Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
25/07/2024, 18:14
Static task
static1
Behavioral task
behavioral1
Sample
032e898e9f9f9da801fd2abfafecd96d838de566e1a11d50c85ea6706371effb.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
032e898e9f9f9da801fd2abfafecd96d838de566e1a11d50c85ea6706371effb.exe
Resource
win10v2004-20240709-en
General
-
Target
032e898e9f9f9da801fd2abfafecd96d838de566e1a11d50c85ea6706371effb.exe
-
Size
2.7MB
-
MD5
04e0f8cfef5a9203f87a6e6f957e02c2
-
SHA1
fb1c1486c3470892e3622966f6b5e2e5a9aeeef4
-
SHA256
032e898e9f9f9da801fd2abfafecd96d838de566e1a11d50c85ea6706371effb
-
SHA512
d520f08a8bc6949995c91383943877aeaa5bdb923a3063317f345192cdc423d52282b3489dba575e66f99cad296a067f80088b2654e347d72dc4963a027586ee
-
SSDEEP
49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LB89w4Sx:+R0pI/IQlUoMPdmpSpy4
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 5004 devoptiec.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\IntelprocYC\\devoptiec.exe" 032e898e9f9f9da801fd2abfafecd96d838de566e1a11d50c85ea6706371effb.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\KaVBEP\\optidevsys.exe" 032e898e9f9f9da801fd2abfafecd96d838de566e1a11d50c85ea6706371effb.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 032e898e9f9f9da801fd2abfafecd96d838de566e1a11d50c85ea6706371effb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language devoptiec.exe -
NTFS ADS 2 IoCs
description ioc Process File created C:\Users\Admin\CC4G4\%B4@<A:\ <6EBFB9G\*<A7BJF\&G4EG� 8AH\#EB:E4@F\&G4EGHC\locdevdob.exe 032e898e9f9f9da801fd2abfafecd96d838de566e1a11d50c85ea6706371effb.exe File created C:\Users\Admin\CC4G4\%B4@<A:\ <6EBFB9G\*<A7BJF\&G4EG� 8AH\#EB:E4@F\&G4EGHC\locdevdob.exe devoptiec.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4592 032e898e9f9f9da801fd2abfafecd96d838de566e1a11d50c85ea6706371effb.exe 4592 032e898e9f9f9da801fd2abfafecd96d838de566e1a11d50c85ea6706371effb.exe 4592 032e898e9f9f9da801fd2abfafecd96d838de566e1a11d50c85ea6706371effb.exe 4592 032e898e9f9f9da801fd2abfafecd96d838de566e1a11d50c85ea6706371effb.exe 5004 devoptiec.exe 5004 devoptiec.exe 4592 032e898e9f9f9da801fd2abfafecd96d838de566e1a11d50c85ea6706371effb.exe 4592 032e898e9f9f9da801fd2abfafecd96d838de566e1a11d50c85ea6706371effb.exe 5004 devoptiec.exe 5004 devoptiec.exe 4592 032e898e9f9f9da801fd2abfafecd96d838de566e1a11d50c85ea6706371effb.exe 4592 032e898e9f9f9da801fd2abfafecd96d838de566e1a11d50c85ea6706371effb.exe 5004 devoptiec.exe 5004 devoptiec.exe 4592 032e898e9f9f9da801fd2abfafecd96d838de566e1a11d50c85ea6706371effb.exe 4592 032e898e9f9f9da801fd2abfafecd96d838de566e1a11d50c85ea6706371effb.exe 5004 devoptiec.exe 5004 devoptiec.exe 4592 032e898e9f9f9da801fd2abfafecd96d838de566e1a11d50c85ea6706371effb.exe 4592 032e898e9f9f9da801fd2abfafecd96d838de566e1a11d50c85ea6706371effb.exe 5004 devoptiec.exe 5004 devoptiec.exe 4592 032e898e9f9f9da801fd2abfafecd96d838de566e1a11d50c85ea6706371effb.exe 4592 032e898e9f9f9da801fd2abfafecd96d838de566e1a11d50c85ea6706371effb.exe 5004 devoptiec.exe 5004 devoptiec.exe 4592 032e898e9f9f9da801fd2abfafecd96d838de566e1a11d50c85ea6706371effb.exe 4592 032e898e9f9f9da801fd2abfafecd96d838de566e1a11d50c85ea6706371effb.exe 5004 devoptiec.exe 5004 devoptiec.exe 4592 032e898e9f9f9da801fd2abfafecd96d838de566e1a11d50c85ea6706371effb.exe 