38bc13ef112b2f17d4d1a80243fac6a521b5d58228984aae0752d79487fa3b66

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

ec4f09f82d...d3.exe

windows10-2004-x64

efd97b1038...ea4.js

windows10-2004-x64

emotet_exe...04.exe

windows10-2004-x64

emotet_exe...23.exe

windows10-2004-x64

eupdate.exe

windows10-2004-x64

f4f47c67be...3f.exe

windows10-2004-x64

fb5d110ced...9c.exe

windows10-2004-x64

fee15285c3...35.exe

windows10-2004-x64

file(1).exe

windows10-2004-x64

file.exe

windows10-2004-x64

gjMEi6eG.exe

windows10-2004-x64

good.exe

windows10-2004-x64

hyundai st...1).exe

windows10-2004-x64

hyundai st...10.exe

windows10-2004-x64

infected d...er.exe

windows10-2004-x64

inps_979.xls

windows10-2004-x64

jar.jar

windows10-2004-x64

june9.dll

windows10-2004-x64

mouse_2.exe

windows10-2004-x64

oof.exe

windows10-2004-x64

openme.exe

windows10-2004-x64

ou55sg33s_1.exe

windows10-2004-x64

senate.dll

windows10-2004-x64

starticon3.exe

windows10-2004-x64

str.dll

windows10-2004-x64

svchost.exe

windows10-2004-x64

update.exe

windows10-2004-x64

vir1.xlsx

windows10-2004-x64

wwf[1].exe

windows10-2004-x64

xNet.dll

windows10-2004-x64

전산 및...��.exe

windows10-2004-x64

전산 및...�1.exe

windows10-2004-x64

Resubmissions

01/03/2025, 18:58

250301-xmhhrayp15 10

01/03/2025, 18:55

250301-xkqrcaypx7 10

Analysis

max time kernel
140s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2024, 19:31

Sharing

Copy URL

Twitter E-mail

Static task

static1

15 signatures

Behavioral task

behavioral1

Sample

ec4f09f82d932cdd40700a74a8875b73a783cbaab1f313286adf615a5336d7d3.exe

Resource

win10v2004-20241007-en

djvu discovery persistence ransomware

windows10-2004-x64

14 signatures

150 seconds

Behavioral task

behavioral2

Sample

efd97b1038e063779fb32a3ab35adc481679a5c6c8e3f4f69c44987ff08b6ea4.js

Resource

win10v2004-20241007-en

execution

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral3

Sample

emotet_exe_e1_ef536781ae8be4b67a7fb8aa562d84994ad250d97d5606115b6f4e6e2992363f_2020-11-17__174504.exe

Resource

win10v2004-20241007-en

emotet epoch1 banker discovery trojan

windows10-2004-x64

11 signatures

150 seconds

Behavioral task

behavioral4

Sample

emotet_exe_e3_93074e9fbde60e4182f5d763bac7762f2d4e2fcf9baf457b6f12e7696b3562c1_2020-11-17__182823.exe

Resource

win10v2004-20241007-en

emotet epoch3 banker discovery trojan

windows10-2004-x64

11 signatures

150 seconds

Behavioral task

behavioral5

Sample

eupdate.exe

Resource

win10v2004-20241007-en

discovery persistence spyware stealer upx

windows10-2004-x64

10 signatures

150 seconds

Behavioral task

behavioral6

Sample

f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe

Resource

win10v2004-20241007-en

bazarbackdoor backdoor

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral7

Sample

fb5d110ced698b06c6cb8c7112792a2d37c579dcd9bde808310cb8dc88e16d9c.exe

Resource

win10v2004-20241007-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral8

Sample

fee15285c36fa7e28e28c7bb9b4cd3940ef12b9907de59d11ab6e2376416d35.exe

Resource

win10v2004-20241007-en

trickbot tar2 banker discovery trojan

windows10-2004-x64

7 signatures

150 seconds

Behavioral task

behavioral9

Sample

file(1).exe

Resource

win10v2004-20241007-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral10

Sample

file.exe

Resource

win10v2004-20241007-en

persistence

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral11

Sample

gjMEi6eG.exe

Resource

win10v2004-20241007-en

njrat discovery evasion persistence privilege_escalation trojan

windows10-2004-x64

11 signatures

150 seconds

Behavioral task

behavioral12

Sample

good.exe

Resource

win10v2004-20241007-en

phorphiex discovery evasion loader persistence trojan upx worm

windows10-2004-x64

11 signatures

150 seconds

Behavioral task

behavioral13

Sample

hyundai steel-pipe- job 8010(1).exe

Resource

win10v2004-20241007-en

hawkeye_reborn m00nd3v_logger collection discovery infostealer keylogger spyware stealer trojan

