Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
24/08/2024, 21:37
Behavioral task
behavioral1
Sample
source_prepared.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
source_prepared.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
misc.pyc
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
misc.pyc
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
source_prepared.pyc
Resource
win10-20240611-en
Behavioral task
behavioral6
Sample
source_prepared.pyc
Resource
win10v2004-20240802-en
General
-
Target
source_prepared.exe
-
Size
27.4MB
-
MD5
405d4b3d59e2059aa75f55db8f193e69
-
SHA1
5e405e7375c9b1b522adb4f8a362b17e7b6fd6b6
-
SHA256
c330400a2a7f8bccf3bcefbdd711519da9acfaeebdaab6c6a0f2ec7905a7eb99
-
SHA512
3901516690673fc5e31bd11b64c879f043387e50dddb9772ba4d210f873f9c10a7d77810836e4588c0f8e0ec2485e90a8976759423d1b2cb76bac36367db8d86
-
SSDEEP
786432:fMo1QtIG2j6+s7LWB75zuPNvYCI/qgKrwvg0C:3iIG2qHWB75iVHrwh
Malware Config
Signatures
-
Loads dropped DLL 33 IoCs
pid Process 2456 source_prepared.exe 2456 source_prepared.exe 2456 source_prepared.exe 2456 source_prepared.exe 2456 source_prepared.exe 2456 source_prepared.exe 2456 source_prepared.exe 2456 source_prepared.exe 2456 source_prepared.exe 2456 source_prepared.exe 2456 source_prepared.exe 2456 source_prepared.exe 2456 source_prepared.exe 2456 source_prepared.exe 2456 source_prepared.exe 2456 source_prepared.exe 2456 source_prepared.exe 2456 source_prepared.exe 2456 source_prepared.exe 2456 source_prepared.exe 2456 source_prepared.exe 2456 source_prepared.exe 2456 source_prepared.exe 2456 source_prepared.exe 2456 source_prepared.exe 2456 source_prepared.exe 2456 source_prepared.exe 2456 source_prepared.exe 2456 source_prepared.exe 2456 source_prepared.exe 2456 source_prepared.exe 2456 source_prepared.exe 2456 source_prepared.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 932 wrote to memory of 2456 932 source_prepared.exe 87 PID 932 wrote to memory of 2456 932 source_prepared.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"2⤵
- Loads dropped DLL
PID:2456
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
116KB
MD5be8dbe2dc77ebe7f88f910c61aec691a
SHA1a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA2564d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
SHA5120da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
-
Filesize
48KB
MD5f8dfa78045620cf8a732e67d1b1eb53d
SHA1ff9a604d8c99405bfdbbf4295825d3fcbc792704
SHA256a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5
SHA512ba7f8b7ab0deb7a7113124c28092b543e216ca08d1cf158d9f40a326fb69f4a2511a41a59ea8482a10c9ec4ec8ac69b70dfe9ca65e525097d93b819d498da371
-
Filesize
69KB
MD5cc0f232f2a8a359dee29a573667e6d77
SHA1d3ffbf5606d9c77a0de0b7456f7a5314f420b1f7
SHA2567a5c88ce496bafdf31a94ae6d70b017070703bc0a7da1dfae7c12b21bb61030d
