Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

11/10/2024, 15:01

241011-sdwa2ayblh 7

02/10/2024, 03:16

241002-dsqa1avapn 8

02/10/2024, 03:04

241002-dkt9zsxfna 7

02/10/2024, 02:53

241002-ddfg9axcpa 7

02/10/2024, 02:33

241002-c15vzssgkp 7

Analysis

  • max time kernel
    104s
  • max time network
    20s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    02/10/2024, 03:04

General

  • Target

    MKMA.exe

  • Size

    132.8MB

  • MD5

    26210a8c2404f926deeaff3a0b078650

  • SHA1

    036222021f2905127521b863d3b45a57d377996c

  • SHA256

    11268095435c4f1de4e84c48b39db70f6f405c5d9619b8f4708d2accdb6c878a

  • SHA512

    6a6c590bb314ecb8c52fc466020226ff472ead6ac1564d0dd71ec20568a22acc95709fb92bbd4d8d9233f295ca2e2c9e3d0d2822a441fa3b2d595353437d8205

  • SSDEEP

    3145728:b6mC1E0qtOU9SC++6y9MgYR5tyJb2PlRy3gWINvmbcad:boHqtOnC4y9Mx5u27PNkca

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MKMA.exe
    "C:\Users\Admin\AppData\Local\Temp\MKMA.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2564
    • C:\Users\Admin\AppData\Local\Temp\MKMA.exe
      "C:\Users\Admin\AppData\Local\Temp\MKMA.exe"
      2⤵
      • Loads dropped DLL
      PID:2960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI25642\pygame\tests\run_tests__tests\all_ok\fake_6_test.py

    Filesize

    899B

    MD5

    1298138791b1f707f862d39399f4aff7

    SHA1

    cb2c58d7ad6bc5093688ebc28f5411544c797133

    SHA256

    cc550db032e61fd3efa68f98129bdf5b6ada43203a10bfc15b70ae3f5d1820a5

    SHA512

    bbe5517e97ffb388848817941a0c80e1e1af9d7887dba072ced6f1bb8b1b4b3b84ed73d2602ebeb7811a85c21c11b5bf891015a170cb64b9c3e50ead10c94e63

  • C:\Users\Admin\AppData\Local\Temp\_MEI25642\pygame\tests\run_tests__tests\failures1\__init__.py

    Filesize

    8B

    MD5

    d5b0eaf0ea4aa52b0dab64b782f42a29

    SHA1

    36610e835a94dc7a61ef9309348a9561774ea896

    SHA256

    f7ff302fd49cbfcfc2b3c1c9c891c6bf1d6fc1712bb2ebe5b00a8d64b709411d

    SHA512

    70241fcf496c6c14019c9611d0c9597a4ab4e4fea249a17702a9d255a701852008d6a530fc9f5df59f2e9b6b6f8b915545d1caccb919e2c2d9649c7295442e8d

  • C:\Users\Admin\AppData\Local\Temp\_MEI25642\python312.dll

    Filesize

    6.6MB

    MD5

    cae8fa4e7cb32da83acf655c2c39d9e1

    SHA1

    7a0055588a2d232be8c56791642cb0f5abbc71f8

    SHA256

    8ad53c67c2b4db4387d5f72ee2a3ca80c40af444b22bf41a6cfda2225a27bb93

    SHA512

    db2190da2c35bceed0ef91d7553ff0dea442286490145c3d0e89db59ba1299b0851e601cc324b5f7fd026414fc73755e8eff2ef5fb5eeb1c54a9e13e7c66dd0c

  • C:\Users\Admin\AppData\Local\Temp\_MEI25642\setuptools-74.1.2.dist-info\INSTALLER

    Filesize

    4B

    MD5

    365c9bfeb7d89244f2ce01c1de44cb85

    SHA1

    d7a03141d5d6b1e88b6b59ef08b6681df212c599

    SHA256

    ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

    SHA512

    d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

  • C:\Users\Admin\AppData\Local\Temp\_MEI25642\setuptools\_vendor\jaraco.functools-4.0.1.dist-info\LICENSE

    Filesize

    1023B

    MD5

    141643e11c48898150daa83802dbc65f

    SHA1

    0445ed0f69910eeaee036f09a39a13c6e1f37e12

    SHA256

    86da0f01aeae46348a3c3d465195dc1ceccde79f79e87769a64b8da04b2a4741

    SHA512

    ef62311602b466397baf0b23caca66114f8838f9e78e1b067787ceb709d09e0530e85a47bbcd4c5a0905b74fdb30df0cc640910c6cc2e67886e5b18794a3583f

  • C:\Users\Admin\AppData\Local\Temp\_MEI25642\setuptools\_vendor\jaraco.text-3.12.1.dist-info\WHEEL

    Filesize

    92B

    MD5

    43136dde7dd276932f6197bb6d676ef4

    SHA1

    6b13c105452c519ea0b65ac1a975bd5e19c50122

    SHA256

    189eedfe4581172c1b6a02b97a8f48a14c0b5baa3239e4ca990fbd8871553714

    SHA512

    e7712ba7d36deb083ebcc3b641ad3e7d19fb071ee64ae3a35ad6a50ee882b20cd2e60ca1319199df12584fe311a6266ec74f96a3fb67e59f90c7b5909668aee1