Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
24/05/2024, 22:39
Static task
static1
Behavioral task
behavioral1
Sample
19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe
Resource
win10v2004-20240508-en
General
-
Target
19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe
-
Size
3.5MB
-
MD5
3ca78b4470ad81124f5a46b182f843de
-
SHA1
9a34af988758d6bfd26f656437ece55936a2abaf
-
SHA256
19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54
-
SHA512
cdd11b4c71d0c19baaae52f3b08c4a80a0aa240914415d7f8a04974c5a4f57c6c22e6fe6847ec2a79678ea0ad4d3c90216da19d1c8cac828c2075d7acfe5d62a
-
SSDEEP
49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBn9w4SLDtnkgXL35xZzlPBq4Ow:+R0pI/IQlUoMPdmpSpj4ADtnkgvNWlw
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2036 adobsys.exe -
Loads dropped DLL 1 IoCs
pid Process 2988 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\AdobePT\\adobsys.exe" 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\Mint33\\dobdevec.exe" 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2988 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 2988 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 2036 adobsys.exe 2988 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 2036 adobsys.exe 2988 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 2036 adobsys.exe 2988 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 2036 adobsys.exe 2988 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 2036 adobsys.exe 2988 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 2036 adobsys.exe 2988 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 2036 adobsys.exe 2988 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 2036 adobsys.exe 2988 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 2036 adobsys.exe 2988 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 2036 adobsys.exe 2988 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 2036 adobsys.exe 2988 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 2036 adobsys.exe 2988 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 2036 adobsys.exe 2988 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 2036 adobsys.exe 2988 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 2036 adobsys.exe 2988 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 2036 adobsys.exe 2988 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 2036 adobsys.exe 2988 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 2036 adobsys.exe 2988 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 2036 adobsys.exe 2988 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 2036 adobsys.exe 2988 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 2036 adobsys.exe 2988 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 2036 adobsys.exe 2988 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 2036 adobsys.exe 2988 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 2036 adobsys.exe 2988 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 2036 adobsys.exe 2988 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 2036 adobsys.exe 2988 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 2036 adobsys.exe 2988 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 2036 adobsys.exe 2988 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 2036 adobsys.exe 2988 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 2036 adobsys.exe 2988 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 2036 adobsys.exe 2988 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2988 wrote to memory of 2036 2988 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 28 PID 2988 wrote to memory of 2036 2988 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 28 PID 2988 wrote to memory of 2036 2988 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 28 PID 2988 wrote to memory of 2036 2988 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe"C:\Users\Admin\AppData\Local\Temp\19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\AdobePT\adobsys.exeC:\AdobePT\adobsys.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2036
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.5MB
MD525de4bb5de7b8087834b9868b6925d79
SHA135c8dca21b5c3e762164faa6527d2a55c13e063f
SHA256f70b9316c4d5fe782860b1b7ab6e52453012a09149fb36ecccef26f8dd4b4d2b
SHA51231225a4574fb6879148bbc3c635e21de836c9a1eda48285b7b5930751e8f8f0f32ba0b911dc87e2fbdaf3f5b6c896c56dee7ae74455506d37e9050883fbbe777
-
Filesize
202B
MD5f544242d5b84935a682a63567f233abe
SHA19b88a451b599741e0d6e11362a43046632d3de49
SHA256675114dac4aafd47a0c4f28f4cd2e77323791fe4ee16525872b4f94ad4052ed4
SHA512db8b21e426951c7fc18e1c058de383db53097f7d085d370831b183d240e96b8b3dc20740f8647c5e4ee8d8432b9528a0a2c08dbaf3a7e47fea061ba9b0187a6b
-
Filesize
3.5MB
MD5c203c71926fdab9bca8fd8f05d4101f5
SHA1bd6aefbf588ee1462d299fb43bdfadcecc7fd3a3
SHA2561a958842cebafe925f9bc9600dd8df7a2ffee5cf6e12eed118e174dcab67594d
SHA512c0f4398d5918adeb4a22802843ed955ad38fe60d5b3c21c30157b65fe9e891f7b128f3f9e401fa4c02a5dc042171ca67ea7744a940e431dfc74e64f489c4f361