Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

8

694a01dabf...ba.exe

windows7-x64

8

694a01dabf...ba.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    172s
  • max time network
    180s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/10/2022, 10:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    694a01dabfcae9081427aaa200f6c0d43d09539e9c300f5165a799362a7a9bba.exe

  • Size

    436KB

  • MD5

    68903762db226e18344ac90a11fb8fb0

  • SHA1

    4ad4e25df70ded17bc5f4f1bc9bda781d704d899

  • SHA256

    694a01dabfcae9081427aaa200f6c0d43d09539e9c300f5165a799362a7a9bba

  • SHA512

    eae7273a9adca8f6dac4895eff0a6ac7fadb71ae8f43c031d6c0d741377ad4cf7c491e8c860aa9970367841fb9b1a8796c4dc3512a7ba8594ed338a2e6e63e83

  • SSDEEP

    6144:vrQ7X8rQ7X8rQ7X8rQ7X8rQ7XqF/rxWoksa+IlzpN7kypXsGKLu8N:vrE8rE8rE8rE8rEoxWJsClzPIytmx

Score
8/10
spywarestealerupx

Malware Config

Signatures

  • Executes dropped EXE 6 IoCs
  • UPX packed file 19 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops startup file 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 8 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 53 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\694a01dabfcae9081427aaa200f6c0d43d09539e9c300f5165a799362a7a9bba.exe
    "C:\Users\Admin\AppData\Local\Temp\694a01dabfcae9081427aaa200f6c0d43d09539e9c300f5165a799362a7a9bba.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1336
    • C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3136
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        3⤵
          PID:1436
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE803.bat
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4632
        • C:\Users\Admin\AppData\Local\Temp\694a01dabfcae9081427aaa200f6c0d43d09539e9c300f5165a799362a7a9bba.exe
          "C:\Users\Admin\AppData\Local\Temp\694a01dabfcae9081427aaa200f6c0d43d09539e9c300f5165a799362a7a9bba.exe"
          3⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:4732
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aECC6.bat
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2224
            • C:\Users\Admin\AppData\Local\Temp\694a01dabfcae9081427aaa200f6c0d43d09539e9c300f5165a799362a7a9bba.exe
              "C:\Users\Admin\AppData\Local\Temp\694a01dabfcae9081427aaa200f6c0d43d09539e9c300f5165a799362a7a9bba.exe"
              5⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              • Suspicious use of WriteProcessMemory
              PID:3700
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aED72.bat
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:3536
                • C:\Users\Admin\AppData\Local\Temp\694a01dabfcae9081427aaa200f6c0d43d09539e9c300f5165a799362a7a9bba.exe
                  "C:\Users\Admin\AppData\Local\Temp\694a01dabfcae9081427aaa200f6c0d43d09539e9c300f5165a799362a7a9bba.exe"
                  7⤵
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • Suspicious use of WriteProcessMemory
                  PID:1980
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEDFE.bat
                    8⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3612
                    • C:\Users\Admin\AppData\Local\Temp\694a01dabfcae9081427aaa200f6c0d43d09539e9c300f5165a799362a7a9bba.exe
                      "C:\Users\Admin\AppData\Local\Temp\694a01dabfcae9081427aaa200f6c0d43d09539e9c300f5165a799362a7a9bba.exe"
                      9⤵
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • Suspicious use of WriteProcessMemory
                      PID:3088
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEE9B.bat
                        10⤵
                        • Suspicious use of WriteProcessMemory
                        PID:3372
                        • C:\Users\Admin\AppData\Local\Temp\694a01dabfcae9081427aaa200f6c0d43d09539e9c300f5165a799362a7a9bba.exe
                          "C:\Users\Admin\AppData\Local\Temp\694a01dabfcae9081427aaa200f6c0d43d09539e9c300f5165a799362a7a9bba.exe"
                          11⤵
                          • Executes dropped EXE
                          PID:3940
      • C:\Windows\Logo1_.exe
        C:\Windows\Logo1_.exe
        2⤵
        • Executes dropped EXE
        • Drops startup file
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2160
        • C:\Windows\SysWOW64\net.exe
          net stop "Kingsoft AntiVirus Service"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4432
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
            4⤵
              PID:2508
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1008
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              4⤵
                PID:1836
        • C:\Windows\Explorer.EXE
          C:\Windows\Explorer.EXE
          1⤵
            PID:1124

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\$$aE803.bat
            Filesize

            722B

            MD5

            b37a11482c8b763de89f04ea9b0d9b06

            SHA1

            1c9870e63e0cc5a7f2720220d6cc93419c7a3868

            SHA256

            6ba5764957917f6ecd6452411300bea7d7675c112c008a7e7d38459773c41489

            SHA512

            75e6e38aab3a4bb5511a2d0e89c4ce05d6d61e7a0e029cfbd2f801b61be5b0cd38e5bd7ccd7643b829065055fe75492ab23d9764f3bf0f2bfa6f14f774f93c78

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\$$aECC6.bat
            Filesize

