Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
03/07/2024, 05:10
Static task
static1
Behavioral task
behavioral1
Sample
3d99010eba207b7cb76b4a8aecce5afd554c695ffc3b86e8ee56a7ae010f1b3b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3d99010eba207b7cb76b4a8aecce5afd554c695ffc3b86e8ee56a7ae010f1b3b.exe
Resource
win10v2004-20240611-en
General
-
Target
3d99010eba207b7cb76b4a8aecce5afd554c695ffc3b86e8ee56a7ae010f1b3b.exe
-
Size
2.7MB
-
MD5
6d9b32039eaf1d176925da77fb67bdd0
-
SHA1
cedcee40087dc145caa5e1041884d4f575247bfa
-
SHA256
3d99010eba207b7cb76b4a8aecce5afd554c695ffc3b86e8ee56a7ae010f1b3b
-
SHA512
3fc83cb37b8b0a1795ba528597cd7d68d63f678fa4bd6e593c72027de3f0453f254b05dcaf9c72d772d7da44d5566238872bdec02afbdd8f13d5bf9ea350ddfc
-
SSDEEP
49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LB/9w4Sx:+R0pI/IQlUoMPdmpSpv4
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2420 adobec.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDotBV\\adobec.exe" 3d99010eba207b7cb76b4a8aecce5afd554c695ffc3b86e8ee56a7ae010f1b3b.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\MintDI\\optixec.exe" 3d99010eba207b7cb76b4a8aecce5afd554c695ffc3b86e8ee56a7ae010f1b3b.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 964 3d99010eba207b7cb76b4a8aecce5afd554c695ffc3b86e8ee56a7ae010f1b3b.exe 964 3d99010eba207b7cb76b4a8aecce5afd554c695ffc3b86e8ee56a7ae010f1b3b.exe 964 3d99010eba207b7cb76b4a8aecce5afd554c695ffc3b86e8ee56a7ae010f1b3b.exe 964 3d99010eba207b7cb76b4a8aecce5afd554c695ffc3b86e8ee56a7ae010f1b3b.exe 2420 adobec.exe 2420 adobec.exe 964 3d99010eba207b7cb76b4a8aecce5afd554c695ffc3b86e8ee56a7ae010f1b3b.exe 964 3d99010eba207b7cb76b4a8aecce5afd554c695ffc3b86e8ee56a7ae010f1b3b.exe 2420 adobec.exe 2420 adobec.exe 964 3d99010eba207b7cb76b4a8aecce5afd554c695ffc3b86e8ee56a7ae010f1b3b.exe 964 3d99010eba207b7cb76b4a8aecce5afd554c695ffc3b86e8ee56a7ae010f1b3b.exe 2420 adobec.exe 2420 adobec.exe 964 3d99010eba207b7cb76b4a8aecce5afd554c695ffc3b86e8ee56a7ae010f1b3b.exe 964 3d99010eba207b7cb76b4a8aecce5afd554c695ffc3b86e8ee56a7ae010f1b3b.exe 2420 adobec.exe 2420 adobec.exe 964 3d99010eba207b7cb76b4a8aecce5afd554c695ffc3b86e8ee56a7ae010f1b3b.exe 964 3d99010eba207b7cb76b4a8aecce5afd554c695ffc3b86e8ee56a7ae010f1b3b.exe 2420 adobec.exe 2420 adobec.exe 964 3d99010eba207b7cb76b4a8aecce5afd554c695ffc3b86e8ee56a7ae010f1b3b.exe 964 3d99010eba207b7cb76b4a8aecce5afd554c695ffc3b86e8ee56a7ae010f1b3b.exe 2420 adobec.exe 2420 adobec.exe 964 3d99010eba207b7cb76b4a8aecce5afd554c695ffc3b86e8ee56a7ae010f1b3b.exe 964 3d99010eba207b7cb76b4a8aecce5afd554c695ffc3b86e8ee56a7ae010f1b3b.exe 2420 adobec.exe 2420 adobec.exe 964 3d99010eba207b7cb76b4a8aecce5afd554c695ffc3b86e8ee56a7ae010f1b3b.exe 964 3d99010eba207b7cb76b4a8aecce5afd554c695ffc3b86e8ee56a7ae010f1b3b.exe 2420 adobec.exe 2420 adobec.exe 964 3d99010eba207b7cb76b4a8aecce5afd554c695ffc3b86e8ee56a7ae010f1b3b.exe 964 3d99010eba207b7cb76b4a8aecce5afd554c695ffc3b86e8ee56a7ae010f1b3b.exe 