Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

4f0607b787...70.exe

windows7-x64

7

4f0607b787...70.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/08/2024, 21:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4f0607b787ab3899cb0f14914674df67cb8d0177de38ff1bb5a72c96c6041f70.exe

  • Size

    2.7MB

  • MD5

    f2f746afbcbc9463e0681ef511a1f68b

  • SHA1

    d9ef2a1a87501b7e82f9df7222ff69ef4b0bd2ff

  • SHA256

    4f0607b787ab3899cb0f14914674df67cb8d0177de38ff1bb5a72c96c6041f70

  • SHA512

    d7bb409c84ced21ad010fc125faebbf696da067508b6ee2f69ab1d2e6b0e8f882ad165d38d84021b98931c19c9eded3f405771903ffc97f336913366e1e46596

  • SSDEEP

    49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LB/9w4Sx:+R0pI/IQlUoMPdmpSpf4

Score
7/10
discoverypersistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4f0607b787ab3899cb0f14914674df67cb8d0177de38ff1bb5a72c96c6041f70.exe
    "C:\Users\Admin\AppData\Local\Temp\4f0607b787ab3899cb0f14914674df67cb8d0177de38ff1bb5a72c96c6041f70.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4416
    • C:\UserDotDD\xdobec.exe
      C:\UserDotDD\xdobec.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:4476
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4668,i,16315016104747277319,5510969007830467313,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:8
    1⤵
      PID:4876

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\UserDotDD\xdobec.exe
      Filesize

      2.7MB

      MD5

      acbd64b8326189591e8b8d5fe0c8541b

      SHA1

      88a655276ed00d084dee4ea4b0cd684ce6b01131

      SHA256

      39426c2532b919d20bd29a15abb5b6ef2e866b348e32fa2858a6de3a9e2adbd0

      SHA512

      844a7c608dd90f6099fc0f0393cf4367d095e1c5430be1fd4e15563bdc514c74cb0ef9f2403f03b481af54d50441eee35a5f8c622f69024cf016d2bda374d3b6

      Download Submit

    • C:\Users\Admin\253086396416_10.0_Admin.ini
      Filesize

      202B

      MD5

      7fc7d14a2935587aa265211a2a84bf61

      SHA1

      8884676f8828d56f4b4e83d19e2797c0b65b1586

      SHA256

      de4d6ad957b08b85231b9181a019752f0e8a210e55a5a03a4a764862aa3cbab0

      SHA512

      6ab2b86aae92ee37a0d1764acb6ef18861677400e397cfd6d4615a4e5fb19493e809c72661c764a04af10eb395e857c62c64a2fb4f3ac9bd1ec4560088224a71

      Download Submit

    • C:\VidVN\optiasys.exe
      Filesize

      42KB

      MD5

      dcc072cea791fd12b09c712588ca515d

      SHA1

      5b16fd6cc7f35532dcea6ac8446ab3c12d9bdfba

      SHA256

      3e703b0515dc38b1775262f1e6f4510a4ce01155935a632354ec1d1dfabf4359

      SHA512

      04d718d2cee7dc84491e5bad0ee2dd0f45c835e454d7404a49f78a3de5e10d9304732f445672f49e352a13edcd21de81e8cdc224a5a2108c82b8820073559d15

      Download Submit

    • C:\VidVN\optiasys.exe
      Filesize

      2.7MB

      MD5

      d4241eb2f3cd73fb71003479faa02873

      SHA1

      00b56e26aa1c4dbcb3d40b122d2b4fdf38a034f3

      SHA256

      6bdad389f59614176a37fc7194c746c904457dba976605b0f1b21b0a16655739

      SHA512

      97be7256afa0cb0591bebdb0aefcf5d5fbae91b2add1c28cba38ef62de8387b17057765516381828d4e1776ec6c2be859cc1ded590519fc0b8f02792f21d0bf6

      Download Submit