            722B

            MD5

            d144cf0436803afb90d650e6c82b6324

            SHA1

            a92d20b8d45cdd4da0b55f657de48ddcf48bdd9c

            SHA256

            2755b648b755543cd8d66b93331d3a84b05a5fb2d881849ffac807abf6ae6de0

            SHA512

            15d3b1e80fdc08f00aa89f4027de1a916b424f1c30bb8f7465d3155c9f155f85f52196daa872719f747959b03231722d3851f30c52879c9e4e28d4da603e7cf8

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\$$aED72.bat
            Filesize

            722B

            MD5

            a2368d694cff5bec6b6ad6c4a7b36195

            SHA1

            bac8ef4760f701724791bc43a7af8b6d79638432

            SHA256

            04fb70423f46c9b22bed6107ef662e701e8abe6bd9c82fb34102e5e0e8ae974a

            SHA512

            697d56e3cb1332136b024df873e4c002b65ccb904c2b86e8aa2c61c3deffbc2984f87893a957353aaf9d02d0bfc8d128ceed642c62eebdee4f3a7d6dad59215a

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\$$aEDFE.bat
            Filesize

            722B

            MD5

            3706096e15ed21ed2da067d217abc067

            SHA1

            091105bb45cfa9930e1f119122fa6078dad5bd49

            SHA256

            1d7928cd36944111c9ea4b0621940a86cd7bbbe2958447eeae082868b2cc4e48

            SHA512

            4ea231f84796dc0c4d078fa7df5055495ae5231fa0759a44313829ae322a3d97626f13f1d5a1c39c8adcb23ef16ab3bcef28d5f96366589f5fb96e74d1e9f504

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\$$aEE9B.bat
            Filesize

            722B

            MD5

            c9ae94bff4dfff2fc55c4349b0152239

            SHA1

            229397d0f6215bb6276c840aab7e9fe55592ab61

            SHA256

            9bf3c54efe9341e9b26b422f888f355037139ddf54bbd7950a193828147a24ce

            SHA512

            c27a4cf0ef21d2b6dd988166420ad73631b1a0d7e8548133d662b8c66651c297dbcc597148e238a4527a8b1e1dd2b345c992ac755865e25de6312d7aabe7e38a

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\694a01dabfcae9081427aaa200f6c0d43d09539e9c300f5165a799362a7a9bba.exe
            Filesize

            388KB

            MD5

            42eb7386a235f374ced15ff014c74fbc

            SHA1

            21aace04b3f7fe500ff2e07a0c340f8bdfc07d8a

            SHA256

            10b5b2bd640e5d49deca3819abbb3c3fc2d0657237b13ae389e7939ceb35b766

            SHA512

            64c014a85fbd4133b5446fb180eca9250a0b2bef6893aca2548de59147b769706a438092e24b1c5b3d53c9416422167c8454c8adc56024f2cb5458a12d469004

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\694a01dabfcae9081427aaa200f6c0d43d09539e9c300f5165a799362a7a9bba.exe
            Filesize

            292KB

            MD5

            8262261e06fc26a33e6e6823f29aede2

            SHA1

            f56b7c3f8f3c36e54c9141afdc5b581f8c461dfa

            SHA256

            264069c891f0c19c66887a4fc02753076851cdf9a0621e876d94b812f396dd4b

            SHA512

            2b004a9147733cf05dd917645b6e4ddbd7773954ead59a89a527e09606d98f9d01a3c93f14f4fea4f086289916b4984f796028b1c9c5ebce7df34d2afe30c56f

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\694a01dabfcae9081427aaa200f6c0d43d09539e9c300f5165a799362a7a9bba.exe
            Filesize

            340KB

            MD5

            bc1ff70814310ca61ed48b4846bd93d6

            SHA1

            f83575492bf084eef69aa73a450187bbde02cc27

            SHA256

            ba48d7d47b07cb9ed0091614a9aae1a2f3fdb95186fcd0ce018834753022acce

            SHA512

            3b55e76788a69154dccb13c54687d8dd33a182a220f00cea25bed3fb6f3ac56601250dae9ba633db5008fc5804ee6f77a9e131c8966d505c6c65d313924391c7

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\694a01dabfcae9081427aaa200f6c0d43d09539e9c300f5165a799362a7a9bba.exe
            Filesize

            196KB

            MD5

            e277c899323a685b21ff31a4da07bb6d

            SHA1

            1fdf231e80a4f0b8331313b577814348cdf224e6

            SHA256

            d3af26599e093e4f8250662f5590e9c556dadb271a31231a7e35fcd4da5b1700

            SHA512

            17ef1af2962d6a15dcc57bb2a9b22196405d839659b0b1be6960dd4b5f0a02f1a9aa9641a79ccf26a2b9b0214e95f0230593c2d91aa2966d9deadf1a05da04f4

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\694a01dabfcae9081427aaa200f6c0d43d09539e9c300f5165a799362a7a9bba.exe
            Filesize

