Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

no name (2).exe

windows7-x64

7

no name (2).exe

windows10-2004-x64

8

Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    05/01/2025, 01:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    no name (2).exe

  • Size

    6.5MB

  • MD5

    09371d686d4f402f798fd1d80a90f17f

  • SHA1

    9edb34457c2941d31b646e11abd7bbec2a79fa6c

  • SHA256

    71c387334cd87ac32a494dca0c3aacf80b602cfb798085ca27214f0d7f225141

  • SHA512

    342e18098c887b0c35cd27d4293360aefbb8b78cf46806c2d80713195e5ff222205f8414b02a2ac4bbc3dba9f435de059d24ec10b468bd6d735d3b2c6bd06b36

  • SSDEEP

    196608:5JmD6nASmxZRHvUWvozWOxu9kXwvdbDlA03NhnZetJ8w3hULDN9:jGmAxxZRHdKbAlbZA03bZMZxAR9

Score
7/10
upx

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\no name (2).exe
    "C:\Users\Admin\AppData\Local\Temp\no name (2).exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2116
    • C:\Users\Admin\AppData\Local\Temp\no name (2).exe
      "C:\Users\Admin\AppData\Local\Temp\no name (2).exe"
      2⤵
      • Loads dropped DLL
      PID:2352
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:2440

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\_MEI21162\python310.dll
      Filesize

      1.4MB

      MD5

      b3ae142a88ff3760a852ba7facb901bc

      SHA1

      ad23e5f2f0cc6415086d8c8273c356d35fa4e3ee

      SHA256

      2291ce67c4be953a0b7c56d790b6cc8075ec8166b1b2e05d71f684c59fdd91a5

      SHA512

      3b60b8b7197079d629d01440ed78a589c6a18803cc63cdeac1382dc76201767f18190e694d2c1839a72f6318e39dba6217c48a130903f72e47fa1db504810c1c

      Download Submit

    • memory/2352-24-0x000007FEF5B30000-0x000007FEF5F9A000-memory.dmp

      Filesize

      4.4MB

      Download