Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
169s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
03/12/2022, 16:36
Static task
static1
Behavioral task
behavioral1
Sample
9d890f081ed25bf6669e7d17cc07e10dfb7f8bd63af4e17d4d330329e652fc3b.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
9d890f081ed25bf6669e7d17cc07e10dfb7f8bd63af4e17d4d330329e652fc3b.exe
Resource
win10v2004-20220812-en
General
-
Target
9d890f081ed25bf6669e7d17cc07e10dfb7f8bd63af4e17d4d330329e652fc3b.exe
-
Size
198KB
-
MD5
47788109a1179cc02b2bdc68ea1ac5fe
-
SHA1
2031b947693a8a5eedf6da1a01f0a7b99d755533
-
SHA256
9d890f081ed25bf6669e7d17cc07e10dfb7f8bd63af4e17d4d330329e652fc3b
-
SHA512
cfc8140afa4dc9011b02d79c1b39004e11a6aaa80d2c8c96f53daadb2a932eec219597e8d9d1aa07479be68595f1efcef2f43503bb1b1f2d91ca3b495a996d39
-
SSDEEP
1536:WyCrhycxa8EgNyHXSi1bpTfyoRtWbKpeVshd3oTOQQKTN:vCNycxZ5YbkoybpK3oTOQT
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1168 odjebiav2.exe 1332 odjebiav2.exe -
Loads dropped DLL 2 IoCs
pid Process 940 9d890f081ed25bf6669e7d17cc07e10dfb7f8bd63af4e17d4d330329e652fc3b.exe 940 9d890f081ed25bf6669e7d17cc07e10dfb7f8bd63af4e17d4d330329e652fc3b.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ 9d890f081ed25bf6669e7d17cc07e10dfb7f8bd63af4e17d4d330329e652fc3b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Svasta Pomalo v2 = "C:\\Users\\Admin\\AppData\\Roaming\\odjebiav2.exe" 9d890f081ed25bf6669e7d17cc07e10dfb7f8bd63af4e17d4d330329e652fc3b.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ 9d890f081ed25bf6669e7d17cc07e10dfb7f8bd63af4e17d4d330329e652fc3b.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\MS Svasta Pomalo v2 = "C:\\Users\\Admin\\AppData\\Roaming\\odjebiav2.exe" 9d890f081ed25bf6669e7d17cc07e10dfb7f8bd63af4e17d4d330329e652fc3b.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 944 set thread context of 940 944 9d890f081ed25bf6669e7d17cc07e10dfb7f8bd63af4e17d4d330329e652fc3b.exe 27 PID 1168 set thread context of 1332 1168 odjebiav2.exe 29 -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 944 wrote to memory of 940 944 9d890f081ed25bf6669e7d17cc07e10dfb7f8bd63af4e17d4d330329e652fc3b.exe 27 PID 944 wrote to memory of 940 944 9d890f081ed25bf6669e7d17cc07e10dfb7f8bd63af4e17d4d330329e652fc3b.exe 27 PID 944 wrote to memory of 940 944 9d890f081ed25bf6669e7d17cc07e10dfb7f8bd63af4e17d4d330329e652fc3b.exe 27 PID 944 wrote to memory of 940 944 9d890f081ed25bf6669e7d17cc07e10dfb7f8bd63af4e17d4d330329e652fc3b.exe 27 PID 944 wrote to memory of 940 944 9d890f081ed25bf6669e7d17cc07e10dfb7f8bd63af4e17d4d330329e652fc3b.exe 27 PID 944 wrote to memory of 940 944 9d890f081ed25bf6669e7d17cc07e10dfb7f8bd63af4e17d4d330329e652fc3b.exe 27 PID 944 wrote to memory of 940 944 9d890f081ed25bf6669e7d17cc07e10dfb7f8bd63af4e17d4d330329e652fc3b.exe 27 PID 944 wrote to memory of 940 944 9d890f081ed25bf6669e7d17cc07e10dfb7f8bd63af4e17d4d330329e652fc3b.exe 27 PID 944 wrote to memory of 940 944 9d890f081ed25bf6669e7d17cc07e10dfb7f8bd63af4e17d4d330329e652fc3b.exe 27 PID 940 wrote to memory of 1168 940 9d890f081ed25bf6669e7d17cc07e10dfb7f8bd63af4e17d4d330329e652fc3b.exe 28 PID 940 