Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
26/07/2024, 16:31
Static task
static1
Behavioral task
behavioral1
Sample
2f4f4b8611a4de7e51a7a1d1abf112c0N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2f4f4b8611a4de7e51a7a1d1abf112c0N.exe
Resource
win10v2004-20240709-en
General
-
Target
2f4f4b8611a4de7e51a7a1d1abf112c0N.exe
-
Size
2.7MB
-
MD5
2f4f4b8611a4de7e51a7a1d1abf112c0
-
SHA1
b7f38b465f4c5d4194a58f9b833f95add0f7bbed
-
SHA256
de35af036b7c4807ffc11ea69000de4f4a234381d4290b5ec0c96303769bdfab
-
SHA512
9f5079ee17d2c73e562ebe6a6eecf929b915cdef8a4c50274204cc078864701fe012a35abe5825844f543fd435aaf17542c0b7599d93e0cd8643f5d5258232e0
-
SSDEEP
49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LB29w4Sx:+R0pI/IQlUoMPdmpSpg4
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 968 xoptiloc.exe -
Loads dropped DLL 1 IoCs
pid Process 2552 2f4f4b8611a4de7e51a7a1d1abf112c0N.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrvHV\\xoptiloc.exe" 2f4f4b8611a4de7e51a7a1d1abf112c0N.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\VidIE\\dobdevsys.exe" 2f4f4b8611a4de7e51a7a1d1abf112c0N.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2f4f4b8611a4de7e51a7a1d1abf112c0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xoptiloc.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2552 2f4f4b8611a4de7e51a7a1d1abf112c0N.exe 2552 2f4f4b8611a4de7e51a7a1d1abf112c0N.exe 968 xoptiloc.exe 2552 2f4f4b8611a4de7e51a7a1d1abf112c0N.exe 968 xoptiloc.exe 2552 2f4f4b8611a4de7e51a7a1d1abf112c0N.exe 968 xoptiloc.exe 2552 2f4f4b8611a4de7e51a7a1d1abf112c0N.exe 968 xoptiloc.exe 2552 2f4f4b8611a4de7e51a7a1d1abf112c0N.exe 968 xoptiloc.exe 2552 2f4f4b8611a4de7e51a7a1d1abf112c0N.exe 968 xoptiloc.exe 2552 2f4f4b8611a4de7e51a7a1d1abf112c0N.exe 968 xoptiloc.exe 2552 2f4f4b8611a4de7e51a7a1d1abf112c0N.exe 968 xoptiloc.exe 2552 2f4f4b8611a4de7e51a7a1d1abf112c0N.exe 968 xoptiloc.exe 2552 2f4f4b8611a4de7e51a7a1d1abf112c0N.exe 968 xoptiloc.exe 2552 2f4f4b8611a4de7e51a7a1d1abf112c0N.exe 968 xoptiloc.exe 2552 2f4f4b8611a4de7e51a7a1d1abf112c0N.exe 968 xoptiloc.exe 2552 2f4f4b8611a4de7e51a7a1d1abf112c0N.exe 968 xoptiloc.exe 2552 2f4f4b8611a4de7e51a7a1d1abf112c0N.exe 968 xoptiloc.exe 2552 2f4f4b8611a4de7e51a7a1d1abf112c0N.exe 968 xoptiloc.exe 2552 2f4f4b8611a4de7e51a7a1d1abf112c0N.exe 968 xoptiloc.exe 2552 2f4f4b8611a4de7e51a7a1d1abf112c0N.exe 968 xoptiloc.exe 2552 2f4f4b8611a4de7e51a7a1d1abf112c0N.exe 968 xoptiloc.exe 2552 2f4f4b8611a4de7e51a7a1d1abf112c0N.exe 968 xoptiloc.exe 2552 2f4f4b8611a4de7e51a7a1d1abf112c0N.exe 968 xoptiloc.exe 2552 2f4f4b8611a4de7e51a7a1d1abf112c0N.exe 968 xoptiloc.exe 2552 2f4f4b8611a4de7e51a7a1d1abf112c0N.exe 968 xoptiloc.exe 2552 2f4f4b8611a4de7e51a7a1d1abf112c0N.exe 968 xoptiloc.exe 2552 2f4f4b8611a4de7e51a7a1d1abf112c0N.exe 968 xoptiloc.exe 2552 2f4f4b8611a4de7e51a7a1d1abf112c0N.exe 968 xoptiloc.exe 2552 2f4f4b8611a4de7e51a7a1d1abf112c0N.exe 968 xoptiloc.exe 2552 2f4f4b8611a4de7e51a7a1d1abf112c0N.exe 968 xoptiloc.exe 2552 2f4f4b8611a4de7e51a7a1d1abf112c0N.exe 968 xoptiloc.exe 2552 2f4f4b8611a4de7e51a7a1d1abf112c0N.exe 968 xoptiloc.exe 2552 2f4f4b8611a4de7e51a7a1d1abf112c0N.exe 968 xoptiloc.exe 2552 2f4f4b8611a4de7e51a7a1d1abf112c0N.exe 968 xoptiloc.exe 2552 2f4f4b8611a4de7e51a7a1d1abf112c0N.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2552 wrote to memory of 968 2552 2f4f4b8611a4de7e51a7a1d1abf112c0N.exe 29 PID 2552 wrote to memory of 968 2552 2f4f4b8611a4de7e51a7a1d1abf112c0N.exe 29 PID 2552 wrote to memory of 968 2552 2f4f4b8611a4de7e51a7a1d1abf112c0N.exe 29 PID 2552 wrote to memory of 968 2552 2f4f4b8611a4de7e51a7a1d1abf112c0N.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f4f4b8611a4de7e51a7a1d1abf112c0N.exe"C:\Users\Admin\AppData\Local\Temp\2f4f4b8611a4de7e51a7a1d1abf112c0N.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\SysDrvHV\xoptiloc.exeC:\SysDrvHV\xoptiloc.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:968
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
202B
MD5d01b158c171b8704f98f147120c7896d
SHA1b2498a62e633a5b5e33613f2e83901767b60151e
SHA256baa3fb46bc6b2bca10c01c5cdffe6484cc593f7c3bf1d378fc68396e66810bba
SHA512eb19fdf707d480613074352fa2688dc7537e91d5a3f1f16e715d95c95ab657100f68dfc057229102e94b9e2bba045b20eafdf36b1185ca4509c510b133f814fb
-
Filesize
2.7MB
MD54a1d2675df0466aa5c4a60f7989166f5
SHA1777a6267394a2adba2bfb2ba80ebd7d369e89a8e
SHA25600c8559cb4617811ee9322943ec22602c08fc247a3497151ea015e16f0f3048e
SHA512925f2c0dfa9a1342428c63c2193862f860eca73559be8ef37cd93235ac48ec78909d47d33aa05fa092c1b1821e5c798a538dcd3e0d533c9a3a20a71769cbc018
-
Filesize
2.7MB
MD51cdb5b5987c41c3afc63d4e4b0367081
SHA1bcfd854524805ad1cc74900db9e69f07da81b600
SHA25635bf7f77e5c8b4a96a3773be7612bd77211591462ad4d9434aeebe8ace0db98e
SHA51223f0fc40fb540d571a4eecc2e2783246572ea9bad113776a77679754021ffcb7018cf560d5d7aa5616656226fc81fb8106953f992176af759db9b80db86a8634