Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
12/07/2024, 03:17
Static task
static1
Behavioral task
behavioral1
Sample
2c0c6b8b0902b4807ca9536a398f3180N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2c0c6b8b0902b4807ca9536a398f3180N.exe
Resource
win10v2004-20240704-en
General
-
Target
2c0c6b8b0902b4807ca9536a398f3180N.exe
-
Size
3.1MB
-
MD5
2c0c6b8b0902b4807ca9536a398f3180
-
SHA1
1b921069bbef9eac41a0fd00454a53cb9169f7db
-
SHA256
b2fa466180454c368867e2ab775f93091bfd845aaaab92c9e5af3ba6d942ec3f
-
SHA512
ad1a39a7e58c2a2e3eac43166661cc245f46904accc0f05cc7cb19beaec2d0af720d77aaa54b6a476edf33fd0df36bdb100bb0c40fd03fd35c6484e3ef941dc9
-
SSDEEP
49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBxB/bSqz8b6LNXJqI:sxX7QnxrloE5dpUpSbVz8eLFc
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxopti.exe 2c0c6b8b0902b4807ca9536a398f3180N.exe -
Executes dropped EXE 2 IoCs
pid Process 5044 locxopti.exe 4128 aoptiloc.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\Mint26\\bodxsys.exe" 2c0c6b8b0902b4807ca9536a398f3180N.exe Set value (str) \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\IntelprocJQ\\aoptiloc.exe" 2c0c6b8b0902b4807ca9536a398f3180N.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1100 2c0c6b8b0902b4807ca9536a398f3180N.exe 1100 2c0c6b8b0902b4807ca9536a398f3180N.exe 1100 2c0c6b8b0902b4807ca9536a398f3180N.exe 1100 2c0c6b8b0902b4807ca9536a398f3180N.exe 5044 locxopti.exe 5044 locxopti.exe 4128 aoptiloc.exe 4128 aoptiloc.exe 5044 locxopti.exe 5044 locxopti.exe 4128 aoptiloc.exe 4128 aoptiloc.exe 5044 locxopti.exe 5044 locxopti.exe 4128 aoptiloc.exe 4128 aoptiloc.exe 5044 locxopti.exe 5044 locxopti.exe 4128 aoptiloc.exe 4128 aoptiloc.exe 5044 locxopti.exe 5044 locxopti.exe 4128 aoptiloc.exe 4128 aoptiloc.exe 5044 locxopti.exe 5044 locxopti.exe 4128 aoptiloc.exe 4128 aoptiloc.exe 5044 locxopti.exe 5044 locxopti.exe 4128 aoptiloc.exe 4128 aoptiloc.exe 5044 locxopti.exe 5044 locxopti.exe 4128 aoptiloc.exe 4128 aoptiloc.exe 5044 locxopti.exe 5044 locxopti.exe 4128 aoptiloc.exe 4128 aoptiloc.exe 5044 locxopti.exe 5044 locxopti.exe 4128 aoptiloc.exe 4128 aoptiloc.exe 5044 locxopti.exe 5044 locxopti.exe 4128 aoptiloc.exe 4128 aoptiloc.exe 5044 locxopti.exe 5044 locxopti.exe 4128 aoptiloc.exe 4128 aoptiloc.exe 5044 locxopti.exe 5044 locxopti.exe 4128 aoptiloc.exe 4128 aoptiloc.exe 5044 locxopti.exe 5044 locxopti.exe 4128 aoptiloc.exe 4128 aoptiloc.exe 5044 locxopti.exe 5044 locxopti.exe 4128 aoptiloc.exe 4128 aoptiloc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1100 wrote to memory of 5044 1100 2c0c6b8b0902b4807ca9536a398f3180N.exe 88 PID 1100 wrote to memory of 5044 1100 2c0c6b8b0902b4807ca9536a398f3180N.exe 88 PID 1100 wrote to memory of 5044 1100 2c0c6b8b0902b4807ca9536a398f3180N.exe 88 PID 1100 wrote to memory of 4128 1100 2c0c6b8b0902b4807ca9536a398f3180N.exe 91 PID 1100 wrote to memory of 4128 1100 2c0c6b8b0902b4807ca9536a398f3180N.exe 91 PID 1100 wrote to memory of 4128 1100 2c0c6b8b0902b4807ca9536a398f3180N.