Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25/04/2024, 01:42
Static task
static1
Behavioral task
behavioral1
Sample
a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe
Resource
win10v2004-20240412-en
General
-
Target
a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe
-
Size
4.1MB
-
MD5
878a02e17c2d5d0d091e438f3a29224c
-
SHA1
5cfaf5b071625e825145fb92f7f0b55492fd7cd6
-
SHA256
a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36
-
SHA512
617cf9727a8c3c1022ec19e53043214bd59bb58de3794c30efea5bc0972a8ed79d1ff621128ae2814baaea56c4d15e44b0a10dbd1004ca833459ba47970d095a
-
SSDEEP
98304:+R0pI/IQlUoMPdmpSpF4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmq5n9klRKN41v
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1932 devoptiloc.exe -
Loads dropped DLL 1 IoCs
pid Process 2132 a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrv22\\devoptiloc.exe" a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\KaVBHD\\bodasys.exe" a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2132 a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe 2132 a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe 1932 devoptiloc.exe 2132 a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe 1932 devoptiloc.exe 2132 a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe 1932 devoptiloc.exe 2132 a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe 1932 devoptiloc.exe 2132 a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe 1932 devoptiloc.exe 2132 a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe 1932 devoptiloc.exe 2132 a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe 1932 devoptiloc.exe 2132 a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe 1932 devoptiloc.exe 2132 a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe 1932 devoptiloc.exe 2132 a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe 1932 devoptiloc.exe 2132 a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe 1932 devoptiloc.exe 2132 a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe 1932 devoptiloc.exe 2132 a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe 1932 devoptiloc.exe 2132 a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe 1932 devoptiloc.exe 2132 a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe 1932 devoptiloc.exe 2132 a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe 1932 devoptiloc.exe 2132 a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe 1932 devoptiloc.exe 2132 a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe 1932 devoptiloc.exe 2132 a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe 1932 devoptiloc.exe 2132 a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe 1932 devoptiloc.exe 2132 a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe 1932 devoptiloc.exe 2132 a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe 1932 devoptiloc.exe 2132 a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe 1932 devoptiloc.exe 2132 a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe 1932 devoptiloc.exe 2132 a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe 1932 devoptiloc.exe 2132 a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe 1932 devoptiloc.exe 2132 a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe 1932 devoptiloc.exe 2132 a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe 1932 devoptiloc.exe 2132 a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe 1932 devoptiloc.exe 2132 a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe 1932 devoptiloc.exe 2132 a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe 1932 devoptiloc.exe 2132 a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2132 wrote to memory of 1932 2132 a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe 28 PID 2132 wrote to memory of 1932 2132 a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe 28 PID 2132 wrote to memory of 1932 2132 a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe 28 PID 2132 wrote to memory of 1932 2132 a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe"C:\Users\Admin\AppData\Local\Temp\a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\SysDrv22\devoptiloc.exeC:\SysDrv22\devoptiloc.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1932
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.1MB
MD5ef4e213fb4e12503fd539b796aaa7b4b
SHA108ab526b3171cdcac130b8ddf7ab4d1b806905b5
SHA256d44d281fd195932169e2a862730633a1554a9cac75e4616ec66908bf403d785c
SHA512c2367639145f03e722fea37ae0ae436abd4bc866ee1590af73d916b78261ddd0b8d81c783f75d0ab5bb58f03b537241639285091beee8ce19b15ffe253640564
-
Filesize
203B
MD529f543cb79c148284847ea7169f817c5
SHA177412f9b3f3b22fbe0f5e7b598c5d402a53597bf
SHA25608b427b52137419bcaa5499db5b47e16c291d536eda961870537f1ba9f14f69d
SHA5127d0d1273c660aa839f51598bbebc0a9749e3eb6b9381052c4494734cb7e4ee70101704e6d73a895185d7cf0417122fe8dd70dcb986e27c7f8af6225927e9c93e
-
Filesize
4.1MB
MD56bbe760829a2fcbd8742805595badd32
SHA14ac185974a0484d63346cbb558dafd6b4dc42bbb
SHA256fd9ee4acd17d1da19e4af77274bf86a488b0e4c4470aaf36a739242bab71bcea
SHA512a6e4a5752ca92e824ef98682ddb649062815a5fd616ca8b5bc31ecbd70c46563f34646608c92012747c03786ef35ecdd0c9a6b1a7eb39b7fc4cc7f63d3c5e755