Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    107s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/07/2024, 16:31

General

  • Target

    2f4f4b8611a4de7e51a7a1d1abf112c0N.exe

  • Size

    2.7MB

  • MD5

    2f4f4b8611a4de7e51a7a1d1abf112c0

  • SHA1

    b7f38b465f4c5d4194a58f9b833f95add0f7bbed

  • SHA256

    de35af036b7c4807ffc11ea69000de4f4a234381d4290b5ec0c96303769bdfab

  • SHA512

    9f5079ee17d2c73e562ebe6a6eecf929b915cdef8a4c50274204cc078864701fe012a35abe5825844f543fd435aaf17542c0b7599d93e0cd8643f5d5258232e0

  • SSDEEP

    49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LB29w4Sx:+R0pI/IQlUoMPdmpSpg4

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2f4f4b8611a4de7e51a7a1d1abf112c0N.exe
    "C:\Users\Admin\AppData\Local\Temp\2f4f4b8611a4de7e51a7a1d1abf112c0N.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:476
    • C:\UserDotUJ\devoptiec.exe
      C:\UserDotUJ\devoptiec.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:220

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\MintCJ\boddevec.exe

    Filesize

    2.7MB

    MD5

    dbaa6fbbe005b45bfd51942bc81c1b89

    SHA1

    246398c807ffa422be1b81fb591e29f75192bab6

    SHA256

    625643203d6db7d120fd0b467d801edf766fbbf6d0ed5b88d23d537f94410afd

    SHA512

    6f7f05489e0ce0b12298aa742f6c625821812c7dcdca9cdc66f42718b5ec625e78fabc7491cce4fb7dd0ff69c43f24df47522e36db65c3db6c8e6d6af7506954

  • C:\UserDotUJ\devoptiec.exe

    Filesize

    2.7MB

    MD5

    00cc598c2e194ea4c33785b0b74c6690

    SHA1

    0d4789c33b8cdb2d8a65bc3fbf81841b1dcd4c44

    SHA256

    620ea12132e929c57cf51b8c5d119f2c209d5cf58fa73fa657a2b1071f414d14

    SHA512

    6ce40bd7de5309b98358626b942311833d0f5d83ccfe938b8476a4c50474ada742d301ecb37853b38ac017f3ca7f9d89820d8f830e23111001c4e4b39a70dd05

  • C:\Users\Admin\253086396416_10.0_Admin.ini

    Filesize

    207B

    MD5

    a9d1fe73e1a6ebe77721f9db00b1fac0

    SHA1

    aac96ed3ed475dce2aa4fc18ec0e960b7820afd3

    SHA256

    dec227047783d39c9b9a4fa2763cc93586266dab91337e7c83f2766aa0990995

    SHA512

    55a02c59f67681c6906698b67946541f6f100680deb54821e633743294812b8aee84dbb9523a5124bbf5749ad7a51f2ffdd577cd4e805e187e234e11c5862bcb