Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
03/06/2024, 05:07
Static task
static1
Behavioral task
behavioral1
Sample
eaf61d95ac62fec0bb3923fd92f449442fac8cbb00c922793cfef7813a1e22a6.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
eaf61d95ac62fec0bb3923fd92f449442fac8cbb00c922793cfef7813a1e22a6.exe
Resource
win10v2004-20240426-en
General
-
Target
eaf61d95ac62fec0bb3923fd92f449442fac8cbb00c922793cfef7813a1e22a6.exe
-
Size
4.1MB
-
MD5
7a02eff6c96018d0b403bb84741dd38d
-
SHA1
06f73c13cefbf78d08d59fa800c8bbeda3d92202
-
SHA256
eaf61d95ac62fec0bb3923fd92f449442fac8cbb00c922793cfef7813a1e22a6
-
SHA512
75e318e9119f3ad5792eb9c52c29938b9c7502cc2bed678dfb77b0a05974dcd78d676453ca21e42733f9a050645df397cf03a1c113485ee84cb44e7881a3eef8
-
SSDEEP
98304:+R0pI/IQlUoMPdmpSpa4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdm15n9klRKN41v
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3052 xdobec.exe -
Loads dropped DLL 1 IoCs
pid Process 2180 eaf61d95ac62fec0bb3923fd92f449442fac8cbb00c922793cfef7813a1e22a6.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrvL5\\xdobec.exe" eaf61d95ac62fec0bb3923fd92f449442fac8cbb00c922793cfef7813a1e22a6.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\GalaxC7\\optixloc.exe" eaf61d95ac62fec0bb3923fd92f449442fac8cbb00c922793cfef7813a1e22a6.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2180 eaf61d95ac62fec0bb3923fd92f449442fac8cbb00c922793cfef7813a1e22a6.exe 2180 eaf61d95ac62fec0bb3923fd92f449442fac8cbb00c922793cfef7813a1e22a6.exe 3052 xdobec.exe 2180 eaf61d95ac62fec0bb3923fd92f449442fac8cbb00c922793cfef7813a1e22a6.exe 3052 xdobec.exe 2180 eaf61d95ac62fec0bb3923fd92f449442fac8cbb00c922793cfef7813a1e22a6.exe 3052 xdobec.exe 2180 eaf61d95ac62fec0bb3923fd92f449442fac8cbb00c922793cfef7813a1e22a6.exe 3052 xdobec.exe 2180 eaf61d95ac62fec0bb3923fd92f449442fac8cbb00c922793cfef7813a1e22a6.exe 3052 xdobec.exe 2180 eaf61d95ac62fec0bb3923fd92f449442fac8cbb00c922793cfef7813a1e22a6.exe 3052 xdobec.exe 2180 eaf61d95ac62fec0bb3923fd92f449442fac8cbb00c922793cfef7813a1e22a6.exe 3052 xdobec.exe 2180 eaf61d95ac62fec0bb3923fd92f449442fac8cbb00c922793cfef7813a1e22a6.exe 3052 xdobec.exe 2180 eaf61d95ac62fec0bb3923fd92f449442fac8cbb00c922793cfef7813a1e22a6.exe 3052 xdobec.exe 2180 eaf61d95ac62fec0bb3923fd92f449442fac8cbb00c922793cfef7813a1e22a6.exe 3052 xdobec.exe 2180 eaf61d95ac62fec0bb3923fd92f449442fac8cbb00c922793cfef7813a1e22a6.exe 3052 xdobec.exe 2180 eaf61d95ac62fec0bb3923fd92f449442fac8cbb00c922793cfef7813a1e22a6.exe 3052 xdobec.exe 2180 eaf61d95ac62fec0bb3923fd92f449442fac8cbb00c922793cfef7813a1e22a6.exe 3052 xdobec.exe 2180 eaf61d95ac62fec0bb3923fd92f449442fac8cbb00c922793cfef7813a1e22a6.exe 3052 xdobec.exe 2180 eaf61d95ac62fec0bb3923fd92f449442fac8cbb00c922793cfef7813a1e22a6.exe 3052 xdobec.exe 2180 eaf61d95ac62fec0bb3923fd92f449442fac8cbb00c922793cfef7813a1e22a6.exe 3052 xdobec.exe 2180 eaf61d95ac62fec0bb3923fd92f449442fac8cbb00c922793cfef7813a1e22a6.exe 3052 xdobec.exe 2180 eaf61d95ac62fec0bb3923fd92f449442fac8cbb00c922793cfef7813a1e22a6.exe 3052 xdobec.exe 