Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    122s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/08/2024, 19:15

General

  • Target

    1e68534366344db8cd3dd0a60fae3bcc14ab7408c9d1bba1421c83d38cf4d9d4.exe

  • Size

    3.1MB

  • MD5

    3c42714034cd9bb851ea0f3f031f4f85

  • SHA1

    2d762fedabee69e7d4ade09bc96528056a148c7c

  • SHA256

    1e68534366344db8cd3dd0a60fae3bcc14ab7408c9d1bba1421c83d38cf4d9d4

  • SHA512

    4934e07910cb7a5b0abc4b5413a33cc890247ec52e2fb6534dfae43fef7c335669d0d48750ed41df090430bd36ca8edf7eaa96ff8ed38982bd33f425b56952ce

  • SSDEEP

    49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBJ9w4Su+LNfej:+R0pI/IQlUoMPdmpSpR4JkNfej

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1e68534366344db8cd3dd0a60fae3bcc14ab7408c9d1bba1421c83d38cf4d9d4.exe
    "C:\Users\Admin\AppData\Local\Temp\1e68534366344db8cd3dd0a60fae3bcc14ab7408c9d1bba1421c83d38cf4d9d4.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2836
    • C:\UserDotJ6\devoptiec.exe
      C:\UserDotJ6\devoptiec.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:4748

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\MintT0\bodxsys.exe

    Filesize

    3.1MB

    MD5

    c42ac3a28ef4569fdb8bf3440b5b478b

    SHA1

    7d626ade0451d2e768b380e65ab2bd175cddd332

    SHA256

    fe273abd446868f0926e5ae1f2c2e703378498c62adba78b892041e5f110f5b2

    SHA512

    4781e42234fd7348b81524cb45e5bc32081deb7a16424207fab36fee26ac10e4434b3a9ca046a0f67f2de088ff005232d95bc86541cf25a151ced40ac4a0efa0

  • C:\UserDotJ6\devoptiec.exe

    Filesize

    3.1MB

    MD5

    d331bd6bc0525b5325988f3bf3c953d7

    SHA1

    f212a741db2b111201d563959982435071e956fb

    SHA256

    f2b6cacfcd8c5bf64cf72e0b9a82911ef0b921010cefcd8696669e4a9fea0b2c

    SHA512

    847675663fac5fdb742e141f8828b7a731087d98720ce3f0caec7db8b1a114b8b7188e6f3d3c24fecb3872c1c4ab6573ff7823b91e9560068a3355dc3f39e976

  • C:\Users\Admin\253086396416_10.0_Admin.ini

    Filesize

    205B

    MD5

    257ce2abd34ab234cfc4504414faf861

    SHA1

    d5aada576d78a541ddfb76ae3311a654b04f23e5

    SHA256

    fda6b3eb228e89892ce0e747958ad80f0c1a1040aa959db9e4a162fa2a2eff94

    SHA512

    d49762a959aa5e1c28cb8958802b764468d12e3a4c725fd83e0433fc311f602b344e4511f8d872657ea618c00feb116d156472e1d138a092f3afcdeae602a730