Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

17782977dc...4b.exe

windows7-x64

7

17782977dc...4b.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    24/05/2024, 19:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    17782977dcc16ce3c1a6a614223a0e4c98f4b575206bc9b5ab50ee6e81e56a4b.exe

  • Size

    2.7MB

  • MD5

    46c076bed77d9c4e6d30b383d456c1b7

  • SHA1

    0598b84f98015c10877d820f45d4745e69c28cd1

  • SHA256

    17782977dcc16ce3c1a6a614223a0e4c98f4b575206bc9b5ab50ee6e81e56a4b

  • SHA512

    4ee81fc694de66eb1dc1bc502f6fa77332817015952fd1b035f9d6b4abfc2b8a3654ca6388202e12ebabb64594a2fda1931d995ec335a6cc63e35e88f283f20e

  • SSDEEP

    49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBf9w4Sx:+R0pI/IQlUoMPdmpSpb4

Score
7/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\17782977dcc16ce3c1a6a614223a0e4c98f4b575206bc9b5ab50ee6e81e56a4b.exe
    "C:\Users\Admin\AppData\Local\Temp\17782977dcc16ce3c1a6a614223a0e4c98f4b575206bc9b5ab50ee6e81e56a4b.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2248
    • C:\IntelprocOB\xbodloc.exe
      C:\IntelprocOB\xbodloc.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:2056

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\MintB1\bodasys.exe
    Filesize

    2.7MB

    MD5

    9958ec7ccafb54dc85733f417f974a81

    SHA1

    36367551597a4b811b52ab3f626433b0dd3f014b

    SHA256

    8fc0cea26cd97f56ec89462a3b490a31acece478823f80f17933b590fef57d02

    SHA512

    d79cd3cb39f9195c12b7ee90ae7bfd15375db894d17f4a9be9605e5348ee79a027f4941378490d38e874bb7436c051cd6c0671b6829a3f4dae33b4580e52f536

    Download Submit

  • C:\Users\Admin\253086396416_6.1_Admin.ini
    Filesize

    206B

    MD5

    db866abf1b12c985e891094495bcb030

    SHA1

    50ba0ce48ff976b04e7a262702ee20e10ecb21df

    SHA256

    8f71c29ffbf7faf31faa3524a5f4dd6b3681e323c7fa152059f5520cafb3995b

    SHA512

    6dbe4f5789d26c5b9df4fb10bef0068aeac929e87b70e7dc47fe76d55c66f14f254bcfc5c4f71917000121395311096b907323db964787e616b280a632214e8e

    Download Submit

  • \IntelprocOB\xbodloc.exe
    Filesize

    2.7MB

    MD5

    a5e20f4d3b3642170d822bd140ce0def

    SHA1

    e285d0e2901dc728552aa30eb16a7f68ab50d12b

    SHA256

    0f380988f6d0fbbdd57f3de3dfd9c321bbf8700b32b373a7211b339b6cd57b85

    SHA512

    8212f7a2b6280b1dc2b03832e0823e8b75ec3710aadf79d5e7542220283862f7b3ca64b7b662d6bebe3408f515561f2d015fad138b864524e41f749e6dc250d4

    Download Submit