Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20250207-en -
resource tags
arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system -
submitted
19/03/2025, 09:46
Behavioral task
behavioral1
Sample
Cphn-MultiTool/src/utils/upx.exe
Resource
win7-20250207-en
Behavioral task
behavioral2
Sample
Cphn-MultiTool/src/utils/upx.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral3
Sample
main.pyc
Resource
win7-20250207-en
Behavioral task
behavioral4
Sample
main.pyc
Resource
win10v2004-20250314-en
Behavioral task
behavioral5
Sample
Cphn-MultiTool/start.bat
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
Cphn-MultiTool/start.bat
Resource
win10v2004-20250314-en
General
-
Target
Cphn-MultiTool/src/utils/upx.exe
-
Size
17.7MB
-
MD5
673af60b87d8ce0dd4ebdcaac1d3641e
-
SHA1
d09d358484d60c6ae51ed710ef7f6b7f9ea68cc7
-
SHA256
7363a85243a9526d24d6bdd2c9e9003b451d4f9d97f26a174bf743fa791b15db
-
SHA512
11fe2b921bf77165f52de385d2aa040b0e084dd93f93febba8777ccadc42a9e00dbd8f456ab06d15bb484a40b1e8475f5623920beff9dd6447ca2c35f2363f88
-
SSDEEP
393216:aqPnLFXlrgUgQpDOETgsvfGEgTluSLzvEA6E8TLV:vPLFXNgtQoEFMPYQM
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2428 upx.exe -
resource yara_rule behavioral1/files/0x000400000001d3a9-112.dat upx behavioral1/memory/2428-114-0x000007FEF6420000-0x000007FEF688E000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 324 wrote to memory of 2428 324 upx.exe 30 PID 324 wrote to memory of 2428 324 upx.exe 30 PID 324 wrote to memory of 2428 324 upx.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\Cphn-MultiTool\src\utils\upx.exe"C:\Users\Admin\AppData\Local\Temp\Cphn-MultiTool\src\utils\upx.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:324 -
C:\Users\Admin\AppData\Local\Temp\Cphn-MultiTool\src\utils\upx.exe"C:\Users\Admin\AppData\Local\Temp\Cphn-MultiTool\src\utils\upx.exe"2⤵
- Loads dropped DLL
PID:2428
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD569d4f13fbaeee9b551c2d9a4a94d4458
SHA169540d8dfc0ee299a7ff6585018c7db0662aa629
SHA256801317463bd116e603878c7c106093ba7db2bece11e691793e93065223fc7046
SHA5128e632f141daf44bc470f8ee677c6f0fdcbcacbfce1472d928576bf7b9f91d6b76639d18e386d5e1c97e538a8fe19dd2d22ea47ae1acf138a0925e3c6dd156378