SHA51248484177bf55179607d66f5a5837a35cd586e8a9fb185de8b10865aab650b056a61d1dc96370c5efc6955ccb4e34b31810f8e1c8f5f02d268f565a73b4ff5657
-
Filesize
83KB
MD5dd26ed92888de9c57660a7ad631bb916
SHA177d479d44d9e04f0a1355569332233459b69a154
SHA256324268786921ec940cbd4b5e2f71dafd08e578a12e373a715658527e5b211697
SHA512d693367565005c1b87823e781dc5925146512182c8d8a3a2201e712c88df1c0e66e65ecaec9af22037f0a8f8b3fb3f511ea47cfd5774651d71673fab612d2897
-
Filesize
175KB
MD5d8caf1c098db12b2eba8edae51f31c10
SHA1e533ac6c614d95c09082ae951b3b685daca29a8f
SHA256364208a97336f577d99bbaaed6d2cf8a4a24d6693b323de4665f75a964ca041d
SHA51277e36f4fb44374b7c58a9005a1d7dfeb3214eabb90786e8a7c6593b5b1c7a305d6aa446be7a06ae0ff38f2bedea68cacb39053b7b7ec297bff3571b3922fd938
-
Filesize
122KB
MD5c8afa1ebb28828e1115c110313d2a810
SHA11d0d28799a5dbe313b6f4ddfdb7986d2902fa97a
SHA2568978972cf341ccd0edf8435d63909a739df7ef29ec7dd57ed5cab64b342891f0
SHA5124d9f41bd23b62600d1eb097d1578ba656b5e13fd2f31ef74202aa511111969bb8cfc2a8e903de73bd6e63fadaa59b078714885b8c5b8ecc5c4128ff9d06c1e56
-
Filesize
251KB
MD5cea3b419c7ca87140a157629c6dbd299
SHA17dbff775235b1937b150ae70302b3208833dc9be
SHA25695b9850e6fb335b235589dd1348e007507c6b28e332c9abb111f2a0035c358e5
SHA5126e3a6781c0f05bb5182073cca1e69b6df55f05ff7cdcea394bacf50f88605e2241b7387f1d8ba9f40a96832d04f55edb80003f0cf1e537a26f99408ee9312f5b
-
Filesize
64KB
MD5d19cb5ca144ae1fd29b6395b0225cf40
SHA15b9ec6e656261ce179dfcfd5c6a3cfe07c2dfeb4
SHA256f95ec2562a3c70fb1a6e44d72f4223ce3c7a0f0038159d09dce629f59591d5aa
SHA5129ac3a8a4dbdb09be3760e7ccb11269f82a47b24c03d10d289bcdded9a43e57d3cd656f8d060d66b810382ecac3a62f101f83ea626b58cd0b5a3cca25b67b1519
-
Filesize
156KB
MD58cfbafe65d6e38dde8e2e8006b66bb3e
SHA1cb63addd102e47c777d55753c00c29c547e2243c
SHA2566d548db0ab73291f82cf0f4ca9ec0c81460185319c8965e829faeacae19444ff
SHA512fa021615d5c080aadcd5b84fd221900054eb763a7af8638f70cf6cd49bd92773074f1ac6884f3ce1d8a15d59439f554381377faee4842ed5beb13ff3e1b510f4
-
Filesize
34KB
MD5eb859fc7f54cba118a321440ad088096
SHA19d3c410240f4c5269e07ffbde43d6f5e7cc30b44
SHA25614bdd15d60b9d6141009aeedc606007c42b46c779a523d21758e57cf126dc2a4
SHA512694a9c1cc3dc78b47faedf66248ff078e5090cfab22e95c123fb99b10192a5748748a5f0937ffd9fd8e1873ad48f290be723fe194b7eb2a731add7f5fb776c4a
-
Filesize
54KB
MD5df92ea698a3d0729b70a4306bbe3029f
SHA1b82f3a43568148c64a46e2774aec39bf1f2d3c1e
SHA25646dec978ec8cb2146854739bfeddea93335dcc92a25d719352b94f9517855032
SHA512bdebafe1b40244a0cb6c97e75424f79cfe395774a9d03cdb02f82083110c1f4bdcac2819ba1845ad1c56e2d2e6506dcc1833e4eb269bb0f620f0eb73b4d47817
-
Filesize
31KB
MD57d91dd8e5f1dbc3058ea399f5f31c1e6
SHA1b983653b9f2df66e721ece95f086c2f933d303fc
SHA25676bba42b1392dc57a867aef385b990fa302a4f1dcf453705ac119c9c98a36e8d
