Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

Octane.zip

windows10-1703-x64

1

Octane.exe

windows10-1703-x64

7

Octane_Injector.exe

windows10-1703-x64

7

Octane_Module.dll

windows10-1703-x64

1

runtimes/w...er.dll

windows10-1703-x64

1

runtimes/w...er.dll

windows10-1703-x64

1

runtimes/w...er.dll

windows10-1703-x64

3

Analysis

  • max time kernel
    135s
  • max time network
    136s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    04/10/2024, 05:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Octane_Injector.exe

  • Size

    704KB

  • MD5

    5ee0fa66487080e85cde7ca26e09790d

  • SHA1

    0724e0b4e49a1598ba38da914b113fef6649daf2

  • SHA256

    7a311dd1a74b1e7fcc07d439ed0681cc4666802cd6b9d49efdae5c434b799021

  • SHA512

    27c7bbb95f3f34354536cca03550b4fabb172b718184c1e55d98d7847a96d528d362143eb6fc042df8b7e7e9aae199652fb5dd5398b879b515e366339345bb02

  • SSDEEP

    12288:qH/YJGsdbZ5CfW7wg79ro20/9toNc1jWYWhCIwLph0lhSMXlizNocCKbYVk:qf8bZHwI9ctFtoNc1jWYWhCIyh0lhSMa

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
  • Drops file in Windows directory 4 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Octane_Injector.exe
    "C:\Users\Admin\AppData\Local\Temp\Octane_Injector.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1104
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c start https://octane.lol/discord
      2⤵
      • Checks computer location settings
      PID:600
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
    1⤵
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:2632
  • C:\Windows\system32\browser_broker.exe
    C:\Windows\system32\browser_broker.exe -Embedding
    1⤵
    • Modifies Internet Explorer settings
    PID:3716
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies registry class
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4420
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:4752
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Drops file in Windows directory
    • Modifies registry class
    PID:932

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
    Filesize

    4KB

    MD5

    1bfe591a4fe3d91b03cdf26eaacd8f89

    SHA1

    719c37c320f518ac168c86723724891950911cea

    SHA256

    9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8

    SHA512

    02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

    Download Submit

  • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\VXF1XLAP\favicon[1].ico
    Filesize

    23KB

    MD5

    ec2c34cadd4b5f4594415127380a85e6

    SHA1

    e7e129270da0153510ef04a148d08702b980b679

    SHA256

    128e20b3b15c65dd470cb9d0dc8fe10e2ff9f72fac99ee621b01a391ef6b81c7

    SHA512

    c1997779ff5d0f74a7fbb359606dab83439c143fbdb52025495bdc3a7cb87188085eaf12cc434cbf63b3f8da5417c8a03f2e64f751c0a63508e4412ea4e7425c

    Download Submit

  • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DFEE949FB7AABA4791.TMP
    Filesize

    16KB

    MD5

    e7cfd98008e92faa93938e7a981de0cf

    SHA1

    972591f8db7a9e5f5e08d8b62d3c0fc360f62d5e

    SHA256

    476b8e5615e765b992acb6add38eb635fd734f5c6c616e581c196c81f785b97a

    SHA512

    522273dec650b72ba7158eb53d3e979160c4978930d5d56e7fc0211c7d79ef7bc10c7905a8ccd3f46532bf27fac3a2bfdd64096e130590609bef3673b12d97fc

    Download Submit

  • memory/932-76-0x00000204C9050000-0x00000204C9052000-memory.dmp

    Filesize

    8KB

    Download

  • memory/932-74-0x00000204C9030000-0x00000204C9032000-memory.dmp

    Filesize

    8KB

    Download

  • memory/932-72-0x00000204C9010000-0x00000204C9012000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2632-180-0x0000021F059F0000-0x0000021F059F1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2632-129-0x0000021F05910000-0x0000021F05911000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2632-130-0x0000021F05940000-0x0000021F05941000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2632-177-0x0000021F059F0000-0x0000021F059F2000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2632-0-0x0000021F7ED20000-0x0000021F7ED30000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2632-184-0x0000021F7C1A0000-0x0000021F7C1A1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2632-35-0x0000021F7C1D0000-0x0000021F7C1D2000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2632-16-0x0000021F7EE20000-0x0000021F7EE30000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4752-42-0x00000219F8C00000-0x00000219F8D00000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/4752-44-0x00000219F8C00000-0x00000219F8D00000-memory.dmp

    Filesize

    1024KB

    Download