35d69c45121ff17e1f9c236752686d2e269bd0b7bce31d16506d3896b9328671049857ed979
-
Filesize
120KB
MD5496dcf8821ffc12f476878775999a8f3
SHA16b89b8fdd7cd610c08e28c3a14b34f751580cffd
SHA256b59e103f8ec6c1190ded21eef27bea01579220909c3968eeec37d46d2ed39e80
SHA51207118f44b83d58f333bc4b853e9be66dffb3f7db8e65e0226975297bf5794ebdaa2c7a51ef84971faf4d4233a68a6b5e9ac02e737d16c0ac19a6cf65fad9443f
-
Filesize
63KB
MD51c88b53c50b5f2bb687b554a2fc7685d
SHA1bfe6fdb8377498bbefcaad1e6b8805473a4ccbf3
SHA25619dd3b5ebb840885543974a4cb6c8ea4539d76e3672be0f390a3a82443391778
SHA512a312b11c85aaa325ab801c728397d5c7049b55fa00f24d30f32bf5cc0ad160678b40f354d9d5ec34384634950b5d6eda601e21934c929b4bc7f6ef50f16e3f59
-
Filesize
155KB
MD5bc07d7ac5fdc92db1e23395fde3420f2
SHA1e89479381beeba40992d8eb306850977d3b95806
SHA256ab822f7e846d4388b6f435d788a028942096ba1344297e0b7005c9d50814981b
SHA512b6105333bb15e65afea3cf976b3c2a8a4c0ebb09ce9a7898a94c41669e666ccfa7dc14106992502abf62f1deb057e926e1fd3368f2a2817bbf6845eada80803d
-
Filesize
49KB
MD58b3d764024c447853b2f362a4e06cfc6
SHA1a8fd99268cea18647bfa6592180186731bff6051
SHA256ca131fc4a8c77daff8cff1b7e743b564745f6d2b4f9bb371b1286eb383c0692e
SHA512720d58c3db8febd66e3bc372b7b0a409185e9722402ee49e038ade2141a70ec209b79cde7c4d67a90e5b3b35ed545b3400c8dbe73124299a266be2b036934e3e
-
Filesize
31KB
MD5e0cc8c12f0b289ea87c436403bc357c1
SHA1e342a4a600ef9358b3072041e66f66096fae4da4
SHA2569517689d7d97816dee9e6c01ffd35844a3af6cde3ff98f3a709d52157b1abe03
SHA5124d93f23db10e8640cd33e860241e7ea6a533daf64c36c4184844e6cca7b9f4bd41db007164a549e30f5aa9f983345318ff02d72815d51271f38c2e8750df4d77
-
Filesize
77KB
MD5290dbf92268aebde8b9507b157bef602
SHA1bea7221d7abbbc48840b46a19049217b27d3d13a
SHA256e05c5342d55cb452e88e041061faba492d6dd9268a7f67614a8143540aca2bfe
SHA5129ae02b75e722a736b2d76cec9c456d20f341327f55245fa6c5f78200be47cc5885cb73dc3e42e302c6f251922ba7b997c6d032b12a4a988f39bc03719f21d1a5
-
Filesize
157KB
MD50a7eb5d67b14b983a38f82909472f380
SHA1596f94c4659a055d8c629bc21a719ce441d8b924
SHA2563bac94d8713a143095ef8e2f5d2b4a3765ebc530c8ca051080d415198cecf380
SHA5123b78fd4c03ee1b670e46822a7646e668fbaf1ef0f2d4cd53ccfcc4abc2399fcc74822f94e60af13b3cdcb522783c008096b0b265dc9588000b7a46c0ed5973e1
-
Filesize
62KB
MD5645b5b6d1b589d0fa165eaa4f94936bc
SHA120673a3768611b25ee2f56a92362e1ff60e344ba
SHA2561af5a43b1051828f9cee087f6017456c4993a06db4b08ca205e3481cbf11112a
SHA512688e43d2775905ddd1d9a3488ec8b66cc0a092a7267e799996b12b69500ba928cd1c58ff3517486c1be90938d0e1bb2192d8641f96710e703f5daae0bd30731c
-
Filesize
24KB
MD5a16b1acfdaadc7bb4f6ddf17659a8d12
SHA1482982d623d88627c447f96703e4d166f9e51db4
SHA2568af17a746533844b0f1b8f15f612e1cf0df76ac8f073388e80cfc60759e94de0
SHA51203d65f37efc6aba325109b5a982be71380210d41dbf8c068d6a994228888d805adac1264851cc6f378e61c3aff1485cc6c059e83218b239397eda0cec87bd533
-
Filesize
37KB
MD54b5dcc46170e4ac810a59ca5b7533462
SHA11eacf60fdfd427909b54f83518612a4638930225
SHA256704cdcfca773ac658b8f84335f29630707c216f739f7fa5970b1be57f13a5b82
