Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    02/12/2024, 23:05

General

  • Target

    Bootstrapper.exe

  • Size

    81.0MB

  • MD5

    8e4459028b7b17ef356a8be2ad50c8ed

  • SHA1

    084c9494f68755bc64e0fceb97834af2ccfec5d6

  • SHA256

    f1e72b5329dc4d9f7c459aea493d8c59bd0521d82129d168bf7d155924b768c6

  • SHA512

    fc60a89d0516d38fa75bfbd45cc3edd483d8d879e20b7c885bbba1b839caa9e6aaa121b14b164e02dc4f3f189f58980eb0952b85f22c433237e42457a224d0ad

  • SSDEEP

    1572864:AGKlEWvsmwSk8IpG7V+VPhqYdfmE7FliwiYgj+h58sMwGybhiDENjwJq:5KeysmwSkB05awcfNwy5SybGW

Score
7/10
upx

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
    "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2644
    • C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
      "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
      2⤵
      • Loads dropped DLL
      PID:1284

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI26442\python311.dll

    Filesize

    1.6MB

    MD5

    548809b87186356c7ac6421562015915

    SHA1

    8fa683eed7f916302c2eb1a548c12118bea414fa

    SHA256

    6c65da37cf6464507ad9d187a34f5b5d61544b83d831547642d17c01852599a1

    SHA512

    c0b63bf9908e23457cf6c2551219c7951bc1a164f3a585cde750b244fa628753ee43fde35f2aa76223fd9f90cf5ea582241ab510f7373a247eae0b26817198fc

  • memory/1284-1266-0x000007FEF6180000-0x000007FEF6772000-memory.dmp

    Filesize

    5.9MB