Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

70fd17a983...c8.exe

windows7-x64

7

70fd17a983...c8.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/07/2024, 23:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    70fd17a983ed828ffbbf70795c7a0601c97cf28a461705d385cfd46649587ec8.exe

  • Size

    2.7MB

  • MD5

    de0f36c729fea128763a77d293d90545

  • SHA1

    361579b76cdbd3325b4d3aa6920236ace5962968

  • SHA256

    70fd17a983ed828ffbbf70795c7a0601c97cf28a461705d385cfd46649587ec8

  • SHA512

    e7b564e5f4898e531ef9b879104d21a0f92e0856cea5a89d7f06579ca49b3a5491407df2a0891f246a17c528ea5a68b72fb3cf5a3a3adc66e438b8448c25af8a

  • SSDEEP

    49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBo9w4Sx:+R0pI/IQlUoMPdmpSpe4

Score
7/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\70fd17a983ed828ffbbf70795c7a0601c97cf28a461705d385cfd46649587ec8.exe
    "C:\Users\Admin\AppData\Local\Temp\70fd17a983ed828ffbbf70795c7a0601c97cf28a461705d385cfd46649587ec8.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4740
    • C:\Files9D\xdobec.exe
      C:\Files9D\xdobec.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:708

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Files9D\xdobec.exe
    Filesize

    2.7MB

    MD5

    ec25ad960bd6d5c36f1fc732d2798cb5

    SHA1

    01440eaa5c5bf55fcd4187c4cabcc7e53ff7501b

    SHA256

    fc0ba792889c3cb33b538aa48ebea6b2e0f3f1d3f0321d4dbed19fc0823dde19

    SHA512

    19d0c49610186fc8f024d952345bce25cff33a5073bbe690d52aab7950924c6ec4b9051e3ba798141fa1a517ffff4b19431a458d9aa707668a7fb790bd64b40e

    Download Submit

  • C:\KaVBPN\bodxec.exe
    Filesize

    299KB

    MD5

    d4d7124ac39bbf992e0b45e49ae7f569

    SHA1

    38b0ad9ac4bc23c0067652dafed30f14c72c9e02

    SHA256

    df8293fa83615fa4fcd56393ed92a7fe13aa321f6d82d07b4c21d16a6494e1e4

    SHA512

    d319089d4dfa41f5de884bfcb8d725965c9a4eca523e8ce97b82b3426780680b8d8a9b305e1c2cee9d55ee3e7fa8f6e85aae5b77e9e0a2521d524a098dc54be0

    Download Submit

  • C:\Users\Admin\253086396416_10.0_Admin.ini
    Filesize

    198B

    MD5

    5b6688dc0c8be5058d810e31d605c4c0

    SHA1

    043f36deb82e069e89a02a120ab16a2ee75109b2

    SHA256

    961d187f57d95a07737f213c81a847a5f6e090edb5b3977330c6c600ceddb86e

    SHA512

    c2b0d2b9eddac13689a9e55fd84886f4b497883f99068bb8565a4ef20112cd62930a03fbec1b0060a86be98a967df7536e33d7bc653cfe9c81d308fc5e1ed961

    Download Submit