2420 adobec.exe 2420 adobec.exe 964 3d99010eba207b7cb76b4a8aecce5afd554c695ffc3b86e8ee56a7ae010f1b3b.exe 964 3d99010eba207b7cb76b4a8aecce5afd554c695ffc3b86e8ee56a7ae010f1b3b.exe 2420 adobec.exe 2420 adobec.exe 964 3d99010eba207b7cb76b4a8aecce5afd554c695ffc3b86e8ee56a7ae010f1b3b.exe 964 3d99010eba207b7cb76b4a8aecce5afd554c695ffc3b86e8ee56a7ae010f1b3b.exe 2420 adobec.exe 2420 adobec.exe 964 3d99010eba207b7cb76b4a8aecce5afd554c695ffc3b86e8ee56a7ae010f1b3b.exe 964 3d99010eba207b7cb76b4a8aecce5afd554c695ffc3b86e8ee56a7ae010f1b3b.exe 2420 adobec.exe 2420 adobec.exe 964 3d99010eba207b7cb76b4a8aecce5afd554c695ffc3b86e8ee56a7ae010f1b3b.exe 964 3d99010eba207b7cb76b4a8aecce5afd554c695ffc3b86e8ee56a7ae010f1b3b.exe 2420 adobec.exe 2420 adobec.exe 964 3d99010eba207b7cb76b4a8aecce5afd554c695ffc3b86e8ee56a7ae010f1b3b.exe 964 3d99010eba207b7cb76b4a8aecce5afd554c695ffc3b86e8ee56a7ae010f1b3b.exe 2420 adobec.exe 2420 adobec.exe 964 3d99010eba207b7cb76b4a8aecce5afd554c695ffc3b86e8ee56a7ae010f1b3b.exe 964 3d99010eba207b7cb76b4a8aecce5afd554c695ffc3b86e8ee56a7ae010f1b3b.exe 2420 adobec.exe 2420 adobec.exe 964 3d99010eba207b7cb76b4a8aecce5afd554c695ffc3b86e8ee56a7ae010f1b3b.exe 964 3d99010eba207b7cb76b4a8aecce5afd554c695ffc3b86e8ee56a7ae010f1b3b.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 964 wrote to memory of 2420 964 3d99010eba207b7cb76b4a8aecce5afd554c695ffc3b86e8ee56a7ae010f1b3b.exe 87 PID 964 wrote to memory of 2420 964 3d99010eba207b7cb76b4a8aecce5afd554c695ffc3b86e8ee56a7ae010f1b3b.exe 87 PID 964 wrote to memory of 2420 964 3d99010eba207b7cb76b4a8aecce5afd554c695ffc3b86e8ee56a7ae010f1b3b.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d99010eba207b7cb76b4a8aecce5afd554c695ffc3b86e8ee56a7ae010f1b3b.exe"C:\Users\Admin\AppData\Local\Temp\3d99010eba207b7cb76b4a8aecce5afd554c695ffc3b86e8ee56a7ae010f1b3b.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:964 -
C:\UserDotBV\adobec.exeC:\UserDotBV\adobec.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2420
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD5646fd407b3e58a2c4736748dd67e8662
SHA14b75d9d1d86c9d1d71d5433421217b5b4794add1
SHA256955e017aac7380553eb87785a06b262afc438d326dc010ff71bb4de4e2cc9048
SHA512a5f14e367bf34c79b793d40ae94aed3d76cf69631c3123a976126f19c0640accfca1018c1141a4ae6f48fab15a768f9b53fb6b6ac3b4d9351bb0292bf5c95e49
-
Filesize
2.7MB
MD5cab10bbdb3e621e07992f3f3ea401dac
SHA1ac41b287a0961d6bb0fda9485a194e541378cf32
SHA25608163924e7e781878880ad4e1db9220d4563bf27bb7849698c8efc6804880835
SHA51280a83a360ccfdd02ba5c8bd934aa56ef61f89f0fb68b243b77922d5a2312c58f07c4695ae8df7353cb28f7ffe35a146bedc32526fa8da3544b8188cb9bf45801
-
Filesize
203B
MD50625e9abf9465ecb76167b68410b881e
SHA1ff3e83642efb54e0620390844e9564a1ffc3a9a7
SHA2561d6d05729cf31af55a0254bae62b4b72747edc64358ed2a8d31fb821055f1e9b
SHA512c141986d7e78d501ade141a35a8783885597ef23e32b44c9b93e0899b2a0f6442152504a3b42ea9c2227c0cea1fb3816da80a3fbd668d39c6b4bdba3685db1d2