Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04/06/2024, 01:31
Static task
static1
Behavioral task
behavioral1
Sample
ae2f56cac952e09d564ef10b5856cd04ddb4b9c2e63659449fdf702089537a2a.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ae2f56cac952e09d564ef10b5856cd04ddb4b9c2e63659449fdf702089537a2a.exe
Resource
win10v2004-20240508-en
General
-
Target
ae2f56cac952e09d564ef10b5856cd04ddb4b9c2e63659449fdf702089537a2a.exe
-
Size
4.1MB
-
MD5
92d386c9f7ada34b492f0fda97bed78b
-
SHA1
148603e84e07069f71cb076a2c63ca40dd50b152
-
SHA256
ae2f56cac952e09d564ef10b5856cd04ddb4b9c2e63659449fdf702089537a2a
-
SHA512
81bbdb1a966c85bdf46d021ff7bba1bdfec9e9e726198bf9847b0bfbd387c4117b6443a048fc764a761f3ef94c1a1fa97ce32e5fd456e3553c9cae20e63a6aaa
-
SSDEEP
98304:+R0pI/IQlUoMPdmpSpr4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmo5n9klRKN41v
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1984 devoptiec.exe -
Loads dropped DLL 1 IoCs
pid Process 2120 ae2f56cac952e09d564ef10b5856cd04ddb4b9c2e63659449fdf702089537a2a.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDotW0\\devoptiec.exe" ae2f56cac952e09d564ef10b5856cd04ddb4b9c2e63659449fdf702089537a2a.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\GalaxS0\\boddevsys.exe" ae2f56cac952e09d564ef10b5856cd04ddb4b9c2e63659449fdf702089537a2a.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2120 ae2f56cac952e09d564ef10b5856cd04ddb4b9c2e63659449fdf702089537a2a.exe 2120 ae2f56cac952e09d564ef10b5856cd04ddb4b9c2e63659449fdf702089537a2a.exe 1984 devoptiec.exe 2120 ae2f56cac952e09d564ef10b5856cd04ddb4b9c2e63659449fdf702089537a2a.exe 1984 devoptiec.exe 2120 ae2f56cac952e09d564ef10b5856cd04ddb4b9c2e63659449fdf702089537a2a.exe 1984 devoptiec.exe 2120 ae2f56cac952e09d564ef10b5856cd04ddb4b9c2e63659449fdf702089537a2a.exe 1984 devoptiec.exe 2120 ae2f56cac952e09d564ef10b5856cd04ddb4b9c2e63659449fdf702089537a2a.exe 1984 devoptiec.exe 2120 ae2f56cac952e09d564ef10b5856cd04ddb4b9c2e63659449fdf702089537a2a.exe 1984 devoptiec.exe 2120 ae2f56cac952e09d564ef10b5856cd04ddb4b9c2e63659449fdf702089537a2a.exe 1984 devoptiec.exe 2120 ae2f56cac952e09d564ef10b5856cd04ddb4b9c2e63659449fdf702089537a2a.exe 1984 devoptiec.exe 2120 ae2f56cac952e09d564ef10b5856cd04ddb4b9c2e63659449fdf702089537a2a.exe 1984 devoptiec.exe 2120 ae2f56cac952e09d564ef10b5856cd04ddb4b9c2e63659449fdf702089537a2a.exe 1984 devoptiec.exe 2120 ae2f56cac952e09d564ef10b5856cd04ddb4b9c2e63659449fdf702089537a2a.exe 1984 devoptiec.exe 2120 ae2f56cac952e09d564ef10b5856cd04ddb4b9c2e63659449fdf702089537a2a.exe 1984 devoptiec.exe 2120 ae2f56cac952e09d564ef10b5856cd04ddb4b9c2e63659449fdf702089537a2a.exe 1984 devoptiec.exe 2120 ae2f56cac952e09d564ef10b5856cd04ddb4b9c2e63659449fdf702089537a2a.exe 1984 devoptiec.exe 2120 ae2f56cac952e09d564ef10b5856cd04ddb4b9c2e63659449fdf702089537a2a.exe 1984 devoptiec.exe 2120 ae2f56cac952e09d564ef10b5856cd04ddb4b9c2e63659449fdf702089537a2a.exe 1984 devoptiec.exe 2120 ae2f56cac952e09d564ef10b5856cd04ddb4b9c2e63659449fdf702089537a2a.exe 1984 devoptiec.exe 2120 ae2f56cac952e09d564ef10b5856cd04ddb4b9c2e63659449fdf702089537a2a.exe 1984 