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c0c6b8b0902b4807ca9536a398f3180N.exe"C:\Users\Admin\AppData\Local\Temp\2c0c6b8b0902b4807ca9536a398f3180N.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxopti.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxopti.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5044
-
-
C:\IntelprocJQ\aoptiloc.exeC:\IntelprocJQ\aoptiloc.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4128
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
23KB
MD592e05ba3017090c77842fb48869867bc
SHA16daf02c129156f59bc6defa6b1f3a93c9e3e8df6
SHA256194123ee36bc4cba1627c299fdefa4997784b9500b613312e45794c77ac92b87
SHA51226dfc6a1ba28fc660b5ebe9ad0ba738c63153219c91b3eec80a3228467813965cc374edceb619f3c6bf17e6d8df54fe902958e15591873b3893d71ccb9cb020c
-
Filesize
3.1MB
MD5be015420caaa0c38050823c75a4cf3fe
SHA15f9370fb48e708cf5c3d3a713e3c0d72f133a79a
SHA25649ca4392356fb2917282ec31953a06fcd51524f646abd3c5bbe55cab315342cf
SHA51251c892bbbed23fab9d5f8b0d72506b30794a27e11fe6f0c75f62e22e3c96063f801a2b20a897969eb0e2b6c2afbd62aaa468cfeee303991df7ea5bcd95cfa66f
-
Filesize
89KB
MD57705853270a4869d9e105b7387732236
SHA19af0304518c0e2b890f930c3ce2163712a20b6e9
SHA256bea71ededdc9be77ce285cbe9ff9f2042ed40f2fc46203f34994328fd97a7568
SHA512bcfe2ab92aa6e53d5d1b7401ad655c0595cd876e19c195ad36c6e48d446ac45eb3f661c7d7742dd8d7b6a2462d149345dd0cbd238cf62ed65ed6cdf340ec7f99
-
Filesize
3.1MB
MD5b47526998cd62e4aae101bb1c2523dcb
SHA1a652987a5297a2b9d3fc7a38fbca7f253348c5f3
SHA2568454f5b9098cdab2b82371c84a4c68248b8313bf224c87c8b43ca42a34024881
SHA512ddf2efb04dc971f42459dff6e3cfb154a2ac8a25f5540b6dd2cc5006223dd3bbc491fa5c10a4a728b8b2a063cddcd6fc87c7149ed6380d4455ddf56d621297a5
-
Filesize
206B
MD5d459a8f8c8ac4844f0b183a8140e47a6
SHA165d808b778bc6ff7f35de6547086b1513da98d93
SHA2564ff7a3f52509aec0144fd39e2c82ad888a918ae81e36bfbfe49e2f4b7ebb8810
SHA512e8b4ff12976cde3e1fd48e0886682c6195be0e963226f6946b3f39eeabe2bb270e3b880c757883db43e8e52d3a104b36b184e2c408d03b2aef79d8e867c1a794
-
Filesize
174B
MD50b0dc84f7aa15b6a826e6d7fc2643b1f
SHA196f0b81be1547a33cce453b1a12dd251332ffae4
SHA2568b029ef680879cf13f4952d264a05899a571daa935fe1c2d673b58713efd498f
SHA51254d6df75fb589d464d18438f96cfc4928763ccb2788fd307a586908f78c06c351db79139b87e7c480c793ce409af9a6679de730c9521df3ada221090ff813a47
-
Filesize
3.1MB
MD55b17b91d10a3d0862d049beede009ced
SHA1f7d7ce7f9b80fcae98498a322f1146bbdffea9c5
SHA256812932584eb330f362edd9b10a4ba26a79ac7fd7b55b4126879124cc2dde491a
SHA512b8eb47b4d4ea655436761c67c8383d595ea00fe923d5add3fedba8d486d515541b68d553c7dad767037d1db9aa7d29d12dbdf12bc00b9e502e9dc4b15ed62170