Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

6fb5509b71...f0.exe

windows7-x64

7

6fb5509b71...f0.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/08/2024, 22:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6fb5509b71cfdd3ac59431d7e4b97db1ed91daa2ca5481aa9c9dd7ad848145f0.exe

  • Size

    2.7MB

  • MD5

    3537b2e7b46a0f1a2cfd6bd8c51d3a9a

  • SHA1

    5abf1b26db7fc08ad1a83c9bc681cb55b0f5d87c

  • SHA256

    6fb5509b71cfdd3ac59431d7e4b97db1ed91daa2ca5481aa9c9dd7ad848145f0

  • SHA512

    22f00b81e2e57bc132de3648da242b20c950277cfe400fe8b4c07214fe4af2f21087c33d38fe62b0a79c0c9a1497d9b6bf29525cc675a62f0f910f37c7cd984d

  • SSDEEP

    49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBm9w4Sx:+R0pI/IQlUoMPdmpSp04

Score
7/10
discoverypersistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6fb5509b71cfdd3ac59431d7e4b97db1ed91daa2ca5481aa9c9dd7ad848145f0.exe
    "C:\Users\Admin\AppData\Local\Temp\6fb5509b71cfdd3ac59431d7e4b97db1ed91daa2ca5481aa9c9dd7ad848145f0.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4128
    • C:\SysDrvNQ\abodloc.exe
      C:\SysDrvNQ\abodloc.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:1984

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\LabZWL\optixec.exe
    Filesize

    2.7MB

    MD5

    a6301b6868d38f455716924a10afdc11

    SHA1

    1ec9fadc7de74cda0bf1e0089f9e115f253d7303

    SHA256

    a9be251831a381a01d3f954e28d57e687dc29d44af239652b35f4f300539710f

    SHA512

    3081c3c0039c49cd176bd904c61c91c981718e199fff205f28c6e8a2271a675d4a5a1901de439d676a9e9e86f4f01eba39245085b86d43570174a39b6eb6cb75

    Download Submit

  • C:\SysDrvNQ\abodloc.exe
    Filesize

    2.7MB

    MD5

    4f1065ae21dc2812f4f4c62baf7ecee8

    SHA1

    70f9e8251597dba89169786fb5f32986b71eec8b

    SHA256

    5f6345ff75ea3b423ef5fefaa3e641fcf98a210cd0addaf702e267d40175804a

    SHA512

    fc32cf1818dfea4bc3a1ec3c60aee1508dd603581049c2e9b637dfc9c7a40a58eecd5d568bd5a90c9065b209c980def1f0ea4ff8c73361729fcf09d328eccf6a

    Download Submit

  • C:\Users\Admin\253086396416_10.0_Admin.ini
    Filesize

    203B

    MD5

    e39cae161c8ce3ed4fa06bc9fdc37b86

    SHA1

    7a75b58a50e7fbbcc082ad77b9864489987c9e81

    SHA256

    50e5d94a575f4d0ca5519cd47a264bea75957c15dd815ca9ac80c8e560f246a0

    SHA512

    eb679995c3ba32a831e9f90e9872f90889739b95fa2ba456b9ac13fed9f7f472e5f39b844e984e3676f1836a3d31d7256ba0d9a2d6714a38b69a1f793720d794

    Download Submit