Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25/05/2024, 06:04
Static task
static1
Behavioral task
behavioral1
Sample
f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe
Resource
win10v2004-20240508-en
General
-
Target
f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe
-
Size
2.7MB
-
MD5
1115f275e740119deecd7264e54972ac
-
SHA1
71424f85830f6f396fc4c350fdcd189ec09bef7a
-
SHA256
f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27
-
SHA512
eb558a5433af8b0d58e1b77d638f63598ce80bb4d9af5c377f2826de35b1e7cf0d609bfbc3c8d02b61a4f0b1b25b75d3e6896be69aa4bbbfb2801e2c3a7e129d
-
SSDEEP
49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBr9w4Sx:+R0pI/IQlUoMPdmpSp/4
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 436 devoptiloc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrvGZ\\devoptiloc.exe" f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\GalaxH5\\bodasys.exe" f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2720 f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe 2720 f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe 2720 f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe 2720 f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe 436 devoptiloc.exe 436 devoptiloc.exe 2720 f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe 2720 f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe 436 devoptiloc.exe 436 devoptiloc.exe 2720 f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe 2720 f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe 436 devoptiloc.exe 436 devoptiloc.exe 2720 f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe 2720 f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe 436 devoptiloc.exe 436 devoptiloc.exe 2720 f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe 2720 f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe 436 devoptiloc.exe 436 devoptiloc.exe 2720 f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe 2720 f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe 436 devoptiloc.exe 436 devoptiloc.exe 2720 f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe 2720 f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe 436 devoptiloc.exe 436 devoptiloc.exe 2720 f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe 2720 f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe 436 devoptiloc.exe 436 devoptiloc.exe 2720 f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe 2720 f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe 436 devoptiloc.exe 436 devoptiloc.exe 2720 f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe 2720 f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe 436 devoptiloc.exe 436 devoptiloc.exe 2720 f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe 2720 f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe 436 devoptiloc.exe 436 devoptiloc.exe 2720 f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe 2720 f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe 436 devoptiloc.exe 436 devoptiloc.exe 2720 f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe 2720 f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe 436 devoptiloc.exe 436 devoptiloc.exe 2720 f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe 2720 f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe 436 devoptiloc.exe 436 devoptiloc.exe 2720 f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe 2720 f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe 436 devoptiloc.exe 436 devoptiloc.exe 2720 f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe 2720 f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2720 wrote to memory of 436 2720 f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe 92 PID 2720 wrote to memory of 436 2720 f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe 92 PID 2720 wrote to memory of 436 2720 f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe"C:\Users\Admin\AppData\Local\Temp\f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\SysDrvGZ\devoptiloc.exeC:\SysDrvGZ\devoptiloc.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:436
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD590ee82efa2c5a7479a4ff237fd73e3fc
SHA19b416adebdc4d27c47e716de99dc7f487333b75c
SHA25635474e7a62f196d5fe6c748bd83ddc7a5f927a44a5aa40021ae036e29e7d598a
SHA5126ab7c9dc2659b02c1cb1478cdc4f5ce485b1b9a996ab162fc47e176edcd111889a64678b99774f057077924b35957f95d5db9e6ecfe3bdb11d846cbaeb33558d
-
Filesize
2.7MB
MD59dcf80cb77ffb36af0b8a99e3fa47430
SHA18667d1db70467988ddad74fd2ca33991e7239a3c
SHA256b210b18da632d685669c6037ca6be53b95446130d761cf53f2b47dfb0c5334bd
SHA512e15a5368c85fecc9327340b6a73f3d44a309b5cf5e343e22baffa0947bd4925a781f269e022f71a168f55a3378f5e1a2687453489df125c6af21a6ebbe62c3af
-
Filesize
205B
MD5ccbde905d714aa9d9114c22ee138f5ef
SHA19a70cf12b2e3ea2ef296e96f9778eafc9633183a
SHA256b39cf131cbdef422dd0245e816b94031372861566b57c3f826bf9968c8c2f8ed
SHA51268bc8710a78e08a618cbdf4fb61d275967b0993b1312539e59a36016472bbba935f847d76d09a585aebaf8b07d5c52b3a9d02045a37f905b5945e384bf133960