Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
03/06/2024, 21:16
Static task
static1
Behavioral task
behavioral1
Sample
4c9cdd61249483c4ef050c43a664fdfe8322cf82b07b914b94c9002e2979cd94.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
4c9cdd61249483c4ef050c43a664fdfe8322cf82b07b914b94c9002e2979cd94.exe
Resource
win10v2004-20240508-en
General
-
Target
4c9cdd61249483c4ef050c43a664fdfe8322cf82b07b914b94c9002e2979cd94.exe
-
Size
4.1MB
-
MD5
88ff053add827f525cb99740b26cc056
-
SHA1
da9f98795713cb42c7ff68b112de863cd9e3b6f4
-
SHA256
4c9cdd61249483c4ef050c43a664fdfe8322cf82b07b914b94c9002e2979cd94
-
SHA512
bff162de8ca248b3ced9c0387ff31fd71a1328d7bae74ab2d1248d8269f224822058e4cfa96898b79848df04306e0661ff1436e5a91af142d291c12c90e50e29
-
SSDEEP
49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB8B/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpDbVz8eLFcz
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxdob.exe 4c9cdd61249483c4ef050c43a664fdfe8322cf82b07b914b94c9002e2979cd94.exe -
Executes dropped EXE 2 IoCs
pid Process 2652 ecxdob.exe 1620 xoptiloc.exe -
Loads dropped DLL 2 IoCs
pid Process 2180 4c9cdd61249483c4ef050c43a664fdfe8322cf82b07b914b94c9002e2979cd94.exe 2180 4c9cdd61249483c4ef050c43a664fdfe8322cf82b07b914b94c9002e2979cd94.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\AdobeW7\\xoptiloc.exe" 4c9cdd61249483c4ef050c43a664fdfe8322cf82b07b914b94c9002e2979cd94.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\LabZTI\\dobxsys.exe" 4c9cdd61249483c4ef050c43a664fdfe8322cf82b07b914b94c9002e2979cd94.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2180 4c9cdd61249483c4ef050c43a664fdfe8322cf82b07b914b94c9002e2979cd94.exe 2180 4c9cdd61249483c4ef050c43a664fdfe8322cf82b07b914b94c9002e2979cd94.exe 2652 ecxdob.exe 1620 xoptiloc.exe 2652 ecxdob.exe 1620 xoptiloc.exe 2652 ecxdob.exe 1620 xoptiloc.exe 2652 ecxdob.exe 1620 xoptiloc.exe 2652 ecxdob.exe 1620 xoptiloc.exe 2652 ecxdob.exe 1620 xoptiloc.exe 2652 ecxdob.exe 1620 xoptiloc.exe 2652 ecxdob.exe 1620 xoptiloc.exe 2652 ecxdob.exe 1620 xoptiloc.exe 2652 ecxdob.exe 1620 xoptiloc.exe 2652 ecxdob.exe 1620 xoptiloc.exe 2652 ecxdob.exe 1620 xoptiloc.exe 2652 ecxdob.exe 1620 xoptiloc.exe 2652 ecxdob.exe 1620 xoptiloc.exe 2652 ecxdob.exe 1620 xoptiloc.exe 2652 ecxdob.exe 1620 xoptiloc.exe 2652 ecxdob.exe 1620 xoptiloc.exe 2652 ecxdob.exe 1620 xoptiloc.exe 2652 ecxdob.exe 1620 xoptiloc.exe 2652 ecxdob.exe 1620 xoptiloc.exe 2652 ecxdob.exe 1620 xoptiloc.exe 2652 ecxdob.exe 1620 xoptiloc.exe 2652 ecxdob.exe 1620 xoptiloc.exe 2652 ecxdob.exe 1620 xoptiloc.exe 2652 ecxdob.exe 1620 xoptiloc.exe 2652 ecxdob.exe 1620 xoptiloc.exe 2652 ecxdob.exe 1620 xoptiloc.exe 2652 ecxdob.exe 1620 xoptiloc.exe 2652 ecxdob.exe 1620 xoptiloc.exe 2652 ecxdob.exe 1620 xoptiloc.exe 2652 ecxdob.exe 1620 xoptiloc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2180 wrote to memory of 2652 2180 4c9cdd61249483c4ef050c43a664fdfe8322cf82b07b914b94c9002e2979cd94.exe 28 PID 2180 wrote to memory of 2652 2180 4c9cdd61249483c4ef050c43a664fdfe8322cf82b07b914b94c9002e2979cd94.exe 28 PID 2180 wrote to memory of 2652 2180 4c9cdd61249483c4ef050c43a664fdfe8322cf82b07b914b94c9002e2979cd94.exe 28 PID 2180 wrote