SHA512c2e5b9b40f267f375234be9a562882faa1a0e82f32a951233464d27879d0b1620099bb800de3e96be277bb3bb44ff421a98a2f0c125f28652c2b6415d0fb4dea
-
Filesize
203KB
MD5a7b4711c5ba1866745485abe14101ac7
SHA1c37158cbd0fe67f8acd61596f63cf62bd2985431
SHA2566688f3dd5b7efa8008c5ba776f32cecf5b42887b1b9ee21555ae3e0d4f13d2e0
SHA512f952ad3c21b649e13e64540713a61db6d49b394ca5d62add7a5fec2186a8d27131ba038d449561b77670d3deb2358a8254e4e205ef20228e27b1eb8234d0e843
-
Filesize
34KB
MD52f2a2b2343549e990419df0977e3fac9
SHA15724b63e32bda7d36285f79dc9ad57fc97ba5415
SHA2569569b0b501a0235388d075baa4c84e5d571169ac6ce3ae9220cde31a5f208b94
SHA512a1b99dcaf01666c3ab9755d55001f3a18344cd70c386ce1b2233b5c6b8248b59d95804b450f9ee9c2f51d6293c4e748b9347540ae3f247418a1673bbd6ef466a
-
Filesize
23KB
MD5aa40ac7a7d1d9a10da426701ea49508d
SHA1bbd083535e20ea00bcc40de7b9e625ff5c74851e
SHA256b892cbaf1a5b363fb66768194cd4d466916e81981bcb63c2989277114a4b0c10
SHA512eaf14159f5f1b70dcb5e6416804f306ec5f4c235abf431a27bc421861117be8c6ec5326c8c703c4c3764b771e5dbac37e6b93ac05f9a632bc83788c476eed8e2
-
Filesize
1.7MB
MD5948430bbba768d83a37fc725d7d31fbb
SHA1e00d912fe85156f61fd8cd109d840d2d69b9629b
SHA25665ebc074b147d65841a467a49f30a5f2f54659a0cc5dc31411467263a37c02df
SHA512aad73403964228ed690ce3c5383e672b76690f776d4ff38792544c67e6d7b54eb56dd6653f4a89f7954752dae78ca35f738e000ffff07fdfb8ef2af708643186
-
Filesize
10KB
MD5b7262254fcc94b031065cee9ef965983
SHA13d2be33ff9a8ecfaaa5ee25d99cfc21a2f3544a9
SHA2568d1c0618dc9d666de3df50884246ff534d79eb29a9bcf9f04f618f2e0a7ac4e5
SHA5125df83f7dacc6821177f8f9a8c13f1a995ae136349685504dcb7745969bf7ce3d1d13b24df266086855bf567cb7bac407c6c3703c991526bc3f6b6d486eb627d7
-
Filesize
113KB
MD5c16b82c4312e882d7acd36621e5d0e01
SHA19ab05e1da7954bead989d5897ba645a4d0317f9f
SHA2567eabcaaa64b60b64b47e513b253d5c92ce527a3426da6108899390d07b308433
SHA512bd3d595b431744ad8960c83f2a1f62023846306a61ae07bd6c8309956726ef8a6cb5388c123ac4288f868db254171df0f2ae40da07f97e8f2b48de3b6e6323a9
-
Filesize
50KB
MD534c2dd52c9e920e035444d6cbddeb555
SHA13ff99987b968261e88032652917f137d4a6a0493
SHA25655814d323ee1ec6cd6145ae8f43dbf44d9481e3592aa17b5a17010f7e401ff42
SHA5128f0be0a3e2588bdeff9f5c4eb728ae43a58a19b91596adca0c931d5425a591178f13dcef68b1b949a2c805e1b9963800397f661688fd3c299d7084efe45adaf7
-
Filesize
3.3MB
MD580b72c24c74d59ae32ba2b0ea5e7dad2
SHA175f892e361619e51578b312605201571bfb67ff8
SHA256eb975c94e5f4292edd9a8207e356fe4ea0c66e802c1e9305323d37185f85ad6d
SHA51208014ee480b5646362c433b82393160edf9602e4654e12cd9b6d3c24e98c56b46add9bf447c2301a2b2e782f49c444cb8e37ee544f38330c944c87397bdd152a
-
Filesize
37KB
MD5d86a9d75380fab7640bb950aeb05e50e
SHA11c61aaf9022cd1f09a959f7b2a65fb1372d187d7
SHA25668fba9dd89bfad35f8fd657b9af22a8aebda31bffda35058a7f5ae376136e89b
SHA51218437e64061221be411a1587f634b4b8efa60e661dbc35fd96a6d0e7eff812752de0ada755c01f286efefc47fb5f2daf07953b4cfc4119121b6bee7756c88d0f
-
Filesize
686KB
MD586f2d9cc8cc54bbb005b15cabf715e5d
SHA1396833cba6802cb83367f6313c6e3c67521c51ad