SHA512b8e7369da79255a4bb2ed91ba0c313b4578ee45c94e6bc74582fc14f8b2984ed8fcda0434a5bd3b72ea704e6e8fd8cbf1901f325e774475e4f28961483d6c7cf
-
Filesize
81KB
MD5e43aed7d6a8bcd9ddfc59c2d1a2c4b02
SHA136f367f68fb9868412246725b604b27b5019d747
SHA2562c2a6a6ba360e38f0c2b5a53b4626f833a3111844d95615ebf35be0e76b1ef7a
SHA512d92e26eb88db891de389a464f850a8da0a39af8a4d86d9894768cb97182b8351817ce14fe1eb8301b18b80d1d5d8876a48ba66eb7b874c7c3d7b009fcdbc8c4e
-
Filesize
174KB
MD56a2b0f8f50b47d05f96deff7883c1270
SHA12b1aeb6fe9a12e0d527b042512fc8890eedb10d8
SHA25668dad60ff6fb36c88ef1c47d1855517bfe8de0f5ddea0f630b65b622a645d53a
SHA512a080190d4e7e1abb186776ae6e83dab4b21a77093a88fca59ce1f63c683f549a28d094818a0ee44186ddea2095111f1879008c0d631fc4a8d69dd596ef76ca37
-
Filesize
25KB
MD58f5402bb6aac9c4ff9b4ce5ac3f0f147
SHA187207e916d0b01047b311d78649763d6e001c773
SHA256793e44c75e7d746af2bb5176e46c454225f07cb27b1747f1b83d1748d81ad9ac
SHA51265fdef32aeba850aa818a8c8bf794100725a9831b5242350e6c04d0bca075762e1b650f19c437a17b150e9fca6ad344ec4141a041fa12b5a91652361053c7e81
-
Filesize
36KB
MD5bed7b0ced98fa065a9b8fe62e328713f
SHA1e329ebca2df8889b78ce666e3fb909b4690d2daa
SHA2565818679010bb536a3d463eeee8ce203e880a8cd1c06bf1cb6c416ab0dc024d94
SHA512c95f7bb6ca9afba50bf0727e971dff7326ce0e23a4bfa44d62f2ed67ed5fede1b018519dbfa0ed3091d485ed0ace68b52dd0bb2921c9c1e3bc1fa875cd3d2366
-
Filesize
1.3MB
MD5763d1a751c5d47212fbf0caea63f46f5
SHA1845eaa1046a47b5cf376b3dbefcf7497af25f180
SHA256378a4b40f4fa4a8229c93e0afee819085251af03402ccefa3b469651e50e60b7
SHA512bb356dd610e6035f4002671440ce96624addf9a89fd952a6419647a528a551a6ccd0eca0ee2eeb080d9aad683b5afc9415c721fa62c3bcddcb7f1923f59d9c45
-
Filesize
5.0MB
MD5e547cf6d296a88f5b1c352c116df7c0c
SHA1cafa14e0367f7c13ad140fd556f10f320a039783
SHA25605fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de
SHA5129f42edf04c7af350a00fa4fdf92b8e2e6f47ab9d2d41491985b20cd0adde4f694253399f6a88f4bdd765c4f49792f25fb01e84ec03fd5d0be8bb61773d77d74d
-
Filesize
38KB
MD50f8e4992ca92baaf54cc0b43aaccce21
SHA1c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA256eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
SHA5126e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
-
Filesize
768KB
MD519a2aba25456181d5fb572d88ac0e73e
SHA1656ca8cdfc9c3a6379536e2027e93408851483db
SHA2562e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006
SHA512df17dc8a882363a6c5a1b78ba3cf448437d1118ccc4a6275cc7681551b13c1a4e0f94e30ffb94c3530b688b62bff1c03e57c2c185a7df2bf3e5737a06e114337
-
C:\Users\Admin\AppData\Local\Temp\_MEI9322\numpy.libs\libopenblas64__v0.3.23-293-gc2f4bdbb-gcc_10_3_0-2bde3a66a51006b2b53eb373ff767a3f.dll
Filesize36.4MB
MD55e46c3d334c90c3029eb6ae2a3fe58f2
SHA1ad3d806f720289ccb90ce8bfd0da49fa99e7777b
SHA25657b87772bf676b5c2d718c79dddc9f039d79ec3319fee1398cc305adff7b69e5