to memory of 2652 2180 4c9cdd61249483c4ef050c43a664fdfe8322cf82b07b914b94c9002e2979cd94.exe 28 PID 2180 wrote to memory of 1620 2180 4c9cdd61249483c4ef050c43a664fdfe8322cf82b07b914b94c9002e2979cd94.exe 29 PID 2180 wrote to memory of 1620 2180 4c9cdd61249483c4ef050c43a664fdfe8322cf82b07b914b94c9002e2979cd94.exe 29 PID 2180 wrote to memory of 1620 2180 4c9cdd61249483c4ef050c43a664fdfe8322cf82b07b914b94c9002e2979cd94.exe 29 PID 2180 wrote to memory of 1620 2180 4c9cdd61249483c4ef050c43a664fdfe8322cf82b07b914b94c9002e2979cd94.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c9cdd61249483c4ef050c43a664fdfe8322cf82b07b914b94c9002e2979cd94.exe"C:\Users\Admin\AppData\Local\Temp\4c9cdd61249483c4ef050c43a664fdfe8322cf82b07b914b94c9002e2979cd94.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxdob.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxdob.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2652
-
-
C:\AdobeW7\xoptiloc.exeC:\AdobeW7\xoptiloc.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1620
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29KB
MD5c2b58e7bd0d9d36929797d78aa1d3e51
SHA18fc011635fc3980b8429b2956954a84ef4f62f48
SHA256d5277dd43fac6b920dc73e189c8ce3c2b5d25215f887f88a07155db345eeb18c
SHA51278c62f3f40b38eb2f380b786661968a0da8840a04924336873b4f4aceba9dd3bd8652ebb78ce9ba2b6128880c6d2ac12c784def607e382a7ede8e458ed4932e0
-
Filesize
15KB
MD562f17a18e2665228331086e6e938bfcc
SHA18e2aada25ef3eee33045d7c08ce27d04adfb7da4
SHA2561f30a15b454a01e1f02a566860b6dea8fe2debfee04aa9dcd02eff1b374b5385
SHA5120cde9444b74a958f01e657a2f49550b28dac6697a6d01cdde84a080468781943e73e4ca36b1efb6ce7bebd85c014c8ebf526f60943adf83ef100be6249c3a5f3
-
Filesize
4.1MB
MD50b5e47d160f4f8c442525bc38ad08cb9
SHA15e3f4e2b766f79e04a3833af4e3eeeecd153ea8d
SHA256434719fe6980220acebba5aef601d7957e0b27fe776495a41e72936b96d564c3
SHA512ccf004324feaaba5d4c84cf96298100275a32113fe0fce7851a1d106af75d3404913f67cea5d95b6cedf15bac11e7b81504e98d2182b46ed28c7753f4edbec4b
-
Filesize
168B
MD5e55b80a88e77e986deaafdf6c98ed3ac
SHA17c0fe97a70c38ad2c28d0560e215dd230f58bcfd
SHA256210b40035526568956d862ccf7a98eeb84dad6ac307440bb3c0115a5295a091b
SHA512332ec6c6042068ac3b0e526154251fea941bcf13046fa8624b3ac5d19078c4c4a8a7bc73756868403b56c1beb2a875d1f47715c590afc4abd661d0da7d25f7ea
-
Filesize
200B
MD5e58834da36b77dfbd101410e98f10572
SHA164468ad2e7b02ca0c30acbed5b1490e0a00d2829
SHA25679b33e1ede8245b0f97dcba01af1a91f89267badc171e3032d9b284b7f7a0eec
SHA512529f6dd864a9d5b2bd5bfd2403e41b2165ceaf97dadb32ea8b93b05824d34a69715f7878ad60b7eb5088452548af67672ffb541cb8373ae43b133aef7373fc2d
-
Filesize
4.1MB
MD50f9398f6279e19a0db1b90a470abc98e
SHA1ac2709c85992c339e43bde9f4dec6f0315e8d8d3
SHA2567efc0ec6f369ebdcb46be998e0207d3475e539298c07dd50b42928790c188908
SHA5126d8fad7f8c94adf8d92ca47b0be0c3547204894c25e43739fcb8551feaddf1cfd5e0d95774299579568e0bb67e1f641ecb5413b8ed91ae884b6bebe99d98dec4
-
Filesize
4.1MB
MD5408df2326490f484b2c8e7fad73dcbc4
SHA14821dbf490a019006efede9c1f5277ff7c863ba1
SHA25684c982b2f3c5e69771ce5bdfdbf99a89cf4c5e664525adba737dba99d4d15c92
SHA512aa6c38b8e7899b3e6dbf62f95ec4467553b9c467a0e4840ff97f6feca0f8dd462c7c5b5d598d89578660a9fe672142aacb4d60e651a402eb3e4ca54752e7b500