Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
56s -
max time network
29s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
-
submitted
09/10/2024, 23:24
General
-
Target
Mega.nz Spreader.exe
-
Size
8.5MB
-
MD5
56b45c6edd70b8d85df6399eea6d24d1
-
SHA1
15a65e88ec6dc89e35fef0c5e786ac255d6d4a6e
-
SHA256
70f06035e9cc9a891f2959b80e3be9bea2ba07b72bce4fac125249c29c0d9d1c
-
SHA512
55275a2511cbd72ce38732ae9d677b753bf813949338182fe2ecdaf026e7438e219bf287ee88805100ed8768377f63009c4b1655fd5de14c5db41501c16b96cc
-
SSDEEP
196608:P0akhW+OUggVe3hwHqxogDycV3B7+JULH9XO8WIu:P06+FZKxoM33YURc1
Malware Config
Signatures
-
Meduza
Meduza is a crypto wallet and info stealer written in C++.
-
Meduza Stealer payload 1 IoCs
-
Executes dropped EXE 5 IoCs
-
Loads dropped DLL 6 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Detects Pyinstaller 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of WriteProcessMemory 24 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Mega.nz Spreader.exe"C:\Users\Admin\AppData\Local\Temp\Mega.nz Spreader.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\leaf.exe"C:\Users\Admin\AppData\Local\Temp\leaf.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\leaf.exe"{path}"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C schtasks /create /tn \eOzNUSwmQA /tr "C:\Users\Admin\AppData\Roaming\eOzNUSwmQA\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn \eOzNUSwmQA /tr "C:\Users\Admin\AppData\Roaming\eOzNUSwmQA\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\api.exe"C:\Users\Admin\AppData\Local\Temp\api.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\lib.exe"C:\Users\Admin\AppData\Local\Temp\lib.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\lib.exe"C:\Users\Admin\AppData\Local\Temp\lib.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD528df963c88836df10a200a7f3ddcdaf2
SHA112c9058ad17a0a186021a145aad09fd32bb8fa2c
SHA256d61f44cb34af871284be7ca4dec205a1bf8ca747b2efbdb84a14e7df0ae3e85f
SHA5126c55ee17008aad1bec0abfd8ad48d5d86b3d371b62eed0418a1351ac1c747a1226fdb3edb46480d6da4bab9c7dab3a05bc8958cc7e83cfe00419afb7531cefff
-
Filesize
106KB
MD54585a96cc4eef6aafd5e27ea09147dc6
SHA1489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA256a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
SHA512d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286
-
Filesize
120KB
MD59b344f8d7ce5b57e397a475847cc5f66
SHA1aff1ccc2608da022ecc8d0aba65d304fe74cdf71
SHA256b1214d7b7efd9d4b0f465ec3463512a1cbc5f59686267030f072e6ce4b2a95cf
SHA5122b0d9e1b550bf108fa842324ab26555f2a224aefff517fdb16df85693e05adaf0d77ebe49382848f1ec68dc9b5ae75027a62c33721e42a1566274d1a2b1baa41
-
Filesize
77KB
MD526dd19a1f5285712068b9e41808e8fa0
SHA190c9a112dd34d45256b4f2ed38c1cbbc9f24dba5
SHA256eaabf6b78840daeaf96b5bdbf06adf0e4e2994dfeee5c5e27fefd824dbda5220
SHA512173e1eda05d297d7da2193e8566201f05428437adcac80aecefe80f82d46295b15ce10990b5c080325dc59a432a587eef84a15ec688a62b82493ad501a1e4520
-
Filesize
1.7MB
MD5ebb4f1a115f0692698b5640869f30853
SHA19ba77340a6a32af08899e7f3c97841724dd78c3f
SHA2564ab0deb6a298d14a0f50d55dc6ce5673b6c5320817ec255acf282191642a4576
SHA5123f6ba7d86c9f292344f4ad196f4ae863bf936578dd7cfac7dc4aaf05c2c78e68d5f813c4ed36048b6678451f1717deeb77493d8557ee6778c6a70beb5294d21a
-
Filesize
38KB
MD50f8e4992ca92baaf54cc0b43aaccce21
SHA1c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA256eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
SHA5126e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
-
Filesize
5.5MB
MD5e2bd5ae53427f193b42d64b8e9bf1943
SHA17c317aad8e2b24c08d3b8b3fba16dd537411727f
SHA256c4844b05e3a936b130adedb854d3c04d49ee54edb43e9d36f8c4ae94ccb78400
SHA512ae23a6707e539c619fd5c5b4fc6e4734edc91f89ebe024d25ff2a70168da6105ac0bd47cf6bf3715af6411963caf0acbb4632464e1619ca6361abf53adfe7036
-
Filesize
29KB
MD5756c95d4d9b7820b00a3099faf3f4f51
SHA1893954a45c75fb45fe8048a804990ca33f7c072d
SHA25613e4d9a734a453a3613e11b6a518430099ad7e3d874ea407d1f9625b7f60268a
SHA5120f54f0262cf8d71f00bf5666eb15541c6ecc5246cd298efd3b7dd39cdd29553a8242d204c42cfb28c537c3d61580153200373c34a94769f102b3baa288f6c398
-
Filesize
677KB
MD59022192413dda223b6e8afd73a22cfaa
SHA1dbfc6d6667fcc47daa13a317c8791a93f5e495b0
SHA256f575eb5246b5c6b9044ea04610528c040c982904a5fb3dc1909ce2f0ec15c9ef
SHA512d5311ba2138f184b44b73e63067e5446a77640bfe9f75c87e81935e120ee3ca1918ad3d36ebcf24ebadff0d9afec10ab1d3276d4b20d9821466ba8183c80b7ab
-
Filesize
630KB
MD58c8c3bcf475b5c95673a810b10a2fc52
SHA1268cb3a6a4194efb14c1bdc82cfab3485c64fa73
SHA2567f02583173f6e150677af6fe09226fa6b4fc9efa2523f393a89b31155a1122c0
SHA512f1948ce32f46a34e425d2f59f5c4e6de56cbc1e29ecfd706c95f4b00ec2831ccc21a44b81cd18d8d03fe6681463276cd4c8d31b19bff712574b1ff765bb4e846
-
Filesize
7.3MB
MD5d1540618704ecaca1a503b496ed7b801
SHA1047c0e7c3b0d03470177dfe17053fdb34ea378a4
SHA2561c864d2dec413df7d389bf89cc5b0f38c879a93c043a22c98570c1eea12099aa
SHA5128c91198512c946d1d0aa5583b8eaf96f111091e75ea26a853597b2791d44965e8005fc8e19267ce4cb7180b715968832d15af987dae7b6aaa1eef6b459f043b9
-
Filesize
4KB
-
Filesize
656KB
-
Filesize
40KB
-
Filesize
344KB
-
Filesize
584KB
-
Filesize
5.6MB
-
Filesize
624KB
-
Filesize
384KB
-
Filesize
80KB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
32KB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
32KB