Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

ae2f56cac9...2a.exe

windows7-x64

7

ae2f56cac9...2a.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    134s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/06/2024, 01:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ae2f56cac952e09d564ef10b5856cd04ddb4b9c2e63659449fdf702089537a2a.exe

  • Size

    4.1MB

  • MD5

    92d386c9f7ada34b492f0fda97bed78b

  • SHA1

    148603e84e07069f71cb076a2c63ca40dd50b152

  • SHA256

    ae2f56cac952e09d564ef10b5856cd04ddb4b9c2e63659449fdf702089537a2a

  • SHA512

    81bbdb1a966c85bdf46d021ff7bba1bdfec9e9e726198bf9847b0bfbd387c4117b6443a048fc764a761f3ef94c1a1fa97ce32e5fd456e3553c9cae20e63a6aaa

  • SSDEEP

    98304:+R0pI/IQlUoMPdmpSpr4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmo5n9klRKN41v

Score
7/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ae2f56cac952e09d564ef10b5856cd04ddb4b9c2e63659449fdf702089537a2a.exe
    "C:\Users\Admin\AppData\Local\Temp\ae2f56cac952e09d564ef10b5856cd04ddb4b9c2e63659449fdf702089537a2a.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:692
    • C:\FilesX1\abodloc.exe
      C:\FilesX1\abodloc.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:908
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4372,i,3724086843943218842,1026644135694712596,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:8
    1⤵
      PID:2732

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\FilesX1\abodloc.exe
      Filesize

      4.1MB

      MD5

      6c7ff6a53d28c9fa455946c673b6932e

      SHA1

      0d1426ebf8b396bbc9f8dfc9f38c4f5ae0c64831

      SHA256

      7894d44c755b8709b76d665104fcb9c2883d5d38270d175a3d64537b7ffd7c3d

      SHA512

      c08dcc6a9efc240804829547a82b5683c2650e2e0a68a68c037ada892b688b9820e8c5b36c158ffb820a391f21040b627b806a87626e5862cfdd07033dbdc8e7

      Download Submit

    • C:\Users\Admin\253086396416_10.0_Admin.ini
      Filesize

      201B

      MD5

      5079742c4968e43f72a11676041594bd

      SHA1

      b9426f3449ade2891fc6120c750bc13c7bc701d4

      SHA256

      ea601eabe6b99ef5a12a5ff8ff57649313f8a244b157b464fc1bac68b0e7059f

      SHA512

      5cac723c4ef3cbdc56d79056afccd94f42395c151eca5d77737d70bee1724c40b9b6ac93127a824514ba11f46b690e08febca265e88e3daf55d2473b71b24104

      Download Submit

    • C:\Vid8K\optixloc.exe
      Filesize

      4.1MB

      MD5

      6d0a18857ba6f9161a556a5d74c8b14f

      SHA1

      50aad36b83851708e36d811fb45ba5be1223a336

      SHA256

      6f1bd15e6bebb5a186497360d55a761c52f8aed2d03832e6878e83ecd79acc14

      SHA512

      1ace0164ec5a1ae4ded1a47ceef3e3a972960ee98409755e8a18c5bee0db33dd3bbc442218e83b00c39a09d1fce9163c7c799847bbb73c76f4da9c45fd0ff4db

      Download Submit