windows10-2004-x64

16 signatures

150 seconds

Behavioral task

behavioral14

Sample

hyundai steel-pipe- job 8010.exe

Resource

win10v2004-20241007-en

hawkeye_reborn m00nd3v_logger collection discovery infostealer keylogger spyware stealer trojan

windows10-2004-x64

16 signatures

150 seconds

Behavioral task

behavioral15

Sample

infected dot net installer.exe

Resource

win10v2004-20241007-en

xred backdoor discovery persistence

windows10-2004-x64

16 signatures

150 seconds

Behavioral task

behavioral16

Sample

inps_979.xls

Resource

win10v2004-20241007-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral17

Sample

jar.jar

Resource

win10v2004-20241007-en

qnodeservice trojan

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral18

Sample

june9.dll

Resource

win10v2004-20241007-en

zloader june08 june botnet discovery trojan

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral19

Sample

mouse_2.exe

Resource

win10v2004-20241007-en

masslogger collection discovery rezer0 spyware stealer

windows10-2004-x64

19 signatures

150 seconds

Behavioral task

behavioral20

Sample

oof.exe

Resource

win10v2004-20241007-en

discovery

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral21

Sample

openme.exe

Resource

win10v2004-20241007-en

trickbot banker discovery trojan

windows10-2004-x64

7 signatures

150 seconds

Behavioral task

behavioral22

Sample

ou55sg33s_1.exe

Resource

win10v2004-20241007-en

betabot modiloader backdoor botnet defense_evasion discovery evasion persistence trojan

windows10-2004-x64

25 signatures

150 seconds

Behavioral task

behavioral23

Sample

senate.dll

Resource

win10v2004-20241007-en

zloader spx139 spx139 botnet discovery trojan

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral24

Sample

starticon3.exe

Resource

win10v2004-20241007-en

djvu discovery persistence ransomware

windows10-2004-x64

12 signatures

150 seconds

Behavioral task

behavioral25

Sample

str.dll

Resource

win10v2004-20241007-en

zloader bot5 bot5 botnet discovery persistence trojan

windows10-2004-x64

7 signatures

150 seconds

Behavioral task

behavioral26

Sample

svchost.exe

Resource

win10v2004-20241007-en

njrat discovery evasion persistence privilege_escalation trojan

windows10-2004-x64

10 signatures

150 seconds

Behavioral task

behavioral27

Sample

update.exe

Resource

win10v2004-20241007-en

rms xmrig aspackv2 defense_evasion discovery evasion execution lateral_movement miner persistence privilege_escalation rat trojan upx

windows10-2004-x64

54 signatures

150 seconds

Behavioral task

behavioral28

Sample

vir1.xlsx

Resource

win10v2004-20241007-en

windows10-2004-x64

7 signatures

150 seconds

Behavioral task

behavioral29

Sample

wwf[1].exe

Resource

win10v2004-20241007-en

zloader bot7 bot7 botnet discovery persistence trojan

windows10-2004-x64

7 signatures

150 seconds

Behavioral task

behavioral30

Sample

xNet.dll

Resource

win10v2004-20241007-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral31

Sample

전산 및 비전산자료 보존 요청서(20200525)_꼭 확인하시고 자료보존해주세요.exe

Resource

win10v2004-20241007-en

vidar 276 discovery spyware stealer

windows10-2004-x64

12 signatures

150 seconds

Behavioral task

behavioral32

Sample

전산 및 비전산자료 보존 요청서(20200525)_꼭 확인하시고 자료보존해주세요1.exe

Resource

win10v2004-20241007-en

makop credential_access defense_evasion discovery execution impact persistence ransomware spyware stealer

windows10-2004-x64

21 signatures

150 seconds

Report Analysis Logs

General

Target

oof.exe
Size

662KB
MD5

0760d43d4adebe20fa0b5e5a7bca1714
SHA1

a0a9dae5e9be39bca31021dd9cf565fcdefb8474
SHA256

8f9067f2bd4a374539a40fddb8915600c9fd6ba3e5db20cbddcb3c5f22d9da44
SHA512

7e60c2726711bb8e822375f93cfb9ced7d172f3f0ae07041cbeea8c4cdb45488d1de90ee77dfef52aa86722a5dcbe521d1affeace3aec8811e851f693d74ef77
SSDEEP

12288:9TEUsvsVEcwaFNaxr7IwFnm1p7BmC10sHo0AhHL:9oBvRcxuxrksqRNI0i

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oof.exe

Processes

C:\Users\Admin\AppData\Local\Temp\oof.exe
"C:\Users\Admin\AppData\Local\Temp\oof.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1180-0-0x0000000002340000-0x0000000002341000-memory.dmp

Filesize
4KB

Download
memory/1180-2-0x0000000002340000-0x0000000002341000-memory.dmp

Filesize
4KB

Download
memory/1180-1-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download