Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
03/09/2023, 05:35
Static task
static1
Behavioral task
behavioral1
Sample
70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe
Resource
win10v2004-20230831-en
General
-
Target
70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe
-
Size
4.1MB
-
MD5
3abf7a0ebfb5ad7f0d7ac93fe5f952f8
-
SHA1
f9490b1f754e45c64c7a0ec27df340643e931c5c
-
SHA256
70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93
-
SHA512
3acb44ce32f46c38725f6356ff73b009878802a6189498832cd898878dc5f1c3491ba9bdd157ff32bf7c79ef79ac9ed4aceec8dd532cfc46f776290bffdcbe00
-
SSDEEP
98304:+R0pI/IQlUoMPdmpSpA4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmH5n9klRKN41v
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3868 abodloc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4078585466-1563564224-3678410669-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDotD3\\abodloc.exe" 70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe Set value (str) \REGISTRY\USER\S-1-5-21-4078585466-1563564224-3678410669-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\LabZ2F\\optixec.exe" 70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2720 70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe 2720 70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe 2720 70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe 2720 70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe 3868 abodloc.exe 3868 abodloc.exe 2720 70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe 2720 70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe 3868 abodloc.exe 3868 abodloc.exe 2720 70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe 2720 70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe 3868 abodloc.exe 3868 abodloc.exe 2720 70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe 2720 70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe 3868 abodloc.exe 3868 abodloc.exe 2720 70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe 2720 70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe 3868 abodloc.exe 3868 abodloc.exe 2720 70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe 2720 70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe 3868 abodloc.exe 3868 abodloc.exe 2720 70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe 2720 70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe 3868 abodloc.exe 3868 abodloc.exe 2720 70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe 2720 70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe 3868 abodloc.exe 3868 abodloc.exe 2720 70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe 2720 70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe 3868 abodloc.exe 3868 abodloc.exe 2720 70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe 2720 70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe 3868 abodloc.exe 3868 abodloc.exe 2720 70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe 2720 70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe 3868 abodloc.exe 3868 abodloc.exe 2720 70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe 2720 70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe 3868 abodloc.exe 3868 abodloc.exe 2720 70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe 2720 70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe 3868 abodloc.exe 3868 abodloc.exe 2720 70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe 2720 70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe 3868 abodloc.exe 3868 abodloc.exe 2720 70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe 2720 70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe 3868 abodloc.exe 3868 abodloc.exe 2720 70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe 2720 70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2720 wrote to memory of 3868 2720 70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe 87 PID 2720 wrote to memory of 3868 2720 70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe 87 PID 2720 wrote to memory of 3868 2720 70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe"C:\Users\Admin\AppData\Local\Temp\70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\UserDotD3\abodloc.exeC:\UserDotD3\abodloc.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3868
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13KB
MD5c41dc9af6b4d2a08015e3c5b0cb7301a
SHA17ab6efdaf5b348acdb7ea1f4818473a460ccbf67
SHA2565ecc0eda6b276364ee7bf1bf425e7db1c4c3c070dafa48eed9b441e6b60d1f3c
SHA512ca143456a373a076d715ead506f0f553aba551352d380cfdef32496c96c3b15b55cfe2390c5d1e5e9385ad9752d46b2dc99dd0634f1476a1e77a872bf0746f89
-
Filesize
4.1MB
MD54e66b23cd3162d4bb41d579428c2492d
SHA16422600d5f91ee973d93d7b42edd50118a666ba6
SHA2565eb4018e7a859af1ed3ea46490b0bbdcfaa6c1195adb83c2fd07594b437495ac
SHA51289527f70bcd635459ba4671e122a63377e4f1fb20832fc70518ced966b7efeb9281cf2e3c1eda3d92c47b4a0f7c01219e8c73d560e77335d46030e738051ea0f
-
Filesize
4.1MB
MD54e66b23cd3162d4bb41d579428c2492d
SHA16422600d5f91ee973d93d7b42edd50118a666ba6
SHA2565eb4018e7a859af1ed3ea46490b0bbdcfaa6c1195adb83c2fd07594b437495ac
SHA51289527f70bcd635459ba4671e122a63377e4f1fb20832fc70518ced966b7efeb9281cf2e3c1eda3d92c47b4a0f7c01219e8c73d560e77335d46030e738051ea0f
-
Filesize
203B
MD583336aeaf214801efdf673d83b4510e3
SHA194fe73258e3556455033112243af1002af6dec43
SHA2568d0bd75d99a55812b5cd3698e12c57bd9fc1780f54c5e7e185effe5488ac69ec
SHA51273f0f46d29d080410743f67126e3ef83ab22cf7412664df5ba358bee003e2963b85b0c639cd0dab3b486bf47b161b171a64e8126ad9aad22d61a3fbb91ddc62b