devoptiec.exe 2120 ae2f56cac952e09d564ef10b5856cd04ddb4b9c2e63659449fdf702089537a2a.exe 1984 devoptiec.exe 2120 ae2f56cac952e09d564ef10b5856cd04ddb4b9c2e63659449fdf702089537a2a.exe 1984 devoptiec.exe 2120 ae2f56cac952e09d564ef10b5856cd04ddb4b9c2e63659449fdf702089537a2a.exe 1984 devoptiec.exe 2120 ae2f56cac952e09d564ef10b5856cd04ddb4b9c2e63659449fdf702089537a2a.exe 1984 devoptiec.exe 2120 ae2f56cac952e09d564ef10b5856cd04ddb4b9c2e63659449fdf702089537a2a.exe 1984 devoptiec.exe 2120 ae2f56cac952e09d564ef10b5856cd04ddb4b9c2e63659449fdf702089537a2a.exe 1984 devoptiec.exe 2120 ae2f56cac952e09d564ef10b5856cd04ddb4b9c2e63659449fdf702089537a2a.exe 1984 devoptiec.exe 2120 ae2f56cac952e09d564ef10b5856cd04ddb4b9c2e63659449fdf702089537a2a.exe 1984 devoptiec.exe 2120 ae2f56cac952e09d564ef10b5856cd04ddb4b9c2e63659449fdf702089537a2a.exe 1984 devoptiec.exe 2120 ae2f56cac952e09d564ef10b5856cd04ddb4b9c2e63659449fdf702089537a2a.exe 1984 devoptiec.exe 2120 ae2f56cac952e09d564ef10b5856cd04ddb4b9c2e63659449fdf702089537a2a.exe 1984 devoptiec.exe 2120 ae2f56cac952e09d564ef10b5856cd04ddb4b9c2e63659449fdf702089537a2a.exe 1984 devoptiec.exe 2120 ae2f56cac952e09d564ef10b5856cd04ddb4b9c2e63659449fdf702089537a2a.exe 1984 devoptiec.exe 2120 ae2f56cac952e09d564ef10b5856cd04ddb4b9c2e63659449fdf702089537a2a.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2120 wrote to memory of 1984 2120 ae2f56cac952e09d564ef10b5856cd04ddb4b9c2e63659449fdf702089537a2a.exe 28 PID 2120 wrote to memory of 1984 2120 ae2f56cac952e09d564ef10b5856cd04ddb4b9c2e63659449fdf702089537a2a.exe 28 PID 2120 wrote to memory of 1984 2120 ae2f56cac952e09d564ef10b5856cd04ddb4b9c2e63659449fdf702089537a2a.exe 28 PID 2120 wrote to memory of 1984 2120 ae2f56cac952e09d564ef10b5856cd04ddb4b9c2e63659449fdf702089537a2a.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae2f56cac952e09d564ef10b5856cd04ddb4b9c2e63659449fdf702089537a2a.exe"C:\Users\Admin\AppData\Local\Temp\ae2f56cac952e09d564ef10b5856cd04ddb4b9c2e63659449fdf702089537a2a.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\UserDotW0\devoptiec.exeC:\UserDotW0\devoptiec.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1984
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.1MB
MD5e98950a06db2256a6bddbf99a914a42d
SHA1fdc0da4f9cc3c0ef84ac1615a5af79216fde4b00
SHA25641aa0f799e36380a52fe48bd4bd7b70a74562bd16248ca878ab7dfd44a26c1da
SHA51256fbae4406f47e2a7179c7e862a15a7ab6d5f5dc8784631d8de45e403fdfa344c4febd8f71ad0d611d7a4d9c8bca4984954eb36d7674bc5bca8d4d36e6a9c6ab
-
Filesize
210B
MD522d57e34fbab6ac0bbb490a5af54ec18
SHA1b728a5fe4a45fc52f33def57a652ccd336187433
SHA256943d4a738cac974daefa13322f0e95300442f3744bcdeb0df96c5ae69abbe0a2
SHA512655cea65e5aa04730395736302e72c8122043cd1f38d099273231d72eea24c6ea7d3471b85b641a5f5512d822c5a902a66189814e5ce4ec43bd2d0f121800e5d
-
Filesize
4.1MB
MD594dcf9a91bae0408b2b510c62a2b9fa4
SHA19bfa0bcc960dc71df7d57e3c5a3fe90e08768623
SHA256e95ae7cdf149f3670ab9137d3879afa52805f1383f976f942cd0ad831dc1e48d
SHA512d1881cc2776557b229dd338eaee60ebf7cabb02912db972a9fc2d5fbccc8ba7724ec31023948756d45cab1edc462334c24aa99f70090fc8c8a776529d1086829