Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

17782977dc...4b.exe

windows7-x64

7

17782977dc...4b.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    103s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/05/2024, 19:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    17782977dcc16ce3c1a6a614223a0e4c98f4b575206bc9b5ab50ee6e81e56a4b.exe

  • Size

    2.7MB

  • MD5

    46c076bed77d9c4e6d30b383d456c1b7

  • SHA1

    0598b84f98015c10877d820f45d4745e69c28cd1

  • SHA256

    17782977dcc16ce3c1a6a614223a0e4c98f4b575206bc9b5ab50ee6e81e56a4b

  • SHA512

    4ee81fc694de66eb1dc1bc502f6fa77332817015952fd1b035f9d6b4abfc2b8a3654ca6388202e12ebabb64594a2fda1931d995ec335a6cc63e35e88f283f20e

  • SSDEEP

    49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBf9w4Sx:+R0pI/IQlUoMPdmpSpb4

Score
7/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\17782977dcc16ce3c1a6a614223a0e4c98f4b575206bc9b5ab50ee6e81e56a4b.exe
    "C:\Users\Admin\AppData\Local\Temp\17782977dcc16ce3c1a6a614223a0e4c98f4b575206bc9b5ab50ee6e81e56a4b.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4136
    • C:\FilesVE\devbodec.exe
      C:\FilesVE\devbodec.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:4636

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\FilesVE\devbodec.exe
    Filesize

    2.7MB

    MD5

    fd89ff9471e323b5bcf3eed84a148573

    SHA1

    9c544eea6e8e78355117a9d7f3ab551b6d3f6469

    SHA256

    d586b60cd9357de81a80fc94877bf2660f4a4c8b96f6a8c8ee5ba0bd19c5be8e

    SHA512

    bb3cf8aedf049b25358475116aa289a72875e8d7c5b16ea6491aeaf02fd21383d03618a4ee28e1c0d6f15c128b81eb31c8fab22b3d6fe00ca0d4cfadb3b67694

    Download Submit

  • C:\GalaxHB\dobxec.exe
    Filesize

    2.7MB

    MD5

    e04fdc93fce7aac1b030690cf39c26a2

    SHA1

    b572629c77badde07833cdbbd3e26489cce5a4ac

    SHA256

    3fbcf949b41ec8c8ae5524b07062218340ca633f5f1f1df6dd9e2b4c7b9854f0

    SHA512

    fb91306b854bc373fe97bef3849830c6960f8d755fb85b67aad0f97725be0d49b30a65c3762808108de9ca8282d744fc0768f669b6fe6f0ae0fbcdbfac4311f7

    Download Submit

  • C:\Users\Admin\253086396416_10.0_Admin.ini
    Filesize

    201B

    MD5

    241bca561e9d21f6d8730bbe6c0f3c21

    SHA1

    42d169e2ec6c3964838ebb32e9212014bad57953

    SHA256

    90e239ca82818cc990d72bd892c79e8f34885384cacb4568b91db47265382ed4

    SHA512

    dbdc25044aee498b0d3a86183dffcb763c3776a50b96e7b879ee8b436ab0b7ba7ec3e5cdba8c3e03a5322f6c627307c265f64268e59043dcda60a321d16506d4

    Download Submit