Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    16s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    25/01/2025, 13:30

General

  • Target

    vanish.exe

  • Size

    7.5MB

  • MD5

    a1006e5babbb7e99e3041986c7aab9fd

  • SHA1

    c4df6551e48b11114b05396f7a36fee3bf26b466

  • SHA256

    ebf548e65b8f05f66462e7247444fc75b6759033a873919c1f973d650ed549cf

  • SHA512

    8f45173a16e88e7924eff0808a9f48df6cf81a1117b8499f743727eb75f99e440d3d174472295aaee8b9d28bb91611c43faf96c4991ede9f9ca619f538b2e281

  • SSDEEP

    196608:99gFkwfI9jUC2gYBYv3vbWY+iITm1U6fd1EZ:UFbIH2gYBgDW/TOzb+

Score
7/10
upx

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\vanish.exe
    "C:\Users\Admin\AppData\Local\Temp\vanish.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2736
    • C:\Users\Admin\AppData\Local\Temp\vanish.exe
      "C:\Users\Admin\AppData\Local\Temp\vanish.exe"
      2⤵
      • Loads dropped DLL
      PID:2824
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:2576

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\_MEI27362\python312.dll

      Filesize

      1.7MB

      MD5

      6f7c42579f6c2b45fe866747127aef09

      SHA1

      b9487372fe3ed61022e52cc8dbd37e6640e87723

      SHA256

      07642b6a3d99ce88cff790087ac4e2ba0b2da1100cf1897f36e096427b580ee5

      SHA512

      aadf06fd6b4e14f600b0a614001b8c31e42d71801adec7c9c177dcbb4956e27617fa45ba477260a7e06d2ca4979ed5acc60311258427ee085e8025b61452acec

    • memory/2824-23-0x000007FEF6940000-0x000007FEF7005000-memory.dmp

      Filesize

      6.8MB