Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23/05/2024, 21:55
Static task
static1
Behavioral task
behavioral1
Sample
57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe
Resource
win10v2004-20240226-en
General
-
Target
57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe
-
Size
2.7MB
-
MD5
8fe596f81a362abfd41fe74464b8e672
-
SHA1
4b1a892cb73a3b359ad6a4f9e322e33d06202cd7
-
SHA256
57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8
-
SHA512
9b9fcb90297263f01f6daf4de7f926476bd8ec20e022ad1585b3d5927bc71728c75659a3f3ded2649565c4df2cf3dfdfe0ee5505a661b47df444c880c94897b4
-
SSDEEP
49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBz9w4Sx:+R0pI/IQlUoMPdmpSpr4
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1068 xdobloc.exe -
Loads dropped DLL 1 IoCs
pid Process 2004 57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\IntelprocCZ\\xdobloc.exe" 57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\LabZXW\\bodaloc.exe" 57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2004 57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe 2004 57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe 1068 xdobloc.exe 2004 57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe 1068 xdobloc.exe 2004 57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe 1068 xdobloc.exe 2004 57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe 1068 xdobloc.exe 2004 57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe 1068 xdobloc.exe 2004 57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe 1068 xdobloc.exe 2004 57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe 1068 xdobloc.exe 2004 57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe 1068 xdobloc.exe 2004 57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe 1068 xdobloc.exe 2004 57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe 1068 xdobloc.exe 2004 57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe 1068 xdobloc.exe 2004 57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe 1068 xdobloc.exe 2004 57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe 1068 xdobloc.exe 2004 57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe 1068 xdobloc.exe 2004 57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe 1068 xdobloc.exe 2004 57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe 1068 xdobloc.exe 2004 57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe 1068 xdobloc.exe 2004 57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe 1068 xdobloc.exe 2004 57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe 1068 xdobloc.exe 2004 57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe 1068 xdobloc.exe 2004 57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe 1068 xdobloc.exe 2004 57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe 1068 xdobloc.exe 2004 57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe 1068 xdobloc.exe 2004 57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe 1068 xdobloc.exe 2004 57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe 1068 xdobloc.exe 2004 57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe 1068 xdobloc.exe 2004 57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe 1068 xdobloc.exe 2004 57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe 1068 xdobloc.exe 2004 57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe 1068 xdobloc.exe 2004 57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe 1068 xdobloc.exe 2004 57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe 1068 xdobloc.exe 2004 57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2004 wrote to memory of 1068 2004 57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe 28 PID 2004 wrote to memory of 1068 2004 57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe 28 PID 2004 wrote to memory of 1068 2004 57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe 28 PID 2004 wrote to memory of 1068 2004 57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe"C:\Users\Admin\AppData\Local\Temp\57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\IntelprocCZ\xdobloc.exeC:\IntelprocCZ\xdobloc.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1068
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD5a9d381bd7d232ad3197da52fecba45c6
SHA1463df5a18666037d47660c5c4ec4914ebc72bbd4
SHA256d48881283faccb3ff3f639994710f43f91469f91b586ee36670a0c474d98e843
SHA512275987eeccb50de0140d97cc2a72cfc3ec73a5f04420792b9ed212dd4002a14df266649fdc16ef8a7788b7e2eab08d54b9146e6620617bb3d9b1bba6d73867a5
-
Filesize
204B
MD540c90e96610052d533b7fa61a3705a63
SHA15f95964bab83f1c8230432cd81cf74673f1bfe0f
SHA256bde301dc9948490391f5429397ec445bed7a78906046ed255aa04b0f89b792f1
SHA512663355020b1c77eca49f163c65eabdaba5c75a83758c18ec05f4c63d8464508997c7a55e1ecd4ce30e5777ab39e58db1f09dec01ce8a3cd597484456d7975b00
-
Filesize
2.7MB
MD5533cf8c096dda4ea4bb1b077b3a6083f
SHA1c21df0787b7089544291a849372067c864fd7f12
SHA256ed0658049e8112a5dbfcf4713176c02d440ed9bb98ce9397cbd63c04d43968a4
SHA512cc84fee98e4e10af6691c27bc4d729f2ac5667f90b5e56e93eba4ee9e16c765d3796b4831c0184b234ef8d1dae28da1723b66130e4263807bdda7449f56adbb7