Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

122fd9b654...f5.exe

windows7-x64

7

122fd9b654...f5.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    105s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/05/2024, 18:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    122fd9b654f5ec30573998f3f18931055abcfdce32e26269e05f4277ae5171f5.exe

  • Size

    4.1MB

  • MD5

    9aed14432c1e48e3e0a69bca2686b11a

  • SHA1

    8274d4cfbe36f0aed3ea3278764a9a4d696c3938

  • SHA256

    122fd9b654f5ec30573998f3f18931055abcfdce32e26269e05f4277ae5171f5

  • SHA512

    c57f8ad5a98c3ca6889cd8af82e2117b93199c2ef50a8597c16bbeb05d439e3306ccfede07e6326817cee13ef8de1e18b3ac57abac462b3fdb60e56a4177844f

  • SSDEEP

    98304:+R0pI/IQlUoMPdmpSpv4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdm85n9klRKN41v

Score
7/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\122fd9b654f5ec30573998f3f18931055abcfdce32e26269e05f4277ae5171f5.exe
    "C:\Users\Admin\AppData\Local\Temp\122fd9b654f5ec30573998f3f18931055abcfdce32e26269e05f4277ae5171f5.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3916
    • C:\IntelprocST\xdobloc.exe
      C:\IntelprocST\xdobloc.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:3948

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\IntelprocST\xdobloc.exe
    Filesize

    4.1MB

    MD5

    ffb80fee45abd2d1a4949d2a5625667f

    SHA1

    c6abc112b7c4697ded1352d085740bee28c20db4

    SHA256

    07192114698a480cca7f78640c3461d68692e29068a8a8b74a4623598085c7bc

    SHA512

    4de369037125360c917ea4eadfd12e35beea6d3f650f20b833e5dc7ba0a6234ca746b119f23ecd558d78e2d8c92fa9e78f618c4c3b859b16582a7900f0b88ff9

    Download Submit

  • C:\LabZXD\bodxloc.exe
    Filesize

    4.1MB

    MD5

    991faf7ff85412bc7baf73116a010d3f

    SHA1

    b2ff2ccd28e2f28bb37688987b68c35485df038e

    SHA256

    1b50abb75b298567174e33b6eed54db57b056f01b70e59671b60dac3aa44cd7a

    SHA512

    ccf6bb6830135b2ec91590218cbd72e7d75f87ac659633a663bfde35ca04e21bd2212f165fc4b096322c2f277f5feefc56593b832234d415a0a789691eaa052e

    Download Submit

  • C:\Users\Admin\253086396416_10.0_Admin.ini
    Filesize

    204B

    MD5

    67009ce475d757ab74b80d69b82c4d15

    SHA1

    497882296bc1bfa566e2b7d51940730eba4a663e

    SHA256

    0cbc333010279d2a96f5912aebfdb0dcab70ad10d7ea0b680e74e981277f92af

    SHA512

    19684d4f8d00139dce17e9dc89e6a610f98c927c0c67571a0ccab97f9568f3c0f9aac3792028fc057dc0abaf4c034a3ceff31fd374c9b9b330d8f836be97ed00

    Download Submit