Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    23/05/2024, 21:55

General

  • Target

    57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe

  • Size

    2.7MB

  • MD5

    8fe596f81a362abfd41fe74464b8e672

  • SHA1

    4b1a892cb73a3b359ad6a4f9e322e33d06202cd7

  • SHA256

    57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8

  • SHA512

    9b9fcb90297263f01f6daf4de7f926476bd8ec20e022ad1585b3d5927bc71728c75659a3f3ded2649565c4df2cf3dfdfe0ee5505a661b47df444c880c94897b4

  • SSDEEP

    49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBz9w4Sx:+R0pI/IQlUoMPdmpSpr4

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe
    "C:\Users\Admin\AppData\Local\Temp\57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2004
    • C:\IntelprocCZ\xdobloc.exe
      C:\IntelprocCZ\xdobloc.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:1068

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\LabZXW\bodaloc.exe

    Filesize

    2.7MB

    MD5

    a9d381bd7d232ad3197da52fecba45c6

    SHA1

    463df5a18666037d47660c5c4ec4914ebc72bbd4

    SHA256

    d48881283faccb3ff3f639994710f43f91469f91b586ee36670a0c474d98e843

    SHA512

    275987eeccb50de0140d97cc2a72cfc3ec73a5f04420792b9ed212dd4002a14df266649fdc16ef8a7788b7e2eab08d54b9146e6620617bb3d9b1bba6d73867a5

  • C:\Users\Admin\253086396416_6.1_Admin.ini

    Filesize

    204B

    MD5

    40c90e96610052d533b7fa61a3705a63

    SHA1

    5f95964bab83f1c8230432cd81cf74673f1bfe0f

    SHA256

    bde301dc9948490391f5429397ec445bed7a78906046ed255aa04b0f89b792f1

    SHA512

    663355020b1c77eca49f163c65eabdaba5c75a83758c18ec05f4c63d8464508997c7a55e1ecd4ce30e5777ab39e58db1f09dec01ce8a3cd597484456d7975b00

  • \IntelprocCZ\xdobloc.exe

    Filesize

    2.7MB

    MD5

    533cf8c096dda4ea4bb1b077b3a6083f

    SHA1

    c21df0787b7089544291a849372067c864fd7f12

    SHA256

    ed0658049e8112a5dbfcf4713176c02d440ed9bb98ce9397cbd63c04d43968a4

    SHA512

    cc84fee98e4e10af6691c27bc4d729f2ac5667f90b5e56e93eba4ee9e16c765d3796b4831c0184b234ef8d1dae28da1723b66130e4263807bdda7449f56adbb7