Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

2c4d68f6bb...3b.exe

windows7-x64

7

2c4d68f6bb...3b.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    19/06/2024, 20:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2c4d68f6bbef67ee10e0582e5ac04f1360b7966cdf86ff2c971e653c1dc4db3b.exe

  • Size

    4.1MB

  • MD5

    8811ce4604bacfe1a85d264646ab7131

  • SHA1

    bbd6887720549ba3514ecc06a974043bd558fe4c

  • SHA256

    2c4d68f6bbef67ee10e0582e5ac04f1360b7966cdf86ff2c971e653c1dc4db3b

  • SHA512

    c826438472b29e405c73948770180dc9efe24a472912d26a9d6b032f241313574bd5d0fc3f092f3723e3b5845bdf6a781fb693be28c932d3edef0c133a852838

  • SSDEEP

    98304:+R0pI/IQlUoMPdmpSpR4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmO5n9klRKN41v

Score
7/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2c4d68f6bbef67ee10e0582e5ac04f1360b7966cdf86ff2c971e653c1dc4db3b.exe
    "C:\Users\Admin\AppData\Local\Temp\2c4d68f6bbef67ee10e0582e5ac04f1360b7966cdf86ff2c971e653c1dc4db3b.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2976
    • C:\Files3M\devbodloc.exe
      C:\Files3M\devbodloc.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:2120

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\LabZK6\dobasys.exe
    Filesize

    4.1MB

    MD5

    5d7b527a1a32fb3c30ff6feb12db372d

    SHA1

    8411650cbe854e496c87a251799973de5cba648c

    SHA256

    7e6aba1758bda2edcf0cb4e2715518c39222f29e1c043fc730dcf317142ce01a

    SHA512

    1fa7fe7b83601882708594cf4d1d1cc89fdb0921f3de65af9d01b935e9864680218d76f9d214f5e7f9eda98c330672c0a6224337febc8d10bde850c67678f285

    Download Submit

  • C:\Users\Admin\253086396416_6.1_Admin.ini
    Filesize

    202B

    MD5

    d0585afa749e3ed7055e353f0c6edeb0

    SHA1

    42351ed0b1fb86dcd811633573c5304d5052b0a8

    SHA256

    0a8b380c3dea2e9679e7dc1816c1af5df4e041cac95216c8ce2cae4cd97a0b63

    SHA512

    77cd79e601fe7d3bdf1050ab3077ed5ad745799f6898535c3e94d8af165c581cb0ed850283fbdb1741a2f42833d90cf1e3d705fc03afc08c39721195a7a4d207

    Download Submit

  • \Files3M\devbodloc.exe
    Filesize

    4.1MB

    MD5

    57b2068c61e805b6d8ac5893a593029b

    SHA1

    1d34a6b94d61de4f5e4dbb98418de60644ee5712

    SHA256

    1093a3122cd3c2397f8a708693e0ae8e7f2e529ec7dbd3b1691b2b934e63009e

    SHA512

    884ca876f971397bc6f299929b0f99ed493aada711b145c58a9b5c31abff381151f46981bae594c42f6cd8f6b6b90959a68be99891c0d2abc94f628e0c4efe85

    Download Submit