SHA5124bd29d19b619076a64a928f3871edcce8416bcf100c1aa1250932479d6536d9497f2f9a2668c90b3479d0d4ab4234ffa06f81bc6b107fad1be5097fa2b60ab28
-
Filesize
64KB
MD5fb3b38cad2f01d3bc798bccdb258fe0d
SHA190578a26aba4323b742b0958bed7ffb7f65afc05
SHA256d9017d99e0b6cad2f02462420793551fe9e6b836f3a800228caaeed144a32b75
SHA512f2ae7fdb8b06fe2f45ec08b53b7ed0ff0f301592d824fb58be736aa82ef5450dc629d0f0f58203767c31ad6388204ff5a29643c7693773ab87a49d1464a789fe
-
Filesize
2.7MB
MD5d55532990dc349038161734250beb3c4
SHA1152720c327306b13df86649ac8b92291205d47f8
SHA2565d4f44389d1b4e9aa62af63b716a0d4266dbb56fefa9bf27831f85b695994da5
SHA512a3df71eb2dcfc00735f50c51d35db1cc41df9574c0da8bb3acc4071a1e426fbe6031214f6e651b3d8ecfda604f4dd7d5736b73e48a4f96e7051d1da23e6daa93
-
Filesize
107KB
MD512b5c60a32eba22968a38a6802756643
SHA1c6f9f0fa6383f70abc672b83c18ed0a57a4c4be8
SHA256f0a4df58721cb85ca35f5f3b8c47538c53d57bbcca4fc5c07a6c06ac4c5ef421
SHA512210f62d162a99881018f5c8103ca58826991aed70f39382cc59ee724976bd2655464b308fb52bb0c3fa7b8101379cd84d4e6430eaba0b65095ad11d53cda27a3
-
Filesize
104KB
MD566a39e43ea06165e3b1f85591b8d4166
SHA1f818c25e87e8212463d890d45d69262c02d718ee
SHA2567652e82c6c53249b911dde9822b71a7ecbecbc699c79475862e779a51d7f1d0f
SHA5125320c8cc93854c2764ce825741dcaa92f938d99d70e5557f1439135642eab0cb69d47f4b07418f9beabbdc21ba1b583b5c8d25a0259a08483d436f96c18da747
-
Filesize
226KB
MD5529b52c49b02bd2bea730864480deb5f
SHA1d6eb2734a5d56f1f2d8463b6bca5e15858533a86
SHA2560c19ec0b3129f12df51982aace8478f8274a5b0d6a2206be1d0e1ee0227c36a4
SHA5126a7d754f00211422083ccce2e45514474b3a11499540c1f2b10ccb618a029cdf649800fe339abf3d99d65712017b41710e2834488972c634240080d4093c170c
-
Filesize
162KB
MD5ad51d76ee240bd86a265b24c0b333a68
SHA1d01393a006a5296509e7229587781209ccdad5d4
SHA256774bf3e20e2b1ca9797deb1daccb88a776a70c8555a501454d8d900a14585134
SHA5125aae5f028dfe11eaab0487e8aa1f23e8247acb313a565f4fcd689e9cae36b3f8f82b03c343319f6c5df16cd7b3248f772f0e22eaa969d9505f13767d7f96e990
-
Filesize
74KB
MD5584feccdd6b1c2eae4542dd0b904b62f
SHA1ae03f9f6581691af5e20c9c08261b23281381cf5
SHA256592238b7a62fb033724cfd745be6036700f584d6c4ee8baf83cb77788320aa49
SHA5123cc3f16dbb016ca8fa1b77d5a6645c145ab6395094b684719a0e79d602f5fabeda703e93280751ed2ff6e1b6af022729e7266003c830fa11caa07264c8594fa1
-
Filesize
157KB
MD5a27d874d126df629614703f1134780e4
SHA199e381d2cd69ccdbfed7d849402431ea729779c5
SHA256d335d1443e324a7a89582cc3e85bd850198eb3133c3dd38c7f55c6f609b0cfd8
SHA512838183b2982749369aad8e0629d4fcd8de06be43c5fda4d679b69c1c3f4384f1c85c5fd5337e58ec77345edc58174cc03396e0037c870b2562ae622cccb5678e
-
Filesize
569KB
MD5ad162eb4f28e629f32406d20dd556a4c
SHA13036913134c3e7c464dc7c4785294845c877bf1e
SHA2562df309f3cc66116966484fcc466cef200aff8d2a4c8ea482d3530b5cccb89394
