Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3ElectronV3.rar
windows7-x64
3ElectronV3.rar
windows10-2004-x64
3ElectronV3...V3.exe
windows7-x64
7ElectronV3...V3.exe
windows10-2004-x64
10Stub.pyc
windows7-x64
3Stub.pyc
windows10-2004-x64
3ElectronV3...ee.txt
windows7-x64
1ElectronV3...ee.txt
windows10-2004-x64
1ElectronV3...ld.txt
windows7-x64
1ElectronV3...ld.txt
windows10-2004-x64
ElectronV3..._FE.iy
windows7-x64
3ElectronV3..._FE.iy
windows10-2004-x64
3Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
31/08/2024, 14:40
Behavioral task
behavioral1
Sample
ElectronV3.rar
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
ElectronV3.rar
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
ElectronV3/ElectronV3.exe
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
ElectronV3/ElectronV3.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
Stub.pyc
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
Stub.pyc
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
ElectronV3/bin/agree.txt
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
ElectronV3/bin/agree.txt
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
ElectronV3/scripts/Inf Yield.txt
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
ElectronV3/scripts/Inf Yield.txt
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
ElectronV3/workspace/IY_FE.iy
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
ElectronV3/workspace/IY_FE.iy
Resource
win10v2004-20240802-en
General
-
Target
ElectronV3/ElectronV3.exe
-
Size
11.1MB
-
MD5
dd50ab40bc0ceeea383c132cc9ea965c
-
SHA1
c0ede9f69a2fcd7965e980654413854804e48ff9
-
SHA256
ebd33124981919a44841c9e215f91f622843ab2ea0c96cf1bcd44a82feb4dc1f
-
SHA512
fdec36007807500ae41b0afd400ef6727edb2ecd40646c41e76fbf4e6a86e49fab580fee57601972005adc0cbf7cda3be06d10e7da07deb7798dac8b887d098c
-
SSDEEP
196608:iW4JauwOFC/PAGJb3tQk5tieNvX+wfm/pf+xfdkRUyTlKArwWOtW0DaF1H:WIusAG7v5ttvX+9/pWFGRBAArwWIRajH
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2720 ElectronV3.exe -
resource yara_rule behavioral3/files/0x0005000000019532-41.dat upx behavioral3/memory/2720-43-0x000007FEF6360000-0x000007FEF6948000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2136 wrote to memory of 2720 2136 ElectronV3.exe 30 PID 2136 wrote to memory of 2720 2136 ElectronV3.exe 30 PID 2136 wrote to memory of 2720 2136 ElectronV3.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\ElectronV3\ElectronV3.exe"C:\Users\Admin\AppData\Local\Temp\ElectronV3\ElectronV3.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\ElectronV3\ElectronV3.exe"C:\Users\Admin\AppData\Local\Temp\ElectronV3\ElectronV3.exe"2⤵
- Loads dropped DLL
PID:2720
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD5db09c9bbec6134db1766d369c339a0a1
SHA1c156d9f2d0e80b4cf41794cd9b8b1e8a352e0a0b
SHA256b1aac1e461174bbae952434e4dac092590d72b9832a04457c94bd9bb7ee8ad79
SHA512653a7fff6a2b6bffb9ea2c0b72ddb83c9c53d555e798eea47101b0d932358180a01af2b9dab9c27723057439c1eaffb8d84b9b41f6f9cd1c3c934f1794104d45