Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03/12/2022, 16:36
Static task
static1
Behavioral task
behavioral1
Sample
9d890f081ed25bf6669e7d17cc07e10dfb7f8bd63af4e17d4d330329e652fc3b.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
9d890f081ed25bf6669e7d17cc07e10dfb7f8bd63af4e17d4d330329e652fc3b.exe
Resource
win10v2004-20220812-en
General
-
Target
9d890f081ed25bf6669e7d17cc07e10dfb7f8bd63af4e17d4d330329e652fc3b.exe
-
Size
198KB
-
MD5
47788109a1179cc02b2bdc68ea1ac5fe
-
SHA1
2031b947693a8a5eedf6da1a01f0a7b99d755533
-
SHA256
9d890f081ed25bf6669e7d17cc07e10dfb7f8bd63af4e17d4d330329e652fc3b
-
SHA512
cfc8140afa4dc9011b02d79c1b39004e11a6aaa80d2c8c96f53daadb2a932eec219597e8d9d1aa07479be68595f1efcef2f43503bb1b1f2d91ca3b495a996d39
-
SSDEEP
1536:WyCrhycxa8EgNyHXSi1bpTfyoRtWbKpeVshd3oTOQQKTN:vCNycxZ5YbkoybpK3oTOQT
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 4396 odjebiav2.exe 32 odjebiav2.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MS Svasta Pomalo v2 = "C:\\Users\\Admin\\AppData\\Roaming\\odjebiav2.exe" 9d890f081ed25bf6669e7d17cc07e10dfb7f8bd63af4e17d4d330329e652fc3b.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ 9d890f081ed25bf6669e7d17cc07e10dfb7f8bd63af4e17d4d330329e652fc3b.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MS Svasta Pomalo v2 = "C:\\Users\\Admin\\AppData\\Roaming\\odjebiav2.exe" 9d890f081ed25bf6669e7d17cc07e10dfb7f8bd63af4e17d4d330329e652fc3b.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ 9d890f081ed25bf6669e7d17cc07e10dfb7f8bd63af4e17d4d330329e652fc3b.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4892 set thread context of 3108 4892 9d890f081ed25bf6669e7d17cc07e10dfb7f8bd63af4e17d4d330329e652fc3b.exe 80 PID 4396 set thread context of 32 4396 odjebiav2.exe 84 -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 4892 wrote to memory of 3108 4892 9d890f081ed25bf6669e7d17cc07e10dfb7f8bd63af4e17d4d330329e652fc3b.exe 80 PID 4892 wrote to memory of 3108 4892 9d890f081ed25bf6669e7d17cc07e10dfb7f8bd63af4e17d4d330329e652fc3b.exe 80 PID 4892 wrote to memory of 3108 4892 9d890f081ed25bf6669e7d17cc07e10dfb7f8bd63af4e17d4d330329e652fc3b.exe 80 PID 4892 wrote to memory of 3108 4892 9d890f081ed25bf6669e7d17cc07e10dfb7f8bd63af4e17d4d330329e652fc3b.exe 80 PID 4892 wrote to memory of 3108 4892 9d890f081ed25bf6669e7d17cc07e10dfb7f8bd63af4e17d4d330329e652fc3b.exe 80 PID 4892 wrote to memory of 3108 4892 9d890f081ed25bf6669e7d17cc07e10dfb7f8bd63af4e17d4d330329e652fc3b.exe 80 PID 4892 wrote to memory of 3108 4892 9d890f081ed25bf6669e7d17cc07e10dfb7f8bd63af4e17d4d330329e652fc3b.exe 80 PID 4892 wrote to memory of 3108 4892 9d890f081ed25bf6669e7d17cc07e10dfb7f8bd63af4e17d4d330329e652fc3b.exe 80 PID 3108 wrote to memory of 4396 3108 9d890f081ed25bf6669e7d17cc07e10dfb7f8bd63af4e17d4d330329e652fc3b.exe 83 PID 3108 wrote to memory of 4396 3108 9d890f081ed25bf6669e7d17cc07e10dfb7f8bd63af4e17d4d330329e652fc3b.exe 83 PID 3108 wrote to memory of 4396 3108 9d890f081ed25bf6669e7d17cc07e10dfb7f8bd63af4e17d4d330329e652fc3b.exe 83 PID 4396 wrote to memory of 32 4396 odjebiav2.exe 84 PID 4396 wrote to memory of 32 4396 odjebiav2.exe 84 PID 4396 wrote to memory of 32 4396 odjebiav2.exe 84 PID 4396 wrote to memory of 32 4396 odjebiav2.exe 84 PID 4396 wrote to memory of 32 4396 odjebiav2.exe 84 PID 4396 wrote to memory of 32 4396 odjebiav2.exe 84 PID 4396 wrote to memory of 32 4396 odjebiav2.exe 84 PID 4396 wrote to memory of 32 4396 odjebiav2.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\9d890f081ed25bf6669e7d17cc07e10dfb7f8bd63af4e17d4d330329e652fc3b.exe"C:\Users\Admin\AppData\Local\Temp\9d890f081ed25bf6669e7d17cc07e10dfb7f8bd63af4e17d4d330329e652fc3b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\9d890f081ed25bf6669e7d17cc07e10dfb7f8bd63af4e17d4d330329e652fc3b.exe"C:\Users\Admin\AppData\Local\Temp\9d890f081ed25bf6669e7d17cc07e10dfb7f8bd63af4e17d4d330329e652fc3b.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Users\Admin\AppData\Roaming\odjebiav2.exe"C:\Users\Admin\AppData\Roaming\odjebiav2.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Roaming\odjebiav2.exe"C:\Users\Admin\AppData\Roaming\odjebiav2.exe"4⤵
- Executes dropped EXE
PID:32
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
198KB
MD547788109a1179cc02b2bdc68ea1ac5fe
SHA12031b947693a8a5eedf6da1a01f0a7b99d755533
SHA2569d890f081ed25bf6669e7d17cc07e10dfb7f8bd63af4e17d4d330329e652fc3b
SHA512cfc8140afa4dc9011b02d79c1b39004e11a6aaa80d2c8c96f53daadb2a932eec219597e8d9d1aa07479be68595f1efcef2f43503bb1b1f2d91ca3b495a996d39
-
Filesize
198KB
MD547788109a1179cc02b2bdc68ea1ac5fe
SHA12031b947693a8a5eedf6da1a01f0a7b99d755533
SHA2569d890f081ed25bf6669e7d17cc07e10dfb7f8bd63af4e17d4d330329e652fc3b
SHA512cfc8140afa4dc9011b02d79c1b39004e11a6aaa80d2c8c96f53daadb2a932eec219597e8d9d1aa07479be68595f1efcef2f43503bb1b1f2d91ca3b495a996d39
-
Filesize
198KB
MD547788109a1179cc02b2bdc68ea1ac5fe
SHA12031b947693a8a5eedf6da1a01f0a7b99d755533
SHA2569d890f081ed25bf6669e7d17cc07e10dfb7f8bd63af4e17d4d330329e652fc3b
SHA512cfc8140afa4dc9011b02d79c1b39004e11a6aaa80d2c8c96f53daadb2a932eec219597e8d9d1aa07479be68595f1efcef2f43503bb1b1f2d91ca3b495a996d39