Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    03/06/2024, 05:07

General

  • Target

    eaf61d95ac62fec0bb3923fd92f449442fac8cbb00c922793cfef7813a1e22a6.exe

  • Size

    4.1MB

  • MD5

    7a02eff6c96018d0b403bb84741dd38d

  • SHA1

    06f73c13cefbf78d08d59fa800c8bbeda3d92202

  • SHA256

    eaf61d95ac62fec0bb3923fd92f449442fac8cbb00c922793cfef7813a1e22a6

  • SHA512

    75e318e9119f3ad5792eb9c52c29938b9c7502cc2bed678dfb77b0a05974dcd78d676453ca21e42733f9a050645df397cf03a1c113485ee84cb44e7881a3eef8

  • SSDEEP

    98304:+R0pI/IQlUoMPdmpSpa4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdm15n9klRKN41v

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eaf61d95ac62fec0bb3923fd92f449442fac8cbb00c922793cfef7813a1e22a6.exe
    "C:\Users\Admin\AppData\Local\Temp\eaf61d95ac62fec0bb3923fd92f449442fac8cbb00c922793cfef7813a1e22a6.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2180
    • C:\SysDrvL5\xdobec.exe
      C:\SysDrvL5\xdobec.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:3052

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\GalaxC7\optixloc.exe

    Filesize

    4.1MB

    MD5

    a34da82c81a67873de95678ed4e5e66d

    SHA1

    81354378f573cb25ea72599fe503fd501c6c5dc0

    SHA256

    9a3b4486e46b19d14b8126667cb245c163c1236b3e3188ad4a0c90de3d936c5e

    SHA512

    d4aa9836c394c646a798339e120872e0cb09ed75d4198c756d2a010b4dce603fb4ea2d6e018c54e7a6369a9be19293181656a9ad611e69427d64ddd8846c14dc

  • C:\Users\Admin\253086396416_6.1_Admin.ini

    Filesize

    204B

    MD5

    e3c6cf5977364e82306083c36d1cd41d

    SHA1

    bb76116f94958e612753ca04701fa0fefc6e31a7

    SHA256

    c615e4303f3c009ab1c829a245ba4683c077ca418a753b4ef6ce44e1165e179c

    SHA512

    8208bf09d0760ba4c97c36781d5773c079d3ecd117436ac3bb166e6988d0db84341c938cc9cfa9bc755f64e24005481463f831a0554ce1108ad730ef2eaecbb3

  • \SysDrvL5\xdobec.exe

    Filesize

    4.1MB

    MD5

    4d8b4f713a0d79165498db26233be154

    SHA1

    d66caa76fe61bc954d72b441cd5bebbd7569e29a

    SHA256

    c63242ba8b5ecba516fe968cda5faf53f6daf2e5e74c494e9801ae42c289ae1b

    SHA512

    4ae6004e03a62536743c7d6a468f6fa48eb64eecddfc5c7adcf65b54178991e85b39d8e5e084aa18978531995b83a756e4b80094d17d6b43b97dd7ffff2f8831