Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
27/07/2024, 04:23
Static task
static1
Behavioral task
behavioral1
Sample
8feadd808368af7b8d4f8cb3477ef9f0N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
8feadd808368af7b8d4f8cb3477ef9f0N.exe
Resource
win10v2004-20240709-en
General
-
Target
8feadd808368af7b8d4f8cb3477ef9f0N.exe
-
Size
2.7MB
-
MD5
8feadd808368af7b8d4f8cb3477ef9f0
-
SHA1
6ba18e4bcfe4dd13fb2b38db0842c1d9727ba75b
-
SHA256
4e72dd3ff8b488ec0bbf5271b1a8b953a413effffc96d8bb63e7a0c3032987a2
-
SHA512
1399f2406f824a07f64c24497484f39258bf362ae30b273c0cdddcf443bf102677272cb784daa749967308d1a66a6dbf4493891cd6559207e5484ea0cb702d26
-
SSDEEP
49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBV9w4Sx:+R0pI/IQlUoMPdmpSpJ4
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2332 devbodloc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrvGL\\devbodloc.exe" 8feadd808368af7b8d4f8cb3477ef9f0N.exe Set value (str) \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\MintDL\\optidevsys.exe" 8feadd808368af7b8d4f8cb3477ef9f0N.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8feadd808368af7b8d4f8cb3477ef9f0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language devbodloc.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4800 8feadd808368af7b8d4f8cb3477ef9f0N.exe 4800 8feadd808368af7b8d4f8cb3477ef9f0N.exe 4800 8feadd808368af7b8d4f8cb3477ef9f0N.exe 4800 8feadd808368af7b8d4f8cb3477ef9f0N.exe 2332 devbodloc.exe 2332 devbodloc.exe 4800 8feadd808368af7b8d4f8cb3477ef9f0N.exe 4800 8feadd808368af7b8d4f8cb3477ef9f0N.exe 2332 devbodloc.exe 2332 devbodloc.exe 4800 8feadd808368af7b8d4f8cb3477ef9f0N.exe 4800 8feadd808368af7b8d4f8cb3477ef9f0N.exe 2332 devbodloc.exe 2332 devbodloc.exe 4800 8feadd808368af7b8d4f8cb3477ef9f0N.exe 4800 8feadd808368af7b8d4f8cb3477ef9f0N.exe 2332 devbodloc.exe 2332 devbodloc.exe 4800 8feadd808368af7b8d4f8cb3477ef9f0N.exe 4800 8feadd808368af7b8d4f8cb3477ef9f0N.exe 2332 devbodloc.exe 2332 devbodloc.exe 4800 8feadd808368af7b8d4f8cb3477ef9f0N.exe 4800 8feadd808368af7b8d4f8cb3477ef9f0N.exe 2332 devbodloc.exe 2332 devbodloc.exe 4800 8feadd808368af7b8d4f8cb3477ef9f0N.exe 4800 8feadd808368af7b8d4f8cb3477ef9f0N.exe 2332 devbodloc.exe 2332 devbodloc.exe 4800 8feadd808368af7b8d4f8cb3477ef9f0N.exe 4800 8feadd808368af7b8d4f8cb3477ef9f0N.exe 2332 devbodloc.exe 2332 devbodloc.exe 4800 8feadd808368af7b8d4f8cb3477ef9f0N.exe 4800 8feadd808368af7b8d4f8cb3477ef9f0N.exe 2332 devbodloc.exe 2332 devbodloc.exe 4800 8feadd808368af7b8d4f8cb3477ef9f0N.exe 4800 8feadd808368af7b8d4f8cb3477ef9f0N.exe 2332 devbodloc.exe 2332 devbodloc.exe 4800 8feadd808368af7b8d4f8cb3477ef9f0N.exe 4800 8feadd808368af7b8d4f8cb3477ef9f0N.exe 2332 devbodloc.exe 2332 devbodloc.exe 4800 8feadd808368af7b8d4f8cb3477ef9f0N.exe 4800 8feadd808368af7b8d4f8cb3477ef9f0N.exe 2332 devbodloc.exe 2332 devbodloc.exe 4800 8feadd808368af7b8d4f8cb3477ef9f0N.exe 4800 8feadd808368af7b8d4f8cb3477ef9f0N.exe 2332 devbodloc.exe 2332 devbodloc.exe 4800 8feadd808368af7b8d4f8cb3477ef9f0N.exe 4800 8feadd808368af7b8d4f8cb3477ef9f0N.exe 2332 devbodloc.exe 2332 devbodloc.exe 4800 8feadd808368af7b8d4f8cb3477ef9f0N.exe 4800 8feadd808368af7b8d4f8cb3477ef9f0N.exe 2332 devbodloc.exe 2332 devbodloc.exe 4800 8feadd808368af7b8d4f8cb3477ef9f0N.exe 4800 8feadd808368af7b8d4f8cb3477ef9f0N.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4800 wrote to memory of 2332 4800 8feadd808368af7b8d4f8cb3477ef9f0N.exe 89 PID 4800 wrote to memory of 2332 4800 8feadd808368af7b8d4f8cb3477ef9f0N.exe 89 PID 4800 wrote to memory of 2332 4800 8feadd808368af7b8d4f8cb3477ef9f0N.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\8feadd808368af7b8d4f8cb3477ef9f0N.exe"C:\Users\Admin\AppData\Local\Temp\8feadd808368af7b8d4f8cb3477ef9f0N.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\SysDrvGL\devbodloc.exeC:\SysDrvGL\devbodloc.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2332
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD51fcf5c37a551c0b9554c808cdf78fc50
SHA1fce8391c49d94abf26e2e6c95a4499c2e557bbe2
SHA25672d28435e4ec8975073c1e77d39e8a7bf512ddd3420e2ba8cb46a4c80bc7b426
SHA5120a8b6dc7cb6f9d61d454cff90f9fef9f64d9261956dfebec4ce3718d4deb93f9f6253746d4ca88446ce1eaa1ae47b2e2ed64629bacc96ac9647243355a98101c
-
Filesize
2.7MB
MD50db9ace7363a8a53e8fb97d1f32cd3c4
SHA134b2ff086fc9229308a3004aa3a8aac78ad9d21d
SHA2566da0189d1eca67daed8bfb8db9dceda0fb2b91d6398d5efceea03a9873df1fb2
SHA512dcfb59d0c285d3cde83f9472402eb1ec9f5f8cc31549de627a31b146c4a8d76a65e911878bc056a7601aad41bdedd8a7030fa50fc1e0579db15f1d0ba8d4bf33
-
Filesize
2.7MB
MD5843bf43bb9cf1e7f8fae855ae1cb4d16
SHA1527c7f18bc7b71cc6d0a1e6756c097da4535d2ad
SHA2569532d968ee858f5ea914688b58b81a014f70a51b8aa808319784523449cc2f79
SHA512792879a0cdf705bfd50a2d83a5edc583cd6538552e4c48bb96e000e0a5d6b36c339c6c0b0c9a082090c390c4467a2ca00c42b9c399933627c048f59b5f463d53
-
Filesize
208B
MD59ab9bf40db481cbe542c6488df2a2407
SHA1acece7978b19cb9e774a023816194baa5714c69b
SHA256cd044e71c7d7f2192a58d03590c93c5755805e97aad6e5a93b791e4f88a69a9c
SHA512054e6b707b1fa2d5f8dd7dfbfe8ddd1d7e0df04222d7290d3a9ac183b20cee91d13738f7ed3c83f5d30f3317e3b3f0474bd2844e90770cb1338c1843227061b2