Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    102s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/07/2024, 03:17

General

  • Target

    2c0c6b8b0902b4807ca9536a398f3180N.exe

  • Size

    3.1MB

  • MD5

    2c0c6b8b0902b4807ca9536a398f3180

  • SHA1

    1b921069bbef9eac41a0fd00454a53cb9169f7db

  • SHA256

    b2fa466180454c368867e2ab775f93091bfd845aaaab92c9e5af3ba6d942ec3f

  • SHA512

    ad1a39a7e58c2a2e3eac43166661cc245f46904accc0f05cc7cb19beaec2d0af720d77aaa54b6a476edf33fd0df36bdb100bb0c40fd03fd35c6484e3ef941dc9

  • SSDEEP

    49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBxB/bSqz8b6LNXJqI:sxX7QnxrloE5dpUpSbVz8eLFc

Malware Config

Signatures

  • Drops startup file 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2c0c6b8b0902b4807ca9536a398f3180N.exe
    "C:\Users\Admin\AppData\Local\Temp\2c0c6b8b0902b4807ca9536a398f3180N.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1100
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxopti.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxopti.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:5044
    • C:\IntelprocJQ\aoptiloc.exe
      C:\IntelprocJQ\aoptiloc.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:4128

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\IntelprocJQ\aoptiloc.exe

    Filesize

    23KB

    MD5

    92e05ba3017090c77842fb48869867bc

    SHA1

    6daf02c129156f59bc6defa6b1f3a93c9e3e8df6

    SHA256

    194123ee36bc4cba1627c299fdefa4997784b9500b613312e45794c77ac92b87

    SHA512

    26dfc6a1ba28fc660b5ebe9ad0ba738c63153219c91b3eec80a3228467813965cc374edceb619f3c6bf17e6d8df54fe902958e15591873b3893d71ccb9cb020c

  • C:\IntelprocJQ\aoptiloc.exe

    Filesize

    3.1MB

    MD5

    be015420caaa0c38050823c75a4cf3fe

    SHA1

    5f9370fb48e708cf5c3d3a713e3c0d72f133a79a

    SHA256

    49ca4392356fb2917282ec31953a06fcd51524f646abd3c5bbe55cab315342cf

    SHA512

    51c892bbbed23fab9d5f8b0d72506b30794a27e11fe6f0c75f62e22e3c96063f801a2b20a897969eb0e2b6c2afbd62aaa468cfeee303991df7ea5bcd95cfa66f

  • C:\Mint26\bodxsys.exe

    Filesize

    89KB

    MD5

    7705853270a4869d9e105b7387732236

    SHA1

    9af0304518c0e2b890f930c3ce2163712a20b6e9

    SHA256

    bea71ededdc9be77ce285cbe9ff9f2042ed40f2fc46203f34994328fd97a7568

    SHA512

    bcfe2ab92aa6e53d5d1b7401ad655c0595cd876e19c195ad36c6e48d446ac45eb3f661c7d7742dd8d7b6a2462d149345dd0cbd238cf62ed65ed6cdf340ec7f99

  • C:\Mint26\bodxsys.exe

    Filesize

    3.1MB

    MD5

    b47526998cd62e4aae101bb1c2523dcb

    SHA1

    a652987a5297a2b9d3fc7a38fbca7f253348c5f3

    SHA256

    8454f5b9098cdab2b82371c84a4c68248b8313bf224c87c8b43ca42a34024881

    SHA512

    ddf2efb04dc971f42459dff6e3cfb154a2ac8a25f5540b6dd2cc5006223dd3bbc491fa5c10a4a728b8b2a063cddcd6fc87c7149ed6380d4455ddf56d621297a5

  • C:\Users\Admin\253086396416_10.0_Admin.ini

    Filesize

    206B

    MD5

    d459a8f8c8ac4844f0b183a8140e47a6

    SHA1

    65d808b778bc6ff7f35de6547086b1513da98d93

    SHA256

    4ff7a3f52509aec0144fd39e2c82ad888a918ae81e36bfbfe49e2f4b7ebb8810

    SHA512

    e8b4ff12976cde3e1fd48e0886682c6195be0e963226f6946b3f39eeabe2bb270e3b880c757883db43e8e52d3a104b36b184e2c408d03b2aef79d8e867c1a794

  • C:\Users\Admin\253086396416_10.0_Admin.ini

    Filesize

    174B

    MD5

    0b0dc84f7aa15b6a826e6d7fc2643b1f

    SHA1

    96f0b81be1547a33cce453b1a12dd251332ffae4

    SHA256

    8b029ef680879cf13f4952d264a05899a571daa935fe1c2d673b58713efd498f

    SHA512

    54d6df75fb589d464d18438f96cfc4928763ccb2788fd307a586908f78c06c351db79139b87e7c480c793ce409af9a6679de730c9521df3ada221090ff813a47

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxopti.exe

    Filesize

    3.1MB

    MD5

    5b17b91d10a3d0862d049beede009ced

    SHA1

    f7d7ce7f9b80fcae98498a322f1146bbdffea9c5

    SHA256

    812932584eb330f362edd9b10a4ba26a79ac7fd7b55b4126879124cc2dde491a

    SHA512

    b8eb47b4d4ea655436761c67c8383d595ea00fe923d5add3fedba8d486d515541b68d553c7dad767037d1db9aa7d29d12dbdf12bc00b9e502e9dc4b15ed62170