Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10photos.exe
windows7-x64
7photos.exe
windows10-2004-x64
9photos.exe
android-9-x86
photos.exe
android-10-x64
photos.exe
android-11-x64
photos.exe
macos-10.15-amd64
photos.exe
ubuntu-18.04-amd64
photos.exe
debian-9-armhf
photos.exe
debian-9-mips
photos.exe
debian-9-mipsel
discord_to...er.pyc
windows7-x64
discord_to...er.pyc
windows10-2004-x64
discord_to...er.pyc
android-9-x86
discord_to...er.pyc
android-10-x64
discord_to...er.pyc
android-11-x64
discord_to...er.pyc
macos-10.15-amd64
discord_to...er.pyc
ubuntu-18.04-amd64
discord_to...er.pyc
debian-9-armhf
discord_to...er.pyc
debian-9-mips
discord_to...er.pyc
debian-9-mipsel
get_cookies.pyc
windows7-x64
get_cookies.pyc
windows10-2004-x64
get_cookies.pyc
android-9-x86
get_cookies.pyc
android-10-x64
get_cookies.pyc
android-11-x64
get_cookies.pyc
macos-10.15-amd64
get_cookies.pyc
ubuntu-18.04-amd64
get_cookies.pyc
debian-9-armhf
get_cookies.pyc
debian-9-mips
get_cookies.pyc
debian-9-mipsel
misc.pyc
windows7-x64
misc.pyc
windows10-2004-x64
Analysis
-
max time kernel
845s -
max time network
850s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
12/01/2025, 14:23
Behavioral task
behavioral1
Sample
photos.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
photos.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
photos.exe
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral4
Sample
photos.exe
Resource
android-x64-20240624-en
Behavioral task
behavioral5
Sample
photos.exe
Resource
android-x64-arm64-20240624-en
Behavioral task
behavioral6
Sample
photos.exe
Resource
macos-20241106-en
Behavioral task
behavioral7
Sample
photos.exe
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral8
Sample
photos.exe
Resource
debian9-armhf-20240729-en
Behavioral task
behavioral9
Sample
photos.exe
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral10
Sample
photos.exe
Resource
debian9-mipsel-20240418-en
Behavioral task
behavioral11
Sample
discord_token_grabber.pyc
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
discord_token_grabber.pyc
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
discord_token_grabber.pyc
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral14
Sample
discord_token_grabber.pyc
Resource
android-x64-20240624-en
Behavioral task
behavioral15
Sample
discord_token_grabber.pyc
Resource
android-x64-arm64-20240910-en
Behavioral task
behavioral16
Sample
discord_token_grabber.pyc
Resource
macos-20241106-en
Behavioral task
behavioral17
Sample
discord_token_grabber.pyc
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral18
Sample
discord_token_grabber.pyc
Resource
debian9-armhf-20240729-en
Behavioral task
behavioral19
Sample
discord_token_grabber.pyc
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral20
Sample
discord_token_grabber.pyc
Resource
debian9-mipsel-20240226-en
Behavioral task
behavioral21
Sample
get_cookies.pyc
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
get_cookies.pyc
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
get_cookies.pyc
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral24
Sample
get_cookies.pyc
Resource
android-x64-20240910-en
Behavioral task
behavioral25
Sample
get_cookies.pyc
Resource
android-x64-arm64-20240624-en
Behavioral task
behavioral26
Sample
get_cookies.pyc
Resource
macos-20241106-en
Behavioral task
behavioral27
Sample
get_cookies.pyc
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral28
Sample
get_cookies.pyc
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral29
Sample
get_cookies.pyc
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral30
Sample
get_cookies.pyc
Resource
debian9-mipsel-20240611-en
Behavioral task
behavioral31
Sample
misc.pyc
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
misc.pyc
Resource
win10v2004-20241007-en
General
-
Target
photos.exe
-
Size
78.5MB
-
MD5
a4c9a785c0e51be1eba029f03947d108
-
SHA1
9141272123df990f6b0462a13d4b2d2a8a133c17
-
SHA256
122c37ee120e2429eb8e348ab8b30124ed0f9ca295ffd9aec8423932a251702e
-
SHA512
390b8422a81d758d021eb19457bb08e70f34722b8179d29104528b54665a416ecbd3de5a1623253d6cfeccbe9194e048a87f48b706209b6e52eb0bee355197d0
