Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
31/05/2024, 18:52
Static task
static1
Behavioral task
behavioral1
Sample
122fd9b654f5ec30573998f3f18931055abcfdce32e26269e05f4277ae5171f5.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
122fd9b654f5ec30573998f3f18931055abcfdce32e26269e05f4277ae5171f5.exe
Resource
win10v2004-20240508-en
General
-
Target
122fd9b654f5ec30573998f3f18931055abcfdce32e26269e05f4277ae5171f5.exe
-
Size
4.1MB
-
MD5
9aed14432c1e48e3e0a69bca2686b11a
-
SHA1
8274d4cfbe36f0aed3ea3278764a9a4d696c3938
-
SHA256
122fd9b654f5ec30573998f3f18931055abcfdce32e26269e05f4277ae5171f5
-
SHA512
c57f8ad5a98c3ca6889cd8af82e2117b93199c2ef50a8597c16bbeb05d439e3306ccfede07e6326817cee13ef8de1e18b3ac57abac462b3fdb60e56a4177844f
-
SSDEEP
98304:+R0pI/IQlUoMPdmpSpv4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdm85n9klRKN41v
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2908 aoptiec.exe -
Loads dropped DLL 1 IoCs
pid Process 2956 122fd9b654f5ec30573998f3f18931055abcfdce32e26269e05f4277ae5171f5.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDotSH\\aoptiec.exe" 122fd9b654f5ec30573998f3f18931055abcfdce32e26269e05f4277ae5171f5.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\MintGF\\optixsys.exe" 122fd9b654f5ec30573998f3f18931055abcfdce32e26269e05f4277ae5171f5.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2956 122fd9b654f5ec30573998f3f18931055abcfdce32e26269e05f4277ae5171f5.exe 2956 122fd9b654f5ec30573998f3f18931055abcfdce32e26269e05f4277ae5171f5.exe 2908 aoptiec.exe 2956 122fd9b654f5ec30573998f3f18931055abcfdce32e26269e05f4277ae5171f5.exe 2908 aoptiec.exe 2956 122fd9b654f5ec30573998f3f18931055abcfdce32e26269e05f4277ae5171f5.exe 2908 aoptiec.exe 2956 122fd9b654f5ec30573998f3f18931055abcfdce32e26269e05f4277ae5171f5.exe 2908 aoptiec.exe 2956 122fd9b654f5ec30573998f3f18931055abcfdce32e26269e05f4277ae5171f5.exe 2908 aoptiec.exe 2956 122fd9b654f5ec30573998f3f18931055abcfdce32e26269e05f4277ae5171f5.exe 2908 aoptiec.exe 2956 122fd9b654f5ec30573998f3f18931055abcfdce32e26269e05f4277ae5171f5.exe 2908 aoptiec.exe 2956 122fd9b654f5ec30573998f3f18931055abcfdce32e26269e05f4277ae5171f5.exe 2908 aoptiec.exe 2956 122fd9b654f5ec30573998f3f18931055abcfdce32e26269e05f4277ae5171f5.exe 2908 aoptiec.exe 2956 122fd9b654f5ec30573998f3f18931055abcfdce32e26269e05f4277ae5171f5.exe 2908 aoptiec.exe 2956 122fd9b654f5ec30573998f3f18931055abcfdce32e26269e05f4277ae5171f5.exe 2908 aoptiec.exe 2956 122fd9b654f5ec30573998f3f18931055abcfdce32e26269e05f4277ae5171f5.exe 2908 aoptiec.exe 2956 122fd9b654f5ec30573998f3f18931055abcfdce32e26269e05f4277ae5171f5.exe 2908 aoptiec.exe 2956 122fd9b654f5ec30573998f3f18931055abcfdce32e26269e05f4277ae5171f5.exe 2908 aoptiec.exe 2956 122fd9b654f5ec30573998f3f18931055abcfdce32e26269e05f4277ae5171f5.exe 2908 aoptiec.exe 2956 122fd9b654f5ec30573998f3f18931055abcfdce32e26269e05f4277ae5171f5.exe 2908 aoptiec.exe 2956 122fd9b654f5ec30573998f3f18931055abcfdce32e26269e05f4277ae5171f5.exe 2908 aoptiec.exe 2956 122fd9b654f5ec30573998f3f18931055abcfdce32e26269e05f4277ae5171f5.exe 2908 aoptiec.exe 