Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
18/08/2024, 02:18
Static task
static1
Behavioral task
behavioral1
Sample
4a0d6ec6b2bdd3f6fc81cc158f0342d0N.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
4a0d6ec6b2bdd3f6fc81cc158f0342d0N.exe
Resource
win10v2004-20240802-en
General
-
Target
4a0d6ec6b2bdd3f6fc81cc158f0342d0N.exe
-
Size
2.7MB
-
MD5
4a0d6ec6b2bdd3f6fc81cc158f0342d0
-
SHA1
ddd6340d156b0a61f38336ce4c951c383ef3ab0a
-
SHA256
d5b53869944308d199558c0f07b9a665d1bd4cdaac3816abc8c7db2c5ebf8a2d
-
SHA512
0f6f312158598afa4039d109463d56334beeab66222006ba1653cd1e514da29eb9e383aa0126188b6d194c26affdc760624b1c35ced876bcf70407d5b2092ffd
-
SSDEEP
49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBL9w4S+:+R0pI/IQlUoMPdmpSpv4X
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2272 xoptisys.exe -
Loads dropped DLL 1 IoCs
pid Process 1760 4a0d6ec6b2bdd3f6fc81cc158f0342d0N.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\AdobeUY\\xoptisys.exe" 4a0d6ec6b2bdd3f6fc81cc158f0342d0N.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\KaVBKK\\boddevec.exe" 4a0d6ec6b2bdd3f6fc81cc158f0342d0N.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4a0d6ec6b2bdd3f6fc81cc158f0342d0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xoptisys.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1760 4a0d6ec6b2bdd3f6fc81cc158f0342d0N.exe 1760 4a0d6ec6b2bdd3f6fc81cc158f0342d0N.exe 2272 xoptisys.exe 1760 4a0d6ec6b2bdd3f6fc81cc158f0342d0N.exe 2272 xoptisys.exe 1760 4a0d6ec6b2bdd3f6fc81cc158f0342d0N.exe 2272 xoptisys.exe 1760 4a0d6ec6b2bdd3f6fc81cc158f0342d0N.exe 2272 xoptisys.exe 1760 4a0d6ec6b2bdd3f6fc81cc158f0342d0N.exe 2272 xoptisys.exe 1760 4a0d6ec6b2bdd3f6fc81cc158f0342d0N.exe 2272 xoptisys.exe 1760 4a0d6ec6b2bdd3f6fc81cc158f0342d0N.exe 2272 xoptisys.exe 1760 4a0d6ec6b2bdd3f6fc81cc158f0342d0N.exe 2272 xoptisys.exe 1760 4a0d6ec6b2bdd3f6fc81cc158f0342d0N.exe 2272 xoptisys.exe 1760 4a0d6ec6b2bdd3f6fc81cc158f0342d0N.exe 2272 xoptisys.exe 1760 4a0d6ec6b2bdd3f6fc81cc158f0342d0N.exe 2272 xoptisys.exe 1760 4a0d6ec6b2bdd3f6fc81cc158f0342d0N.exe 2272 xoptisys.exe 1760 4a0d6ec6b2bdd3f6fc81cc158f0342d0N.exe 2272 xoptisys.exe 1760 4a0d6ec6b2bdd3f6fc81cc158f0342d0N.exe 2272 xoptisys.exe 1760 4a0d6ec6b2bdd3f6fc81cc158f0342d0N.exe 2272 xoptisys.exe 1760 4a0d6ec6b2bdd3f6fc81cc158f0342d0N.exe 2272 xoptisys.exe 1760 4a0d6ec6b2bdd3f6fc81cc158f0342d0N.exe 2272 xoptisys.exe 1760 4a0d6ec6b2bdd3f6fc81cc158f0342d0N.exe 2272 xoptisys.exe 1760 4a0d6ec6b2bdd3f6fc81cc158f0342d0N.exe 2272 xoptisys.exe 1760 4a0d6ec6b2bdd3f6fc81cc158f0342d0N.exe 2272 xoptisys.exe 1760 4a0d6ec6b2bdd3f6fc81cc158f0342d0N.exe 