Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
19/08/2024, 17:12
Static task
static1
Behavioral task
behavioral1
Sample
b3d0db9af32f965764062a94451da830N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
b3d0db9af32f965764062a94451da830N.exe
Resource
win10v2004-20240802-en
General
-
Target
b3d0db9af32f965764062a94451da830N.exe
-
Size
3.1MB
-
MD5
b3d0db9af32f965764062a94451da830
-
SHA1
1ed9cd9e1b567e1ec86f8ecfaa51c1f1d57c3e6e
-
SHA256
f18f894942289c60091fc9318f9c55a7640d0dd40f4ec713d657c152da182a8f
-
SHA512
627c04f68780d47549532c5bd924516337d47716ced2892f357338ba06c03cf197e6d5c9409b09849755c09ea6b1f53466e5537fb65d90edd4fa0d38fc84f779
-
SSDEEP
49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBY9w4Su+LNfej:+R0pI/IQlUoMPdmpSpy4JkNfej
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2520 xdobec.exe -
Loads dropped DLL 1 IoCs
pid Process 2324 b3d0db9af32f965764062a94451da830N.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\Vid0X\\dobxsys.exe" b3d0db9af32f965764062a94451da830N.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\IntelprocB4\\xdobec.exe" b3d0db9af32f965764062a94451da830N.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b3d0db9af32f965764062a94451da830N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdobec.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2324 b3d0db9af32f965764062a94451da830N.exe 2324 b3d0db9af32f965764062a94451da830N.exe 2520 xdobec.exe 2324 b3d0db9af32f965764062a94451da830N.exe 2520 xdobec.exe 2324 b3d0db9af32f965764062a94451da830N.exe 2520 xdobec.exe 2324 b3d0db9af32f965764062a94451da830N.exe 2520 xdobec.exe 2324 b3d0db9af32f965764062a94451da830N.exe 2520 xdobec.exe 2324 b3d0db9af32f965764062a94451da830N.exe 2520 xdobec.exe 2324 b3d0db9af32f965764062a94451da830N.exe 2520 xdobec.exe 2324 b3d0db9af32f965764062a94451da830N.exe 2520 xdobec.exe 2324 b3d0db9af32f965764062a94451da830N.exe 2520 xdobec.exe 2324 b3d0db9af32f965764062a94451da830N.exe 2520 xdobec.exe 2324 b3d0db9af32f965764062a94451da830N.exe 2520 xdobec.exe 2324 b3d0db9af32f965764062a94451da830N.exe 2520 xdobec.exe 2324 b3d0db9af32f965764062a94451da830N.exe 2520 xdobec.exe 2324 b3d0db9af32f965764062a94451da830N.exe 2520 xdobec.exe 2324 b3d0db9af32f965764062a94451da830N.exe 2520 xdobec.exe 2324 b3d0db9af32f965764062a94451da830N.exe 2520 xdobec.exe 2324 b3d0db9af32f965764062a94451da830N.exe 2520 xdobec.exe 2324 b3d0db9af32f965764062a94451da830N.exe 2520 xdobec.exe 2324 b3d0db9af32f965764062a94451da830N.exe 2520 xdobec.exe 2324 b3d0db9af32f965764062a94451da830N.exe 2520 xdobec.exe 2324 b3d0db9af32f965764062a94451da830N.exe 2520 xdobec.exe 2324 b3d0db9af32f965764062a94451da830N.exe 2520 xdobec.exe 2324 b3d0db9af32f965764062a94451da830N.exe 2520 xdobec.exe 2324 b3d0db9af32f965764062a94451da830N.exe 2520 xdobec.exe 2324 b3d0db9af32f965764062a94451da830N.exe 2520 xdobec.exe 2324 b3d0db9af32f965764062a94451da830N.exe 2520 xdobec.exe 2324 b3d0db9af32f965764062a94451da830N.exe 2520 xdobec.exe 2324 b3d0db9af32f965764062a94451da830N.exe 2520 xdobec.exe 2324 b3d0db9af32f965764062a94451da830N.exe 2520 xdobec.exe 2324 b3d0db9af32f965764062a94451da830N.exe 2520 xdobec.exe 2324 b3d0db9af32f965764062a94451da830N.exe 2520 xdobec.exe 2324 b3d0db9af32f965764062a94451da830N.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2324 wrote to memory of 2520 2324 b3d0db9af32f965764062a94451da830N.exe 30 PID 2324 wrote to memory of 2520 2324 b3d0db9af32f965764062a94451da830N.exe 30 PID 2324 wrote to memory of 2520 2324 b3d0db9af32f965764062a94451da830N.exe 30 PID 2324 wrote to memory of 2520 2324 b3d0db9af32f965764062a94451da830N.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\b3d0db9af32f965764062a94451da830N.exe"C:\Users\Admin\AppData\Local\Temp\b3d0db9af32f965764062a94451da830N.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\IntelprocB4\xdobec.exeC:\IntelprocB4\xdobec.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2520
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
204B
MD51cc6bcfdbfddc31f8e6983a774a6b1b4
SHA16a680d5ca9d08a5bca924bdeb2dc8470d85590e2
SHA256899ab7cf66a191d2ab7aeb1b24091edaa7ac71cfa56b59f40db5c8fb3e3914c4
SHA5122336075ce738c984d2a65aed7e03a71ddea2a06b3917db39c043b789ed682300ca1464ea63d427acd2a91c97a417177f2f2e4dcab050a5433b5eb2bfe386a83e
-
Filesize
3.1MB
MD529aa02cfafb72064825815072845b5fb
SHA1985a50c38ee36c65c595a8f4a48a77e279ff2b68
SHA256b03f6881d7b4589f16a96cfacd8c14ec93c3aedb04c5c10b01de4b57fab7d13e
SHA512fa7d01d6c8d7fa5aa86dd4a3f5622373efc758818c298752c2d649c6ccfc3579daf464d2581e9639485674676946c37888b1cc57f6839c9c9e5d6a9f46b29818
-
Filesize
3.1MB
MD5a56037498f0994a04e8446485effb5d0
SHA137078c4b2d94805a3de854329cc072d7749faa21
SHA256d495c712eac92a253583a1e28d927d0da748d95813227d94b1c643bd53e14b5b
SHA512debf4818bad130782eeeb189a143b851a384787375da876678d6db8130b819197c456d423dbe9421206736992008d3cf2a9db9e8879a60561800e4e50e64bcc4