4592 032e898e9f9f9da801fd2abfafecd96d838de566e1a11d50c85ea6706371effb.exe 5004 devoptiec.exe 5004 devoptiec.exe 4592 032e898e9f9f9da801fd2abfafecd96d838de566e1a11d50c85ea6706371effb.exe 4592 032e898e9f9f9da801fd2abfafecd96d838de566e1a11d50c85ea6706371effb.exe 5004 devoptiec.exe 5004 devoptiec.exe 4592 032e898e9f9f9da801fd2abfafecd96d838de566e1a11d50c85ea6706371effb.exe 4592 032e898e9f9f9da801fd2abfafecd96d838de566e1a11d50c85ea6706371effb.exe 5004 devoptiec.exe 5004 devoptiec.exe 4592 032e898e9f9f9da801fd2abfafecd96d838de566e1a11d50c85ea6706371effb.exe 4592 032e898e9f9f9da801fd2abfafecd96d838de566e1a11d50c85ea6706371effb.exe 5004 devoptiec.exe 5004 devoptiec.exe 4592 032e898e9f9f9da801fd2abfafecd96d838de566e1a11d50c85ea6706371effb.exe 4592 032e898e9f9f9da801fd2abfafecd96d838de566e1a11d50c85ea6706371effb.exe 5004 devoptiec.exe 5004 devoptiec.exe 4592 032e898e9f9f9da801fd2abfafecd96d838de566e1a11d50c85ea6706371effb.exe 4592 032e898e9f9f9da801fd2abfafecd96d838de566e1a11d50c85ea6706371effb.exe 5004 devoptiec.exe 5004 devoptiec.exe 4592 032e898e9f9f9da801fd2abfafecd96d838de566e1a11d50c85ea6706371effb.exe 4592 032e898e9f9f9da801fd2abfafecd96d838de566e1a11d50c85ea6706371effb.exe 5004 devoptiec.exe 5004 devoptiec.exe 4592 032e898e9f9f9da801fd2abfafecd96d838de566e1a11d50c85ea6706371effb.exe 4592 032e898e9f9f9da801fd2abfafecd96d838de566e1a11d50c85ea6706371effb.exe 5004 devoptiec.exe 5004 devoptiec.exe 4592 032e898e9f9f9da801fd2abfafecd96d838de566e1a11d50c85ea6706371effb.exe 4592 032e898e9f9f9da801fd2abfafecd96d838de566e1a11d50c85ea6706371effb.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4592 wrote to memory of 5004 4592 032e898e9f9f9da801fd2abfafecd96d838de566e1a11d50c85ea6706371effb.exe 87 PID 4592 wrote to memory of 5004 4592 032e898e9f9f9da801fd2abfafecd96d838de566e1a11d50c85ea6706371effb.exe 87 PID 4592 wrote to memory of 5004 4592 032e898e9f9f9da801fd2abfafecd96d838de566e1a11d50c85ea6706371effb.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\032e898e9f9f9da801fd2abfafecd96d838de566e1a11d50c85ea6706371effb.exe"C:\Users\Admin\AppData\Local\Temp\032e898e9f9f9da801fd2abfafecd96d838de566e1a11d50c85ea6706371effb.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\IntelprocYC\devoptiec.exeC:\IntelprocYC\devoptiec.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:5004
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD5463f05a92968954f20290629eeaaa2ee
SHA151f9b37e921c372a6de047d8702a2619de94d183
SHA256494ccc499411cb5537d71cae307c073d3544fa8b112c8f5704feb88faf23107e
SHA512b250a0d9c1edaa6d58325663c655fca6fcbe84a33913e2b1ffc8407da21395b6e4aed8bf552ec9e3c28dcf116000d34a956e924aa776173de479cde86aa6a1f4
-
Filesize
2.7MB
MD56a2f05825b27066bb1de8b179694ec8d
SHA19f55c950620a029bd2ce37f1e846d680f2c7c0c3
SHA256dce8eed4b57c69771b801bbf2ddc9e7b16af0b625e578156541ac820a275c768
SHA5120a9ac04faa66196525494aa96ad676bb1c483c73406cb8a935e9d99cbf4c826ab8ccff042cf569e003b2986619ca2555ee027488226ebadc3a23b513dcbeaa56
-
Filesize
211B
MD52e4022ba8554fc51ff28aa4d3ae2391c
SHA17255447c37aa741db662eb6afea76e538a9566c9
SHA2561104a74edbb38227ee2a532ef93d3bb4cc3abcdbe9a6e631034716bb2902bbcd
SHA512e1fb0166810f3d5b0187fa14509fdcb7287ca56c9a4b4e8f9d5d978009274b5ea4ccc682fd2f40ec0dbd493101768a6dab08bd77ae00a143328cbe168d72e669