Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

e0203f0510...JC.exe

windows7-x64

7

e0203f0510...JC.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    151s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/09/2023, 18:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e0203f0510610150823630fa28980356_JC.exe

  • Size

    4.1MB

  • MD5

    e0203f0510610150823630fa28980356

  • SHA1

    d6a72542b10f9bccb975281dcf2e93a1f7518897

  • SHA256

    99774812c22b29d9a95988f407427a1a779b08ee059430af51e2117d499001b9

  • SHA512

    654c392d72e6b04b7880c1f7fb9a76ea7065674fcb038c44fd02b6381762fc61789c17b55972fb58723963bbd487fe63bc9763bdfcb25892fdde054180bde9d4

  • SSDEEP

    98304:+R0pI/IQlUoMPdmpSpP4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmg5n9klRKN41v

Score
7/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e0203f0510610150823630fa28980356_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\e0203f0510610150823630fa28980356_JC.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3688
    • C:\Files2I\devoptiec.exe
      C:\Files2I\devoptiec.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:4972

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Files2I\devoptiec.exe
    Filesize

    4.1MB

    MD5

    0ddcae2d7ad42d3028395ef642b330b3

    SHA1

    5ccfc78ad3fe3a6bc80bafb1b1fa3475cb14b4d6

    SHA256

    483129571db0286f2b673e211ebc87c7a965162a33791761830c75bd2a6069f6

    SHA512

    bf8dd81f11ebe8320a669ac910f03631159f0f3e6469e53dec6c44017f8b70f3190e7ffd3cbb31b1184bb6bfd1a7ce1c2a149500decdbe32e441eb7f94a614f8

    Download Submit

  • C:\Files2I\devoptiec.exe
    Filesize

    4.1MB

    MD5

    0ddcae2d7ad42d3028395ef642b330b3

    SHA1

    5ccfc78ad3fe3a6bc80bafb1b1fa3475cb14b4d6

    SHA256

    483129571db0286f2b673e211ebc87c7a965162a33791761830c75bd2a6069f6

    SHA512

    bf8dd81f11ebe8320a669ac910f03631159f0f3e6469e53dec6c44017f8b70f3190e7ffd3cbb31b1184bb6bfd1a7ce1c2a149500decdbe32e441eb7f94a614f8

    Download Submit

  • C:\KaVBNU\dobasys.exe
    Filesize

    4.1MB

    MD5

    5ef6de43a5ddbf6d64eb2e3061e6c727

    SHA1

    87a4721d055de44471d54ed92c66df781617192c

    SHA256

    d46f65cdba259dd3f79139df912206420c3dd8a12de855bb612ea63703e23c79

    SHA512

    8a81a778dd1e5e81ece9a5985db53e8ec907a71d1df67d48131a4b16b1f6be9d04b67248d961c41d12475b7f63caaefd3b584f8d42477073aac3bfe9c7244aa8

    Download Submit

  • C:\Users\Admin\253086396416_10.0_Admin.ini
    Filesize

    201B

    MD5

    798efd112445ab8f84ad1404d2c09712

    SHA1

    9e6c5c32bb0cc3071a4b16bfb24e14aa26f832d5

    SHA256

    7c8d90bff2912e4155bbbc4622470e68718b00a634890f55d16eda9de0be9e52

    SHA512

    4eacd272dd380d73b52e6d23c7697d7d9f5c12de5d5c02d793d7f603d80351a97d72f481b80e0f8bb64a7006679cbecca2998e849a3ee329dfc0af23465f803f

    Download Submit