Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
18/08/2024, 02:18
General
-
Target
4a0d6ec6b2bdd3f6fc81cc158f0342d0N.exe
-
Size
2.7MB
-
MD5
4a0d6ec6b2bdd3f6fc81cc158f0342d0
-
SHA1
ddd6340d156b0a61f38336ce4c951c383ef3ab0a
-
SHA256
d5b53869944308d199558c0f07b9a665d1bd4cdaac3816abc8c7db2c5ebf8a2d
-
SHA512
0f6f312158598afa4039d109463d56334beeab66222006ba1653cd1e514da29eb9e383aa0126188b6d194c26affdc760624b1c35ced876bcf70407d5b2092ffd
-
SSDEEP
49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBL9w4S+:+R0pI/IQlUoMPdmpSpv4X
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a0d6ec6b2bdd3f6fc81cc158f0342d0N.exe"C:\Users\Admin\AppData\Local\Temp\4a0d6ec6b2bdd3f6fc81cc158f0342d0N.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\AdobeUY\xoptisys.exeC:\AdobeUY\xoptisys.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9KB
MD5bf965ee8f9d95b943a5ea888a522c44e
SHA169326314abf4da6764942ada42d063b44fb707c9
SHA25613c64f8ad509d213565146a5459b79218788b601d1d572943dfbacb755233c7e
SHA512c5b066aa1f9c4aa2d78f788c9be796bc4016f479bb94a04aa8acc989526f1637cb18b97eefb4cc366cf3b29b7f7860dfe7860a23ddf51ae21401c53b0004d60b
-
Filesize
2.7MB
MD548ff9330e14c975fdce24f81cbc0fda1
SHA15787625c3c089a31feee7246658b949073224077
SHA25610808b86c5fbb3429060f4f2aa725f446641a2c8c8b20da223a96def9b409e78
SHA5124bf108a1dee5ad0459f5c48b4c1045f6251b6b6f92a4b62e1b464307b59dfb72184f0af1d61f73f45407323302a456c9b19bf95d2c81f476d9b6940c561c1412
-
Filesize
204B
MD5a10d929430d6a353092359377090f66e
SHA1077ae5c9876f7ffe9c169cf5ee45bf0be411a932
SHA2566590c7d3a4fc20fdd6c28e22095371135fe874d04f7b0967a112eb9ccd3c3b15
SHA5125da6e54ffba9112b08adcac39a7208e2278927ca5411f3f58474e6b39d3d023f325fd6a55efbd322f27c4dee2f1335bd8cfd2903f9ae3d01ccacd69e1a354c50
-
Filesize
2.7MB
MD58d5dda4bd4be33fdc11e5e84c42dd1c3
SHA1fd12db3fd4a2d7c35f0b7c597e75919a36664a2e
SHA256dd7d50c32cf0c96dcbd39c3bc383688ac12dc4a10940e4dae36b7a35a845cc2c
SHA512fa090bb6b65bc2e1adbe895405cc9eab33abb9ebd16eae07002840a2b8e21397be541405c0b198ecbe2b4281bf1ba59e6ff8bcfd8408548fac7cfa8106ddc312