wrote to memory of 1168 940 9d890f081ed25bf6669e7d17cc07e10dfb7f8bd63af4e17d4d330329e652fc3b.exe 28 PID 940 wrote to memory of 1168 940 9d890f081ed25bf6669e7d17cc07e10dfb7f8bd63af4e17d4d330329e652fc3b.exe 28 PID 940 wrote to memory of 1168 940 9d890f081ed25bf6669e7d17cc07e10dfb7f8bd63af4e17d4d330329e652fc3b.exe 28 PID 1168 wrote to memory of 1332 1168 odjebiav2.exe 29 PID 1168 wrote to memory of 1332 1168 odjebiav2.exe 29 PID 1168 wrote to memory of 1332 1168 odjebiav2.exe 29 PID 1168 wrote to memory of 1332 1168 odjebiav2.exe 29 PID 1168 wrote to memory of 1332 1168 odjebiav2.exe 29 PID 1168 wrote to memory of 1332 1168 odjebiav2.exe 29 PID 1168 wrote to memory of 1332 1168 odjebiav2.exe 29 PID 1168 wrote to memory of 1332 1168 odjebiav2.exe 29 PID 1168 wrote to memory of 1332 1168 odjebiav2.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\9d890f081ed25bf6669e7d17cc07e10dfb7f8bd63af4e17d4d330329e652fc3b.exe"C:\Users\Admin\AppData\Local\Temp\9d890f081ed25bf6669e7d17cc07e10dfb7f8bd63af4e17d4d330329e652fc3b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Users\Admin\AppData\Local\Temp\9d890f081ed25bf6669e7d17cc07e10dfb7f8bd63af4e17d4d330329e652fc3b.exe"C:\Users\Admin\AppData\Local\Temp\9d890f081ed25bf6669e7d17cc07e10dfb7f8bd63af4e17d4d330329e652fc3b.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Users\Admin\AppData\Roaming\odjebiav2.exe"C:\Users\Admin\AppData\Roaming\odjebiav2.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Roaming\odjebiav2.exe"C:\Users\Admin\AppData\Roaming\odjebiav2.exe"4⤵
- Executes dropped EXE
PID:1332
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
198KB
MD547788109a1179cc02b2bdc68ea1ac5fe
SHA12031b947693a8a5eedf6da1a01f0a7b99d755533
SHA2569d890f081ed25bf6669e7d17cc07e10dfb7f8bd63af4e17d4d330329e652fc3b
SHA512cfc8140afa4dc9011b02d79c1b39004e11a6aaa80d2c8c96f53daadb2a932eec219597e8d9d1aa07479be68595f1efcef2f43503bb1b1f2d91ca3b495a996d39
-
Filesize
198KB
MD547788109a1179cc02b2bdc68ea1ac5fe
SHA12031b947693a8a5eedf6da1a01f0a7b99d755533
SHA2569d890f081ed25bf6669e7d17cc07e10dfb7f8bd63af4e17d4d330329e652fc3b
SHA512cfc8140afa4dc9011b02d79c1b39004e11a6aaa80d2c8c96f53daadb2a932eec219597e8d9d1aa07479be68595f1efcef2f43503bb1b1f2d91ca3b495a996d39
-
Filesize
198KB
MD547788109a1179cc02b2bdc68ea1ac5fe
SHA12031b947693a8a5eedf6da1a01f0a7b99d755533
SHA2569d890f081ed25bf6669e7d17cc07e10dfb7f8bd63af4e17d4d330329e652fc3b
SHA512cfc8140afa4dc9011b02d79c1b39004e11a6aaa80d2c8c96f53daadb2a932eec219597e8d9d1aa07479be68595f1efcef2f43503bb1b1f2d91ca3b495a996d39
-
Filesize
198KB
MD547788109a1179cc02b2bdc68ea1ac5fe
SHA12031b947693a8a5eedf6da1a01f0a7b99d755533
SHA2569d890f081ed25bf6669e7d17cc07e10dfb7f8bd63af4e17d4d330329e652fc3b
SHA512cfc8140afa4dc9011b02d79c1b39004e11a6aaa80d2c8c96f53daadb2a932eec219597e8d9d1aa07479be68595f1efcef2f43503bb1b1f2d91ca3b495a996d39
-
Filesize
198KB
MD547788109a1179cc02b2bdc68ea1ac5fe
SHA12031b947693a8a5eedf6da1a01f0a7b99d755533
SHA2569d890f081ed25bf6669e7d17cc07e10dfb7f8bd63af4e17d4d330329e652fc3b
SHA512cfc8140afa4dc9011b02d79c1b39004e11a6aaa80d2c8c96f53daadb2a932eec219597e8d9d1aa07479be68595f1efcef2f43503bb1b1f2d91ca3b495a996d39