Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

6e37c6c2c3...e5.exe

windows7-x64

7

6e37c6c2c3...e5.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    09/08/2024, 22:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6e37c6c2c33286a420dc4fe2de3e7d5460f697ed7c15222ab398ff7d88a50be5.exe

  • Size

    2.7MB

  • MD5

    6e8372e4098b599de1ac0fc3f0610d74

  • SHA1

    6e4cab862e5e10f269118b88f20a8f699f853e80

  • SHA256

    6e37c6c2c33286a420dc4fe2de3e7d5460f697ed7c15222ab398ff7d88a50be5

  • SHA512

    0daf6f512eff68610a5f9808051b43fd781c2d0bfdb86c19d3f68c031653745492f33a5606a8efa48f79c579b1f06e2176ae7cd18efb5dfc451654a578f29a49

  • SSDEEP

    49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBX9w4Sx:+R0pI/IQlUoMPdmpSpH4

Score
7/10
discoverypersistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6e37c6c2c33286a420dc4fe2de3e7d5460f697ed7c15222ab398ff7d88a50be5.exe
    "C:\Users\Admin\AppData\Local\Temp\6e37c6c2c33286a420dc4fe2de3e7d5460f697ed7c15222ab398ff7d88a50be5.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2104
    • C:\SysDrvGC\adobec.exe
      C:\SysDrvGC\adobec.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:3064

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\253086396416_6.1_Admin.ini
    Filesize

    199B

    MD5

    74315c6895e7f67503fb873e5bbd4d6f

    SHA1

    ff20939f88228097241bf32a9ef68b2b7579d2e5

    SHA256

    7f8a787fdfee8d3c4ed67f69c581540430af4652e3a14aa6a9714cbafaf7f6bd

    SHA512

    c77941f24450d5a450afffbd4ef3e1c47cd29877e6ee71ee2c61187902a0458266a22c5805c2066e5e0626455dd65a02703f59cdf30eb1594e36122feefde37c

    Download Submit

  • C:\VidGO\optiaec.exe
    Filesize

    2.7MB

    MD5

    c8bc168889907bb3b7270a53311330da

    SHA1

    a7da3dfe5620b183be299d33b3b126b9f7807aec

    SHA256

    85d2d5867d10f964eecdb88eadd268eec7fd756b51e5564eff297cb2ab241c6d

    SHA512

    5a97cd342b04096cd673a7afd4b128392a9334cf64d592a1ceca99f620d9ab34a46ba8e8f9a4be883326cc994727485a274a9690027c760743d9e6414b2c7288

    Download Submit

  • \SysDrvGC\adobec.exe
    Filesize

    2.7MB

    MD5

    8c735136643860f4a82a5c6ee2c98b3b

    SHA1

    d4fa6d5e9e7610d0fe150468d0641436d8184931

    SHA256

    2a6844b72ab7bc7cf9d1c290e6a93dbb6ed70d687303832cf17246f13c5ecdc3

    SHA512

    deb9efc65556d9d0f6c21d20b863502d8dd187bce90076ed4dd8dd3365138385aac242685b1029e0c2ff2c5931021c791dd4ad9a1e937a77c89be7edcaaa9bb1

    Download Submit