SHA512b0cd6357365e2b68ed9d6e9ef5f22b211851842c7d88fcd9da2fa9b5b3b4d78846432caf2a58dc786794a412dfa1cd185c609043563b25ab80b368a9b5aa2ade
-
Filesize
197KB
MD5815f1bdabb79c6a12b38d84aa343196d
SHA1916483149875a5e20c6046ceffef62dd6089ddd5
SHA25631712ae276e2ced05ecda3e1c08fbbcc2cff8474a972626aba55f7797f0ed8c9
SHA5121078e7e48b6f6ed160ae2bccf80a43a5f1cca769b8a690326e112bf20d7f3d018f855f6aa3b56d315dc0853472e0affcfe8e910b5ce69ce952983cfaa496c21d
-
Filesize
66KB
MD58dbe9bbf7118f4862e02cd2aaf43f1ab
SHA1935bc8c5cea4502d0facf0c49c5f2b9c138608ed
SHA25629f173e0147390a99f541ba0c0231fdd7dfbca84d0e2e561ef352bf1ec72f5db
SHA512938f8387dcc356012ac4a952d371664700b110f7111fcc24f5df7d79791ae95bad0dbaf77d2d6c86c820bfd48a6bdbe8858b7e7ae1a77df88e596556c7135ed4
-
Filesize
6.6MB
MD5cae8fa4e7cb32da83acf655c2c39d9e1
SHA17a0055588a2d232be8c56791642cb0f5abbc71f8
SHA2568ad53c67c2b4db4387d5f72ee2a3ca80c40af444b22bf41a6cfda2225a27bb93
SHA512db2190da2c35bceed0ef91d7553ff0dea442286490145c3d0e89db59ba1299b0851e601cc324b5f7fd026414fc73755e8eff2ef5fb5eeb1c54a9e13e7c66dd0c
-
Filesize
30KB
MD579ce1ae3a23dff6ed5fc66e6416600cd
SHA16204374d99144b0a26fd1d61940ff4f0d17c2212
SHA256678e09ad44be42fa9bc9c7a18c25dbe995a59b6c36a13eecc09c0f02a647b6f0
SHA512a4e48696788798a7d061c0ef620d40187850741c2bec357db0e37a2dd94d3a50f9f55ba75dc4d95e50946cbab78b84ba1fc42d51fd498640a231321566613daa
-
C:\Users\Admin\AppData\Local\Temp\_MEI9322\setuptools\_vendor\importlib_resources-6.4.0.dist-info\INSTALLER
Filesize4B
MD5365c9bfeb7d89244f2ce01c1de44cb85
SHA1d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA256ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
SHA512d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
-
Filesize
1023B
MD5141643e11c48898150daa83802dbc65f
SHA10445ed0f69910eeaee036f09a39a13c6e1f37e12
SHA25686da0f01aeae46348a3c3d465195dc1ceccde79f79e87769a64b8da04b2a4741
SHA512ef62311602b466397baf0b23caca66114f8838f9e78e1b067787ceb709d09e0530e85a47bbcd4c5a0905b74fdb30df0cc640910c6cc2e67886e5b18794a3583f
-
Filesize
92B
MD543136dde7dd276932f6197bb6d676ef4
SHA16b13c105452c519ea0b65ac1a975bd5e19c50122
SHA256189eedfe4581172c1b6a02b97a8f48a14c0b5baa3239e4ca990fbd8871553714
SHA512e7712ba7d36deb083ebcc3b641ad3e7d19fb071ee64ae3a35ad6a50ee882b20cd2e60ca1319199df12584fe311a6266ec74f96a3fb67e59f90c7b5909668aee1
-
Filesize
1KB
MD54ce7501f6608f6ce4011d627979e1ae4
SHA178363672264d9cd3f72d5c1d3665e1657b1a5071
SHA25637fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
SHA512a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
-
Filesize
1.1MB
MD5b848e259fabaf32b4b3c980a0a12488d
SHA1da2e864e18521c86c7d8968db74bb2b28e4c23e2
SHA256c65073b65f107e471c9be3c699fb11f774e9a07581f41229582f7b2154b6fc3c
SHA5124c6953504d1401fe0c74435bceebc5ec7bf8991fd42b659867a3529cee5cc64da54f1ab404e88160e747887a7409098f1a85a546bc40f12f0dde0025408f9e27