Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
25/08/2024, 16:51
General
-
Target
c4361213756737fdc082e4de26199740N.exe
-
Size
2.7MB
-
MD5
c4361213756737fdc082e4de26199740
-
SHA1
d5a79ae774b716dd8c62081233459ca1a88329b7
-
SHA256
ff078ae2ca23c8447695c0d1ebbf2f51da99eb60c132fee5d001653bfd26c6fc
-
SHA512
6e7dbf3680a9096638dc1ab605de8fb58937c8a38da8401f52d2981f65c69f733ffef3387c971d174438806b2299674634fe409bcf8e0f774b9aa3012242679d
-
SSDEEP
49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBJ9w4Sx:+R0pI/IQlUoMPdmpSpJ4
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c4361213756737fdc082e4de26199740N.exe"C:\Users\Admin\AppData\Local\Temp\c4361213756737fdc082e4de26199740N.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\FilesSE\xbodsys.exeC:\FilesSE\xbodsys.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD5372ccc2062803321b320adc4845c7603
SHA131e620330130679cf2a40563221332c3bb896d1b
SHA256fdbc7d740ecb5574edbfbe53568ed5c13afcdb329c4b8b7b6e69adaa09c1940e
SHA512fd02ab04b91cb6d362d3b0e41f4034c53cb5bfeaa5ae7e246ae123756255444bf28de960a72425bb4311c5305113be1abf14ad4ad0751b95bc6b21ebf9638e2b
-
Filesize
1.9MB
MD57862655968d0e8388263722fa1960498
SHA13cac32a31bd456ffd8177432373f680bec4eae33
SHA2563041c1b3e18a0ec09747ad16b7e848a4322fb108148658b2e85876456eb82163
SHA51293ca81df72f57321ee67422712514386cc41eb4959c27057eca22bb0ac681369e6025ece099ee82f1e16b70b226931e25639b166ab4483b11395ee557fde545f
-
Filesize
200B
MD5095df9d610e12b63ba2638f411665c5e
SHA13d5f71f729eca967fb42ee2938e9d11aeb491cdb
SHA2567807c844ee9c5e6e68dfd5fc184a0d0cc2d994dc200fb41a2b16cab39084b1e0
SHA51254d35c394c51c80e3b72dedc91642414dc369f99757b9e7388112bb5d94d50627b33a5b0045569511115ee4d472b77768d88154e8c8a078620cb6b1c735d4cb3