Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

2c4d68f6bb...3b.exe

windows7-x64

7

2c4d68f6bb...3b.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/06/2024, 20:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2c4d68f6bbef67ee10e0582e5ac04f1360b7966cdf86ff2c971e653c1dc4db3b.exe

  • Size

    4.1MB

  • MD5

    8811ce4604bacfe1a85d264646ab7131

  • SHA1

    bbd6887720549ba3514ecc06a974043bd558fe4c

  • SHA256

    2c4d68f6bbef67ee10e0582e5ac04f1360b7966cdf86ff2c971e653c1dc4db3b

  • SHA512

    c826438472b29e405c73948770180dc9efe24a472912d26a9d6b032f241313574bd5d0fc3f092f3723e3b5845bdf6a781fb693be28c932d3edef0c133a852838

  • SSDEEP

    98304:+R0pI/IQlUoMPdmpSpR4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmO5n9klRKN41v

Score
7/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2c4d68f6bbef67ee10e0582e5ac04f1360b7966cdf86ff2c971e653c1dc4db3b.exe
    "C:\Users\Admin\AppData\Local\Temp\2c4d68f6bbef67ee10e0582e5ac04f1360b7966cdf86ff2c971e653c1dc4db3b.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4644
    • C:\Files0I\adobec.exe
      C:\Files0I\adobec.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:3720
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4420,i,6870419347051655189,5491911050420577193,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:8
    1⤵
      PID:448

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Files0I\adobec.exe
      Filesize

      4.1MB

      MD5

      352d298af8de553fc8bdb206bae6fb27

      SHA1

      05a9c645f7eb39c2410589280d841ebba83f56ec

      SHA256

      3edaa1096d7de9285babb3de57ea04fa046d6a13c9a2097dcdd36a6f0f8c5687

      SHA512

      33516c02357aa5f719d64b1be1496803334eaa200ac25e06c62cca0922e7371fce1f0ed3167334ec3c66bc8fd18cf482a57dc8df91fba98cf1f4ccfc0f328fba

      Download Submit

    • C:\GalaxI3\dobasys.exe
      Filesize

      4.1MB

      MD5

      41729044bf021938965bdec2a0c76146

      SHA1

      751febca5d298477ea53e9cefaba97774dd1750b

      SHA256

      906beeabfee32de424bd00576ba9b9798b8b84070c87c33d60c22fe4c5db8af2

      SHA512

      0ce78fb75602476e698eaa27edb98c60dc20b14f3f2f5503e2760eebc75d8484db6af8b3760ebe7f19282756137fdbf41142599fbb2dc7f129edd0d8b9b991ff

      Download Submit

    • C:\Users\Admin\253086396416_10.0_Admin.ini
      Filesize

      200B

      MD5

      58744aedbfaf572f749f07dc20b7181c

      SHA1

      4fd52beb28b5498133a207a060a1402de5007b75

      SHA256

      e2709a7efcbf6a755ea065787917c850a973596e4e011708df00d9ca231c71fe

      SHA512

      d93cbf75c99605b59eafa16de8cbe48cbc48703139b2b5b0727ce4bcf78a929261188338f7b1663d31f1d967ae229bb4708b42df5c5cbc574b6dc300e12f7d1a

      Download Submit