Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
11/10/2024, 15:01
241011-sdwa2ayblh 702/10/2024, 03:16
241002-dsqa1avapn 802/10/2024, 03:04
241002-dkt9zsxfna 702/10/2024, 02:53
241002-ddfg9axcpa 702/10/2024, 02:33
241002-c15vzssgkp 7Analysis
-
max time kernel
104s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02/10/2024, 03:04
Behavioral task
behavioral1
Sample
MKMA.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
MKMA.exe
Resource
win10v2004-20240802-en
General
-
Target
MKMA.exe
-
Size
132.8MB
-
MD5
26210a8c2404f926deeaff3a0b078650
-
SHA1
036222021f2905127521b863d3b45a57d377996c
-
SHA256
11268095435c4f1de4e84c48b39db70f6f405c5d9619b8f4708d2accdb6c878a
-
SHA512
6a6c590bb314ecb8c52fc466020226ff472ead6ac1564d0dd71ec20568a22acc95709fb92bbd4d8d9233f295ca2e2c9e3d0d2822a441fa3b2d595353437d8205
-
SSDEEP
3145728:b6mC1E0qtOU9SC++6y9MgYR5tyJb2PlRy3gWINvmbcad:boHqtOnC4y9Mx5u27PNkca
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2960 MKMA.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2564 wrote to memory of 2960 2564 MKMA.exe 29 PID 2564 wrote to memory of 2960 2564 MKMA.exe 29 PID 2564 wrote to memory of 2960 2564 MKMA.exe 29
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
899B
MD51298138791b1f707f862d39399f4aff7
SHA1cb2c58d7ad6bc5093688ebc28f5411544c797133
SHA256cc550db032e61fd3efa68f98129bdf5b6ada43203a10bfc15b70ae3f5d1820a5
SHA512bbe5517e97ffb388848817941a0c80e1e1af9d7887dba072ced6f1bb8b1b4b3b84ed73d2602ebeb7811a85c21c11b5bf891015a170cb64b9c3e50ead10c94e63
-
Filesize
8B
MD5d5b0eaf0ea4aa52b0dab64b782f42a29
SHA136610e835a94dc7a61ef9309348a9561774ea896
SHA256f7ff302fd49cbfcfc2b3c1c9c891c6bf1d6fc1712bb2ebe5b00a8d64b709411d
SHA51270241fcf496c6c14019c9611d0c9597a4ab4e4fea249a17702a9d255a701852008d6a530fc9f5df59f2e9b6b6f8b915545d1caccb919e2c2d9649c7295442e8d
-
Filesize
6.6MB
MD5cae8fa4e7cb32da83acf655c2c39d9e1
SHA17a0055588a2d232be8c56791642cb0f5abbc71f8
SHA2568ad53c67c2b4db4387d5f72ee2a3ca80c40af444b22bf41a6cfda2225a27bb93
SHA512db2190da2c35bceed0ef91d7553ff0dea442286490145c3d0e89db59ba1299b0851e601cc324b5f7fd026414fc73755e8eff2ef5fb5eeb1c54a9e13e7c66dd0c
-
Filesize
4B
MD5365c9bfeb7d89244f2ce01c1de44cb85
SHA1d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA256ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
SHA512d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
-
C:\Users\Admin\AppData\Local\Temp\_MEI25642\setuptools\_vendor\jaraco.functools-4.0.1.dist-info\LICENSE
Filesize1023B
MD5141643e11c48898150daa83802dbc65f
SHA10445ed0f69910eeaee036f09a39a13c6e1f37e12
SHA25686da0f01aeae46348a3c3d465195dc1ceccde79f79e87769a64b8da04b2a4741
SHA512ef62311602b466397baf0b23caca66114f8838f9e78e1b067787ceb709d09e0530e85a47bbcd4c5a0905b74fdb30df0cc640910c6cc2e67886e5b18794a3583f
-
Filesize
92B
MD543136dde7dd276932f6197bb6d676ef4
SHA16b13c105452c519ea0b65ac1a975bd5e19c50122
SHA256189eedfe4581172c1b6a02b97a8f48a14c0b5baa3239e4ca990fbd8871553714
SHA512e7712ba7d36deb083ebcc3b641ad3e7d19fb071ee64ae3a35ad6a50ee882b20cd2e60ca1319199df12584fe311a6266ec74f96a3fb67e59f90c7b5909668aee1