Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    16/10/2024, 03:29

General

  • Target

    7dc19cd9e10dae9d9f54f3edd017b9f2defe65402dae8ad8a7e30144d94756dd.exe

  • Size

    13.1MB

  • MD5

    0482152b7f080e74b2e5db518939e0a9

  • SHA1

    4b95aae66aac2f96257aaad2d787d576d22cf95c

  • SHA256

    7dc19cd9e10dae9d9f54f3edd017b9f2defe65402dae8ad8a7e30144d94756dd

  • SHA512

    5f279410aeb31d45a2490bcd134906ae58df53c68e8e1d999cdd1244709d9d5d354af53227ffda253c30d026ca60c3d3df35b6bd14732bf45880bbb20564e262

  • SSDEEP

    393216:GckVr1+TtIiFg0VmRW8E5u6ayYwTE6V6:uF1QtI6mRW8IubyRED

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 7 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7dc19cd9e10dae9d9f54f3edd017b9f2defe65402dae8ad8a7e30144d94756dd.exe
    "C:\Users\Admin\AppData\Local\Temp\7dc19cd9e10dae9d9f54f3edd017b9f2defe65402dae8ad8a7e30144d94756dd.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2568
    • C:\Users\Admin\AppData\Local\Temp\7dc19cd9e10dae9d9f54f3edd017b9f2defe65402dae8ad8a7e30144d94756dd.exe
      "C:\Users\Admin\AppData\Local\Temp\7dc19cd9e10dae9d9f54f3edd017b9f2defe65402dae8ad8a7e30144d94756dd.exe"
      2⤵
      • Loads dropped DLL
      PID:2100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI25682\python312.dll

    Filesize

    6.6MB

    MD5

    d521654d889666a0bc753320f071ef60

    SHA1

    5fd9b90c5d0527e53c199f94bad540c1e0985db6

    SHA256

    21700f0bad5769a1b61ea408dc0a140ffd0a356a774c6eb0cc70e574b929d2e2

    SHA512

    7a726835423a36de80fb29ef65dfe7150bd1567cac6f3569e24d9fe091496c807556d0150456429a3d1a6fd2ed0b8ae3128ea3b8674c97f42ce7c897719d2cd3

  • C:\Users\Admin\AppData\Local\Temp\_MEI25682\ucrtbase.dll

    Filesize

    1.1MB

    MD5

    b0397bb83c9d579224e464eebf40a090

    SHA1

    81efdfe57225dfe581aafb930347535f08f2f4ce

    SHA256

    d2ebd8719455ae4634d00fd0d0eb0c3ad75054fee4ff545346a1524e5d7e3a66

    SHA512

    e72a4378ed93cfb3da60d69af8103a0dcb9a69a86ee42f004db29771b00a606fbc9cbc37f3daa155d1d5fe85f82c87ca9898a39c7274462fcf5c4420f0581ab3

  • \Users\Admin\AppData\Local\Temp\_MEI25682\api-ms-win-core-file-l1-2-0.dll

    Filesize

    20KB

    MD5

    b59d773b0848785a76baba82d3f775fa

    SHA1

    1b8dcd7f0e2ab0ba9ba302aa4e9c4bfa8da74a82

    SHA256

    0dc1f695befddb8ee52a308801410f2f1d115fc70668131075c2dbcfa0b6f9a0

    SHA512

    cbd52ed8a7471187d74367aa03bf097d9eac3e0d6dc64baf835744a09da0b050537ea6092dcb8b1e0365427e7f27315be2145c6f853ef936755ad07ef17d4a26

  • \Users\Admin\AppData\Local\Temp\_MEI25682\api-ms-win-core-file-l2-1-0.dll

    Filesize

    20KB

    MD5

    4c9bf992ae40c7460a029b1046a7fb5e

    SHA1

    79e13947af1d603c964cce3b225306cadff4058b

    SHA256

    18655793b4d489f769327e3c8710aced6b763c7873b6a8dc5ae6f28d228647f4

    SHA512

    c36d455ac79a73758f6090977c204764a88e929e8eaa7ce27a9c9920451c014e84ae98beb447e8345a8fa186b8c668b076c0ed27047a0e23ad2eeaf2cbc3a8d8

  • \Users\Admin\AppData\Local\Temp\_MEI25682\api-ms-win-core-localization-l1-2-0.dll

    Filesize

    20KB

    MD5

    9d8e7a90dd0d54b7ccde435b977ee46d

    SHA1

    15cd12089c63f4147648856b16193cf014e6764f

    SHA256

    dc570708327c4c8419d4cced2a162d7ca112a168301134dd1fb5e2040eee45b6

    SHA512

    339fe195602355bce26a2526613a212271e7f8c7518d591b9e3c795c154d93b29b8c524b2c3678c799d0ea0101eabea918564e49def0b915af0619e975f1c34b

  • \Users\Admin\AppData\Local\Temp\_MEI25682\api-ms-win-core-processthreads-l1-1-1.dll

    Filesize

    20KB

    MD5

    d399c926466f044f183faa723ba59120

    SHA1

    a9534b4910888d70eefba6fcc3376f2549cb4a05

    SHA256

    19b018be16afe143fb107ef1dd5b8e6c6cb45966806eb3d31ec09ff0dc2b70d1

    SHA512

    fc55f4cfe7c6c63e0720971d920c5c6ead4db74a671f7bb8dc830aa87cb54459a62e974456875bdfda449d82a0acb368e3b6c2cc20c32b1b407e8de7cc532057

  • \Users\Admin\AppData\Local\Temp\_MEI25682\api-ms-win-core-timezone-l1-1-0.dll

    Filesize

    20KB

    MD5

    ea5f768b9a1664884ae4ae62cec90678

    SHA1

    ae08e80431da7f4e8f1e5457c255cc360ef1cac0

    SHA256

    24f4530debf2161e0d0256f923b836aeccc3278a6ff2c9400e415600276b5a6d

    SHA512

    411db31e994ebbc69971972e45d6e51186d8f8790e8c67660b6a846e48a5a5c53a113916a5a15d14c33d8c88037d7f252135e699cb526c4bb3b5abd2e2dfee7c