Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

891617216f...bc.exe

windows7-x64

7

891617216f...bc.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/07/2024, 01:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    891617216f4b2e8f831f9ee9dc6f498bb82cbfdf7e7dccc3d22c15829e1d68bc.exe

  • Size

    2.7MB

  • MD5

    1a632077fc1f1b80d1363719450a2c00

  • SHA1

    23e946a1baf9217e2eba01758b03fc0d5c45666d

  • SHA256

    891617216f4b2e8f831f9ee9dc6f498bb82cbfdf7e7dccc3d22c15829e1d68bc

  • SHA512

    ac64daa5817c64606e753df6a43d5c0b00f5dbf212c0936bb86d9feb9950e9877e59e764b98942752fd27dacacbfea19e2fcff1f96b9abacb3536dd147306f0a

  • SSDEEP

    49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBw9w4Sx:+R0pI/IQlUoMPdmpSpW4

Score
7/10
persistencespywarestealer

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\891617216f4b2e8f831f9ee9dc6f498bb82cbfdf7e7dccc3d22c15829e1d68bc.exe
    "C:\Users\Admin\AppData\Local\Temp\891617216f4b2e8f831f9ee9dc6f498bb82cbfdf7e7dccc3d22c15829e1d68bc.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:628
    • C:\Users\Admin_DssGdwd_Urdplqj_Plfurvriw_Zlqgrzv_Vwduw#Phqx_Surjudpv_Vwduwxs_locdevbod.exe
      C:\Users\Admin_DssGdwd_Urdplqj_Plfurvriw_Zlqgrzv_Vwduw#Phqx_Surjudpv_Vwduwxs_locdevbod.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:5080
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c ipconfig > C:\Users\Admin\ipconfig.txt
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3956
        • C:\Windows\SysWOW64\ipconfig.exe
          ipconfig
          4⤵
          • Gathers network information
          PID:1896
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c netstat -a > C:\Users\Admin\netstat.txt
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2936
        • C:\Windows\SysWOW64\NETSTAT.EXE
          netstat -a
          4⤵
          • Gathers network information
          • Suspicious use of AdjustPrivilegeToken
          PID:3620
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c dir C:\*.txt /b /s >> C:\Users\Admin\grubb.list
        3⤵
          PID:1888
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c dir C:\*.doc /b /s >> C:\Users\Admin\grubb.list
          3⤵
            PID:2940
        • C:\SysDrvZE\xoptisys.exe
          C:\SysDrvZE\xoptisys.exe
          2⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:1180

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\LabZH7\dobdevloc.exe
        Filesize

        1KB

        MD5

        39bb8e2c28040b5417300cd224b583c3

        SHA1

        b7f713ccaf1f4f856102270f0242e8c28abbefb2

        SHA256

        76af70a4940df21709b0fb41a393147a4ee160f3879bfa3e6b65bb24c35d26ad

        SHA512

        274b06d312db6c010669fd494ddb2a617d53ccec6905471986c7089b91860b0f9de2229e37791350f8c3faf079bd0454a4f176c3d8889d070042c71754ab07b8

        Download Submit

      • C:\LabZH7\dobdevloc.exe
        Filesize

        341KB

        MD5

        2e0ae0c41c18acca50d6b2b2301ac5d9

        SHA1

        695c12079dec0342ae2bb3ef607776b6fb78dede

        SHA256

        bc9d56bc05adb3c6bbd18391745ef20bd878be41c2cefa4f588bc8ac70471c05

        SHA512

        ac9c58a3e46a744c48a2b6989c484a47502e0fe531285b5fff83e27652911b4af1e59b3a2fcf2c7685399965a16d78dd964f24c618324da58bb6a34ff431ca79

        Download Submit

      • C:\SysDrvZE\xoptisys.exe
        Filesize

        2.7MB

        MD5

        f2c29fca20d686bda56f61541b29c009

        SHA1

        2a415d2c7866c2da07b8f9a2cbeb35d60ef11645

        SHA256

        6ca26101b8061df81a48308636245b6d2fb0d9eea3c3acc8481462acda39650a

        SHA512

        b9f2800d42fd15f425dc491ede6753352a7904f3267d3bf85d3e31e56d6b03e9ad4ca76f6b23cea3ab2122f76f5f2c62bdf542cd4853f483d1705aa5c125c2e1

        Download Submit

      • C:\Users\Admin\253086396416_10.0_Admin.ini
        Filesize

        206B

        MD5

        6b6b7bb3bd1e01c23b497a4ab490d0fe

        SHA1

        c6d28bd40cba567f57ef7cc5b6dd16855ca82db0

        SHA256

        b184bc7fc43f33e68810d4c0eca729ca5e51ee6279b1a420d22441481786c1c3

        SHA512

        747b5ff52f94a6007b426f71cc5025ba7786d3a2e12e776106ddefc9ffcfa91b8976c965b2f1eb25719d0862fec033b2f56e14c95bf2694be8f87fdb5d09e164

        Download Submit

      • C:\Users\Admin\253086396416_10.0_Admin.ini
        Filesize

        206B

        MD5

        c4d9ea48d53f47d5688d74487fb8c589

        SHA1

        065416c81553e32c44c014b25b1f85223afd2833

        SHA256

        84b8e04060d29e31992cd932b0f3bea5f58ab53c5dc1c0872b091db6ef688aed

        SHA512

        659fe58057b9b0eceb7bc964c4dfa1bd93b30e284cf42abd4fced2a961dd049e3d07023dbc5845edf19325bd654754c6e319053dbbf82b50ad4461857c539358

        Download Submit

      • C:\Users\Admin_DssGdwd_Urdplqj_Plfurvriw_Zlqgrzv_Vwduw#Phqx_Surjudpv_Vwduwxs_locdevbod.exe
        Filesize

        2.7MB

        MD5

        1e5457a2ab7609fe526dfb424d510bc0

        SHA1

        1807f47fbca535383d62f9bc74e84e3182a54609

        SHA256

        4d2d04413a594dc85ee6f4b088fef08c6f7e67360ee650c710b39a744e74909c

        SHA512

        0628bcb7d4486ce142b679f338fb706bc22f5cc4ec33b957ef9daec500bc4cbd20f18f631e7d7f51b7052bce5ddd0aa6ee0196e5172affee904eedb04358258a

        Download Submit