2956 122fd9b654f5ec30573998f3f18931055abcfdce32e26269e05f4277ae5171f5.exe 2908 aoptiec.exe 2956 122fd9b654f5ec30573998f3f18931055abcfdce32e26269e05f4277ae5171f5.exe 2908 aoptiec.exe 2956 122fd9b654f5ec30573998f3f18931055abcfdce32e26269e05f4277ae5171f5.exe 2908 aoptiec.exe 2956 122fd9b654f5ec30573998f3f18931055abcfdce32e26269e05f4277ae5171f5.exe 2908 aoptiec.exe 2956 122fd9b654f5ec30573998f3f18931055abcfdce32e26269e05f4277ae5171f5.exe 2908 aoptiec.exe 2956 122fd9b654f5ec30573998f3f18931055abcfdce32e26269e05f4277ae5171f5.exe 2908 aoptiec.exe 2956 122fd9b654f5ec30573998f3f18931055abcfdce32e26269e05f4277ae5171f5.exe 2908 aoptiec.exe 2956 122fd9b654f5ec30573998f3f18931055abcfdce32e26269e05f4277ae5171f5.exe 2908 aoptiec.exe 2956 122fd9b654f5ec30573998f3f18931055abcfdce32e26269e05f4277ae5171f5.exe 2908 aoptiec.exe 2956 122fd9b654f5ec30573998f3f18931055abcfdce32e26269e05f4277ae5171f5.exe 2908 aoptiec.exe 2956 122fd9b654f5ec30573998f3f18931055abcfdce32e26269e05f4277ae5171f5.exe 2908 aoptiec.exe 2956 122fd9b654f5ec30573998f3f18931055abcfdce32e26269e05f4277ae5171f5.exe 2908 aoptiec.exe 2956 122fd9b654f5ec30573998f3f18931055abcfdce32e26269e05f4277ae5171f5.exe 2908 aoptiec.exe 2956 122fd9b654f5ec30573998f3f18931055abcfdce32e26269e05f4277ae5171f5.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2956 wrote to memory of 2908 2956 122fd9b654f5ec30573998f3f18931055abcfdce32e26269e05f4277ae5171f5.exe 28 PID 2956 wrote to memory of 2908 2956 122fd9b654f5ec30573998f3f18931055abcfdce32e26269e05f4277ae5171f5.exe 28 PID 2956 wrote to memory of 2908 2956 122fd9b654f5ec30573998f3f18931055abcfdce32e26269e05f4277ae5171f5.exe 28 PID 2956 wrote to memory of 2908 2956 122fd9b654f5ec30573998f3f18931055abcfdce32e26269e05f4277ae5171f5.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\122fd9b654f5ec30573998f3f18931055abcfdce32e26269e05f4277ae5171f5.exe"C:\Users\Admin\AppData\Local\Temp\122fd9b654f5ec30573998f3f18931055abcfdce32e26269e05f4277ae5171f5.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\UserDotSH\aoptiec.exeC:\UserDotSH\aoptiec.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2908
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.1MB
MD5795f93ca2328b8e88722a924792f97f8
SHA1d1a508fd76bb298f4849071370fd05bb1bbb83ef
SHA256094b9fe3475dc15d1abf057db2f169ccf0e6790bf0443540776b9249f3964154
SHA51228ab1a0d8b8da04fda9f71be4b979ed1c4ebea4b1b4f2e2b50f48b3863d3bd5ca720a890202800305f2cf82fb670727945d0ae8ea0156f4810d59aaa3e7816ef
-
Filesize
205B
MD5238d8b05425b76a6b67cb10486d363fd
SHA1f817424bfd980abe4f0d657d3b6f6fccff5fa767
SHA25662cf7f546a9436ef53c9d84d926a6075224a3691b8627ad4c6cf0ab056ca2046
SHA5123c86b61c511a3b91153bb623d2264bf8d3a4137a6c445fc16d4e1b3d6fdd34f030108bc6f147a566161c8f765d812606dacc85ccc5bc34d81f3f148282d40f9f
-
Filesize
4.1MB
MD5620b893c02621b3200b13a7dc47a262b
SHA19d45410e849f2eb053753f1df2764ddf2eef768a
SHA2567e6fed474e564cd905758791fcab26f7fb2932522001c3fb1f4f760fcd828ad0
SHA512e37b757516853d8ad3a9e3405c4f91c340339d9e8660705a8f2da1f706e56f400b92f2720490e6ef62149f74ca45c9b59f79f43d1e05b920a16594408acfa2ea