-
SSDEEP
1572864:OHl4WLxMsmwSk8IpG7V+VPhq9AE7eliPiYgj+h58sMwSe37z1cJLRK:OHO6MsmwSkB05aw98wx5Oe37YR
Malware Config
Signatures
-
Loads dropped DLL 10 IoCs
pid Process 316 photos.exe 316 photos.exe 316 photos.exe 316 photos.exe 316 photos.exe 316 photos.exe 316 photos.exe 316 photos.exe 316 photos.exe 316 photos.exe -
resource yara_rule behavioral1/files/0x0003000000020b8b-1315.dat upx behavioral1/memory/316-1317-0x000007FEF63E0000-0x000007FEF69C9000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1868 wrote to memory of 316 1868 photos.exe 30 PID 1868 wrote to memory of 316 1868 photos.exe 30 PID 1868 wrote to memory of 316 1868 photos.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\photos.exeC:\Users\Admin\AppData\Local\Temp\photos.exe cmd /c %SIGILL% "SIGTERM|DELETE|SIGKILL"1⤵
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\photos.exeC:\Users\Admin\AppData\Local\Temp\photos.exe cmd /c %SIGILL% "SIGTERM|DELETE|SIGKILL"2⤵
- Loads dropped DLL
PID:316
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41KB
MD55912435bd03ffe31f84b8561493800a8
SHA1b9ee6273dfc88539277782f59a3d5101e97246d9
SHA256932b58d7a383a653f0729ddd7db8d3704db9aad9b2b9fd5a25f8880a95ca55ba
SHA5120b6271932c8550c753c59c9cdb62cbd550139e5af97f3e9001c6ebe608123a86aae95e221848e392d7692fadafaadc8c332482d6f8449327fd99902f81dbad75
-
Filesize
41KB
MD5099a2b94f96ce0cf3e83e5169e571dab
SHA11b81ca74113234415b49c2a4ff032cdb5eb1a9dc
SHA2568e6c50cb40fa99b612da2c3c7900e948af227e27e56fc5698a12f68a03979de2
SHA5121bb5fa3ad3e21688982b31fe06688e71f083b5d5313df0d609b0a94cbbb082f53c17853cfe8b34791898722591884f514abecdd8d7e8b623f2b1b8ca2ca30110
-
Filesize
41KB
MD540a968a57935db11a9618eba3c05655e
SHA1f2ca0e08165a70cc1aa3a5074d5e0bae4914985a
SHA25672a37c20f1451c7df5f59aad29ac5a981fd4bb8dd4b2d81d38edffb4e8856d8c
SHA5127d5e4cb2c7b54d6db9042c5fe9c3188fdd162ef595e6bfc9d63f67ca4e5b10f2de22b36bd33d83e14371a7d304c4e113ac357d505d9967269427c7204059b2d9
-
Filesize
41KB
MD5f388a8cbfaed2a0920ed2c472107d07b
SHA1c4376421e86ee616259cb2255a0b2969c1b74600
SHA25667d630d47b33f4fc346771ceedd2185deaef4fe0954b66d0477c3ba64a35c3ee
SHA512cbabdc936425280e36e21fe65a2f58418dc6f4c16af4952e99f56bf14076e10810de309d07b9a602b77aaadd11f0f6cd5e53ca138d7bd98b1c05a4789b982472
-
Filesize
1.6MB
MD5a70d5250a7878d930c92c08abd2acf5c
SHA10c9526cb8aaf011655decf5f8037b4ea562db71f
SHA2561777007bcbec5c5daa8c4068b181216def54ac53eb2f6994b2fcb01edd74d03a
SHA51208bf354cc9a16c7103173edd71abb1d91b7865adffc8c1ceb085c9f807f73b5b0ab37e70071f17166fdcce8ab0d5647060638a525090cc2544498537834e7afd
-
Filesize
1.3MB
MD5b30b1bce7a668b480420f8f59df90bdb
SHA1feab869fd4641fda2576f271d3b090143ff93bf0
SHA256b6a49ab5dbba172c5a8b274b9e69a4a8d4ffbc96b8037151fff3233808dca2c7
SHA51207ebb0fbf90d139c93929e1b7a77fbce5bc2b227437151b7de914e9500a1478ba6c01372a2dece2f5e1eccc2676c888ed3aa906da51d9255b71409f4252d39a7
-
Filesize
41KB
MD5513200213d415ae9c6ff91a12e713f6a
SHA1531bd3f7664d64a663d3554969dc958dfb4a7b90
SHA256c31949e8a0f04d574e885d0d6b16b2ce053190d0ddb4f927906a1eb5b6af90d3
SHA5127604e09fe40550b291036fb5b2f7733924412de84cde53894c47d9449af9ecd8907e6ee27412270183bb19d2fd95a970b26297c4ef873196961fc15ff56c093c
-
Filesize
41KB
MD5eda8cdf62bcf809981ddfb5ac46bda50
SHA109f7b5adaf970b1a53a81c019d54b8e73210d9c4
SHA25605fa8735bfa82dd772f5cf8b3da8bbe787d81669c8a2d8cec6d1b3e3db994c67
SHA5123d8c39ca1f8982336357ff2a53b14ff194549ee729f06c385588dad91589ec6aa2db02374609b90e16cefae6afebb0971072af0e77eb9a32aa99307004cc7768
-
Filesize
41KB
MD5d0f8e6c3000e0237e7ffdc93482eb5f1
SHA1f56f2d8b22d9b542f5da8c53719a91115dc2815d
SHA256adce8b53b540c497be723ea55e11cf3e724a87b3a4fd660c8be0844915f7f4ac
SHA512a7e0c52acee2dbd14826969ecb270d505398aaefa3ce976b79c931eceb65decf7a267b0a58bafcded0ec9d8a728fdd79ee0583c73b8362039b4bf4bb21746e84
-
Filesize
41KB
MD561c41d35093bc88a1d9c4f63920fe6a0
SHA132ff4176c3ec13979b6383486020aed4a3713d62
SHA2560b3d88453cf553c041af8388fb1ac3790ea90dd71abd657a1508969e87c0b94f
SHA5120e4dae21e56a61d104d488d007e3f0a212c0b874040d398149a0420f17e935ce3ffeb4432f8ace84c06e0267c7715abe7b0be1b5042ede57401a9eb151b2e255