Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

8f4d2f0e0c...c4.exe

windows7-x64

7

8f4d2f0e0c...c4.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/08/2024, 01:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8f4d2f0e0c86fcf9ab1bcf4fc1f6f4934837b2d2950acad50f2e6da1053399c4.exe

  • Size

    2.7MB

  • MD5

    a90cffa702e913306df4c4a0acdfd404

  • SHA1

    688da8c94990b47fff9fd83253b972b8dee2cbdb

  • SHA256

    8f4d2f0e0c86fcf9ab1bcf4fc1f6f4934837b2d2950acad50f2e6da1053399c4

  • SHA512

    43f0a3b77e613f9a43540867572ec8f298c8f7af7c353467b2a51f5b3804869e5eff5db160a6ebe4e5a02e3dab31ae89c66494fe037dc57bd8e8f289a61c72dc

  • SSDEEP

    49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBP9w4Sx:+R0pI/IQlUoMPdmpSpD4

Score
7/10
discoverypersistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8f4d2f0e0c86fcf9ab1bcf4fc1f6f4934837b2d2950acad50f2e6da1053399c4.exe
    "C:\Users\Admin\AppData\Local\Temp\8f4d2f0e0c86fcf9ab1bcf4fc1f6f4934837b2d2950acad50f2e6da1053399c4.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3872
    • C:\AdobeX7\xbodec.exe
      C:\AdobeX7\xbodec.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:1840

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\AdobeX7\xbodec.exe
    Filesize

    2.7MB

    MD5

    c9a93fc9d5a91741763b1318169023c4

    SHA1

    d4d9a4eec1d32228038f638f6ed1ab588e38a249

    SHA256

    fae224c495601126567f8878cf817d3313c2a7c86cb2def0398f7c2cdbf7799e

    SHA512

    a6a10a03a950d99f58042872ac0f7f46de896cd22b4721a60db75bc19284ef2cd4fbe1a3daaa3cabc27cbb664057a2277371dc687cc63712bb972f42cb40eb6c

    Download Submit

  • C:\Users\Admin\253086396416_10.0_Admin.ini
    Filesize

    203B

    MD5

    48298045bc6b892453eee4b42510656b

    SHA1

    43914273973d897ea5106cd5b4729bcb1eb6fb39

    SHA256

    2fedbc27d5558ee38fca5fe8e9864ab42c4d31c238f9c0eef9582c9478347316

    SHA512

    763711e06a4a594931598d2cfe6527a08b355a5d761c5817cf00ec7f7c83208161745c9cf33e90e8baceea4aaa0b23ac100d9b9162fe56f376eed2b661fc03aa

    Download Submit

  • C:\VidL8\dobxsys.exe
    Filesize

    6KB

    MD5

    2836941cb9ff5075fd24e907563f87e5

    SHA1

    191f35c4de0db98233d503773008ca9d386f7dca

    SHA256

    909341ecf16c532e447b85db09b0031027523c6e73e6ebb3123b6c4f6672a9f4

    SHA512

    4017325aedbdd6b040232f56b048881cbc7dfee91642b03dc65988041417f747376d8a494fe3ace348af127e46b33efaf9fe88129b1f50ce96b67c94964d4381

    Download Submit