SHA256d98dd943517963fd0e790fde00965822aa4e4a48e8a479afad74abf14a300771
SHA5120013d487173b42e669a13752dc8a85b838c93524f976864d16ec0d9d7070d981d129577eda497d4fcf66fc6087366bd320cff92ead92ab79cfcaa946489ac6cb
-
Filesize
45KB
MD5b92f8efb672c383ab60b971b3c6c87de
SHA1acb671089a01d7f1db235719c52e6265da0f708f
SHA256b7376b5d729115a06b1cab60b251df3efc3051ebba31524ea82f0b8db5a49a72
SHA512680663d6c6cd7b9d63160c282f6d38724bd8b8144d15f430b28b417dda0222bfff7afefcb671e863d1b4002b154804b1c8af2d8a28fff11fa94972b207df081b
-
Filesize
194KB
MD5c5c1ca1b3641772e661f85ef0166fd6c
SHA1759a34eca7efa25321a76788fb7df74cfac9ee59
SHA2563d81d06311a8a15967533491783ea9c7fc88d594f40eee64076723cebdd58928
SHA5124f0d2a6f15ebeeb4f9151827bd0c2120f3ca17e07fca4d7661beece70fdcf1a0e4c4ff5300251f2550451f98ea0fdbf45e8903225b7d0cb8da2851cdf62cb8d0
-
Filesize
65KB
MD52ad3039bd03669f99e948f449d9f778b
SHA1dae8f661990c57adb171667b9206c8d84c50ecad
SHA256852b901e17022c437f8fc3039a5af2ee80c5d509c9ef5f512041af17c48fcd61
SHA5128ffeaa6cd491d7068f9176fd628002c84256802bd47a17742909f561ca1da6a2e7c600e17cd983063e8a93c2bbe9b981bd43e55443d28e32dfb504d7f1e120c0
-
Filesize
5.5MB
MD51fe47c83669491bf38a949253d7d960f
SHA1de5cc181c0e26cbcb31309fe00d9f2f5264d2b25
SHA2560a9f2c98f36ba8974a944127b5b7e90e638010e472f2eb6598fc55b1bda9e7ae
SHA51205cc6f00db128fbca02a14f60f86c049855f429013f65d91e14ea292d468bf9bfdeebc00ec2d54a9fb5715743a57ae3ab48a95037016240c02aabe4bfa1a2ff4
-
Filesize
29KB
MD54ac28414a1d101e94198ae0ac3bd1eb8
SHA1718fbf58ab92a2be2efdb84d26e4d37eb50ef825
SHA256b5d4d5b6da675376bd3b2824d9cda957b55fe3d8596d5675381922ef0e64a0f5
SHA5122ac15e6a178c69115065be9d52c60f8ad63c2a8749af0b43634fc56c20220afb9d2e71ebed76305d7b0dcf86895ed5cdfb7d744c3be49122286b63b5ebce20c2
-
Filesize
1.8MB
MD5ac6cd2fb2cd91780db186b8d6e447b7c
SHA1b387b9b6ca5f0a2b70028ab2147789c4fe24ef7a
SHA256a91781fe13548b89817462b00058a75fb0b607ec8ce99d265719ced573ade7b6
SHA51245b24ca07a44d8d90e5efeded2697a37f000b39d305fe63a67292fdd237de3f8efd5e85b139b5702faa695f9f27f12f24ac497e005e2f3c24c141d7cd85305b6
-
Filesize
1.5MB
MD5499fa3dea045af56ee5356c0ce7d6ce2
SHA10444b7d4ecd25491245824c17b84916ee5b39f74
SHA25620139f4c327711baf18289584fa0c8112f7bb3ba55475bded21f3d107672ed94
SHA512d776749effa241ba1415b28d2fcff1d64ed903569a8c4e56dfddd672a53b2f44119734b1959b72a9b3f4060bb2c67b7dea959cc2d4a8e9f781f17009c6840fc1
-
Filesize
1.1MB
MD52ab7e66dff1893fea6f124971221a2a9
SHA13be5864bc4176c552282f9da5fbd70cc1593eb02
SHA256a5db7900ecd5ea5ab1c06a8f94b2885f00dd2e1adf34bcb50c8a71691a97804f
SHA512985480fffcc7e1a25c0070f44492744c3820334a35b9a72b9147898395ab60c7a73ea8bbc761de5cc3b6f8799d07a96c2880a7b56953249230b05dd59a1390ad
-
Filesize
65KB
MD53b17f066462f21ae637f8be73e1f82b0
SHA1f11920db843195975d877465f995b81ee3c3903e
SHA256a9a4b2db416877b7ad9daece9fc9cbd500283bf47c198261343b86d7ed065c18
SHA512eb15cb56500c6a02d75f6d29c288e1db47ab08d16cd0286491b90c2ec7f0f8776e62e615c8d05a708dbf927de8711459d684b90d13fba9fee2e5703f29e7656f