2272 xoptisys.exe 1760 4a0d6ec6b2bdd3f6fc81cc158f0342d0N.exe 2272 xoptisys.exe 1760 4a0d6ec6b2bdd3f6fc81cc158f0342d0N.exe 2272 xoptisys.exe 1760 4a0d6ec6b2bdd3f6fc81cc158f0342d0N.exe 2272 xoptisys.exe 1760 4a0d6ec6b2bdd3f6fc81cc158f0342d0N.exe 2272 xoptisys.exe 1760 4a0d6ec6b2bdd3f6fc81cc158f0342d0N.exe 2272 xoptisys.exe 1760 4a0d6ec6b2bdd3f6fc81cc158f0342d0N.exe 2272 xoptisys.exe 1760 4a0d6ec6b2bdd3f6fc81cc158f0342d0N.exe 2272 xoptisys.exe 1760 4a0d6ec6b2bdd3f6fc81cc158f0342d0N.exe 2272 xoptisys.exe 1760 4a0d6ec6b2bdd3f6fc81cc158f0342d0N.exe 2272 xoptisys.exe 1760 4a0d6ec6b2bdd3f6fc81cc158f0342d0N.exe 2272 xoptisys.exe 1760 4a0d6ec6b2bdd3f6fc81cc158f0342d0N.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1760 wrote to memory of 2272 1760 4a0d6ec6b2bdd3f6fc81cc158f0342d0N.exe 30 PID 1760 wrote to memory of 2272 1760 4a0d6ec6b2bdd3f6fc81cc158f0342d0N.exe 30 PID 1760 wrote to memory of 2272 1760 4a0d6ec6b2bdd3f6fc81cc158f0342d0N.exe 30 PID 1760 wrote to memory of 2272 1760 4a0d6ec6b2bdd3f6fc81cc158f0342d0N.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a0d6ec6b2bdd3f6fc81cc158f0342d0N.exe"C:\Users\Admin\AppData\Local\Temp\4a0d6ec6b2bdd3f6fc81cc158f0342d0N.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\AdobeUY\xoptisys.exeC:\AdobeUY\xoptisys.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2272
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9KB
MD5bf965ee8f9d95b943a5ea888a522c44e
SHA169326314abf4da6764942ada42d063b44fb707c9
SHA25613c64f8ad509d213565146a5459b79218788b601d1d572943dfbacb755233c7e
SHA512c5b066aa1f9c4aa2d78f788c9be796bc4016f479bb94a04aa8acc989526f1637cb18b97eefb4cc366cf3b29b7f7860dfe7860a23ddf51ae21401c53b0004d60b
-
Filesize
2.7MB
MD548ff9330e14c975fdce24f81cbc0fda1
SHA15787625c3c089a31feee7246658b949073224077
SHA25610808b86c5fbb3429060f4f2aa725f446641a2c8c8b20da223a96def9b409e78
SHA5124bf108a1dee5ad0459f5c48b4c1045f6251b6b6f92a4b62e1b464307b59dfb72184f0af1d61f73f45407323302a456c9b19bf95d2c81f476d9b6940c561c1412
-
Filesize
204B
MD5a10d929430d6a353092359377090f66e
SHA1077ae5c9876f7ffe9c169cf5ee45bf0be411a932
SHA2566590c7d3a4fc20fdd6c28e22095371135fe874d04f7b0967a112eb9ccd3c3b15
SHA5125da6e54ffba9112b08adcac39a7208e2278927ca5411f3f58474e6b39d3d023f325fd6a55efbd322f27c4dee2f1335bd8cfd2903f9ae3d01ccacd69e1a354c50
-
Filesize
2.7MB
MD58d5dda4bd4be33fdc11e5e84c42dd1c3
SHA1fd12db3fd4a2d7c35f0b7c597e75919a36664a2e
SHA256dd7d50c32cf0c96dcbd39c3bc383688ac12dc4a10940e4dae36b7a35a845cc2c
SHA512fa090bb6b65bc2e1adbe895405cc9eab33abb9ebd16eae07002840a2b8e21397be541405c0b198ecbe2b4281bf1ba59e6ff8bcfd8408548fac7cfa8106ddc312