Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

856a8fffb9...a1.exe

windows7-x64

7

856a8fffb9...a1.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/06/2024, 00:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    856a8fffb9e3ae7e61920c00936279fe00537e90092c9fc46369722ef49f0da1.exe

  • Size

    4.1MB

  • MD5

    73bb1465ada430e1bd62a6b9780edf4a

  • SHA1

    d5e44f50e33ad0a769844319eadcb8f5a0ee990d

  • SHA256

    856a8fffb9e3ae7e61920c00936279fe00537e90092c9fc46369722ef49f0da1

  • SHA512

    9d0af0a80952fcc8e39e7964d294810aeaa593a3c02051c878260408d1fcd2c8a067cda1f5a08750613377c668768136edbe792f350b1483c3890d6326ec4c95

  • SSDEEP

    98304:+R0pI/IQlUoMPdmpSp74ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmg5n9klRKN41v

Score
7/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\856a8fffb9e3ae7e61920c00936279fe00537e90092c9fc46369722ef49f0da1.exe
    "C:\Users\Admin\AppData\Local\Temp\856a8fffb9e3ae7e61920c00936279fe00537e90092c9fc46369722ef49f0da1.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4024
    • C:\FilesWF\xdobsys.exe
      C:\FilesWF\xdobsys.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:4460

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\FilesWF\xdobsys.exe
    Filesize

    4.1MB

    MD5

    2bc4e9d6d489fe479ffb2879bfb71eb5

    SHA1

    4c21909ddf0faaf0051e6b559024fe06f2b4a0fb

    SHA256

    a6d2b5a03ecee288422db8fcae893c7bafaa1d8957d25d5c384a801dfff0b843

    SHA512

    883d215338463be45b226573947548d557283503fad1ce588ce055f79d1b88a40f6a9171556a8f8bfb94d3293a771ee650cf1156ecf04c4af0febc9a41e67253

    Download Submit

  • C:\Users\Admin\253086396416_10.0_Admin.ini
    Filesize

    200B

    MD5

    39b513c9d231f7f1c06cf07166a3ead8

    SHA1

    a8b166014b2e275a9027610fb65af78796c21656

    SHA256

    7f7782b2d73403a07b6705205d2f48455fe44ba6a04253d79bfc0ea8129822c4

    SHA512

    bea208c0366797216032f441094b19728bd5f3acbcaf221ccfbcad3461471d3f4b30366b694b6c6a86c72d90135238d9785164c591dfe2160b27f436b04c60f7

    Download Submit

  • C:\Vid76\bodxec.exe
    Filesize

    537KB

    MD5

    108e34e5477d8d2f0b369fd17d204759

    SHA1

    aaace701a7e396712c6d6e021b7cab100f185ef5

    SHA256

    bb07d8ba1bb73cc3ff1a104fe2b7b80874192f831ebe6ef7cb7db9a6500078b6

    SHA512

    fd5fc79fbb335514592359b694483c2661bddda07a8ee343b6b139caedfb2727bf114ff38fb16f85b915b1670302869d561d273ca7cd38dafd56bc8cf165d22a

    Download Submit

  • C:\Vid76\bodxec.exe
    Filesize

    4.1MB

    MD5

    8655db5c8b38bc8be9e5b305bd976a63

    SHA1

    70ac3337d4bda02c06fbfa31a633f05e5d5abdaa

    SHA256

    17d00ec09ac8fafde3d0c87af7c626a681d1ecb199e59dbc1a47ded5cfc83cc3

    SHA512

    96c942942d83d514542766086e4616ddbd96d6efb42a82be738a13fa3060d05d7bf02bdd774be9cdca73280dd3b7630c576730e687fd41c49e6ca12280b547e0

    Download Submit