2180 eaf61d95ac62fec0bb3923fd92f449442fac8cbb00c922793cfef7813a1e22a6.exe 3052 xdobec.exe 2180 eaf61d95ac62fec0bb3923fd92f449442fac8cbb00c922793cfef7813a1e22a6.exe 3052 xdobec.exe 2180 eaf61d95ac62fec0bb3923fd92f449442fac8cbb00c922793cfef7813a1e22a6.exe 3052 xdobec.exe 2180 eaf61d95ac62fec0bb3923fd92f449442fac8cbb00c922793cfef7813a1e22a6.exe 3052 xdobec.exe 2180 eaf61d95ac62fec0bb3923fd92f449442fac8cbb00c922793cfef7813a1e22a6.exe 3052 xdobec.exe 2180 eaf61d95ac62fec0bb3923fd92f449442fac8cbb00c922793cfef7813a1e22a6.exe 3052 xdobec.exe 2180 eaf61d95ac62fec0bb3923fd92f449442fac8cbb00c922793cfef7813a1e22a6.exe 3052 xdobec.exe 2180 eaf61d95ac62fec0bb3923fd92f449442fac8cbb00c922793cfef7813a1e22a6.exe 3052 xdobec.exe 2180 eaf61d95ac62fec0bb3923fd92f449442fac8cbb00c922793cfef7813a1e22a6.exe 3052 xdobec.exe 2180 eaf61d95ac62fec0bb3923fd92f449442fac8cbb00c922793cfef7813a1e22a6.exe 3052 xdobec.exe 2180 eaf61d95ac62fec0bb3923fd92f449442fac8cbb00c922793cfef7813a1e22a6.exe 3052 xdobec.exe 2180 eaf61d95ac62fec0bb3923fd92f449442fac8cbb00c922793cfef7813a1e22a6.exe 3052 xdobec.exe 2180 eaf61d95ac62fec0bb3923fd92f449442fac8cbb00c922793cfef7813a1e22a6.exe 3052 xdobec.exe 2180 eaf61d95ac62fec0bb3923fd92f449442fac8cbb00c922793cfef7813a1e22a6.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2180 wrote to memory of 3052 2180 eaf61d95ac62fec0bb3923fd92f449442fac8cbb00c922793cfef7813a1e22a6.exe 28 PID 2180 wrote to memory of 3052 2180 eaf61d95ac62fec0bb3923fd92f449442fac8cbb00c922793cfef7813a1e22a6.exe 28 PID 2180 wrote to memory of 3052 2180 eaf61d95ac62fec0bb3923fd92f449442fac8cbb00c922793cfef7813a1e22a6.exe 28 PID 2180 wrote to memory of 3052 2180 eaf61d95ac62fec0bb3923fd92f449442fac8cbb00c922793cfef7813a1e22a6.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\eaf61d95ac62fec0bb3923fd92f449442fac8cbb00c922793cfef7813a1e22a6.exe"C:\Users\Admin\AppData\Local\Temp\eaf61d95ac62fec0bb3923fd92f449442fac8cbb00c922793cfef7813a1e22a6.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\SysDrvL5\xdobec.exeC:\SysDrvL5\xdobec.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3052
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.1MB
MD5a34da82c81a67873de95678ed4e5e66d
SHA181354378f573cb25ea72599fe503fd501c6c5dc0
SHA2569a3b4486e46b19d14b8126667cb245c163c1236b3e3188ad4a0c90de3d936c5e
SHA512d4aa9836c394c646a798339e120872e0cb09ed75d4198c756d2a010b4dce603fb4ea2d6e018c54e7a6369a9be19293181656a9ad611e69427d64ddd8846c14dc
-
Filesize
204B
MD5e3c6cf5977364e82306083c36d1cd41d
SHA1bb76116f94958e612753ca04701fa0fefc6e31a7
SHA256c615e4303f3c009ab1c829a245ba4683c077ca418a753b4ef6ce44e1165e179c
SHA5128208bf09d0760ba4c97c36781d5773c079d3ecd117436ac3bb166e6988d0db84341c938cc9cfa9bc755f64e24005481463f831a0554ce1108ad730ef2eaecbb3
-
Filesize
4.1MB
MD54d8b4f713a0d79165498db26233be154
SHA1d66caa76fe61bc954d72b441cd5bebbd7569e29a
SHA256c63242ba8b5ecba516fe968cda5faf53f6daf2e5e74c494e9801ae42c289ae1b
SHA5124ae6004e03a62536743c7d6a468f6fa48eb64eecddfc5c7adcf65b54178991e85b39d8e5e084aa18978531995b83a756e4b80094d17d6b43b97dd7ffff2f8831