            244KB

            MD5

            556bb40cb647ba8803469f3ff19249df

            SHA1

            f987beb346fec716a813bf8ec5715129eaead5e9

            SHA256

            d4e88b11d1d9142dd4942b928ec13fc13cbfffaeeb22832e1d292cd16a4d73fc

            SHA512

            d725843a3ffe38e3f8b41a577d00d2d972a02045a914cecffde66107e18b7e6890b44aec2743f5fe7bebc543db89e8a6507f2157ac23f4fc559f1c0393b33377

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\694a01dabfcae9081427aaa200f6c0d43d09539e9c300f5165a799362a7a9bba.exe.exe
            Filesize

            388KB

            MD5

            42eb7386a235f374ced15ff014c74fbc

            SHA1

            21aace04b3f7fe500ff2e07a0c340f8bdfc07d8a

            SHA256

            10b5b2bd640e5d49deca3819abbb3c3fc2d0657237b13ae389e7939ceb35b766

            SHA512

            64c014a85fbd4133b5446fb180eca9250a0b2bef6893aca2548de59147b769706a438092e24b1c5b3d53c9416422167c8454c8adc56024f2cb5458a12d469004

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\694a01dabfcae9081427aaa200f6c0d43d09539e9c300f5165a799362a7a9bba.exe.exe
            Filesize

            292KB

            MD5

            8262261e06fc26a33e6e6823f29aede2

            SHA1

            f56b7c3f8f3c36e54c9141afdc5b581f8c461dfa

            SHA256

            264069c891f0c19c66887a4fc02753076851cdf9a0621e876d94b812f396dd4b

            SHA512

            2b004a9147733cf05dd917645b6e4ddbd7773954ead59a89a527e09606d98f9d01a3c93f14f4fea4f086289916b4984f796028b1c9c5ebce7df34d2afe30c56f

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\694a01dabfcae9081427aaa200f6c0d43d09539e9c300f5165a799362a7a9bba.exe.exe
            Filesize

            340KB

            MD5

            bc1ff70814310ca61ed48b4846bd93d6

            SHA1

            f83575492bf084eef69aa73a450187bbde02cc27

            SHA256

            ba48d7d47b07cb9ed0091614a9aae1a2f3fdb95186fcd0ce018834753022acce

            SHA512

            3b55e76788a69154dccb13c54687d8dd33a182a220f00cea25bed3fb6f3ac56601250dae9ba633db5008fc5804ee6f77a9e131c8966d505c6c65d313924391c7

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\694a01dabfcae9081427aaa200f6c0d43d09539e9c300f5165a799362a7a9bba.exe.exe
            Filesize

            196KB

            MD5

            e277c899323a685b21ff31a4da07bb6d

            SHA1

            1fdf231e80a4f0b8331313b577814348cdf224e6

            SHA256

            d3af26599e093e4f8250662f5590e9c556dadb271a31231a7e35fcd4da5b1700

            SHA512

            17ef1af2962d6a15dcc57bb2a9b22196405d839659b0b1be6960dd4b5f0a02f1a9aa9641a79ccf26a2b9b0214e95f0230593c2d91aa2966d9deadf1a05da04f4

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\694a01dabfcae9081427aaa200f6c0d43d09539e9c300f5165a799362a7a9bba.exe.exe
            Filesize

            244KB

            MD5

            556bb40cb647ba8803469f3ff19249df

            SHA1

            f987beb346fec716a813bf8ec5715129eaead5e9

            SHA256

            d4e88b11d1d9142dd4942b928ec13fc13cbfffaeeb22832e1d292cd16a4d73fc

            SHA512

            d725843a3ffe38e3f8b41a577d00d2d972a02045a914cecffde66107e18b7e6890b44aec2743f5fe7bebc543db89e8a6507f2157ac23f4fc559f1c0393b33377

            Download Submit

          • C:\Windows\Logo1_.exe
            Filesize

            48KB

            MD5

            3e2de32f3ea909656d52b570d8c7dd29

            SHA1

            0ae3fa4ffc39e4f5faf4d6fadca810a3414832f9

            SHA256

            546dcbd7105ff7e2f9d8231711d582d557ec1ab1ed08c15b95aa74ba1673ed99

            SHA512

            3b5055aeab86d4f6f5a24105a869024035e7090e5e56f5a1e656e0a9422fd928f111d6f2611e7c77cfcbaffafc9894e9c2b269a3673a0d54a5bc2cfe547d61eb

            Download Submit

          • C:\Windows\Logo1_.exe
            Filesize

            48KB

            MD5

            3e2de32f3ea909656d52b570d8c7dd29

            SHA1

            0ae3fa4ffc39e4f5faf4d6fadca810a3414832f9

            SHA256

            546dcbd7105ff7e2f9d8231711d582d557ec1ab1ed08c15b95aa74ba1673ed99

            SHA512

            3b5055aeab86d4f6f5a24105a869024035e7090e5e56f5a1e656e0a9422fd928f111d6f2611e7c77cfcbaffafc9894e9c2b269a3673a0d54a5bc2cfe547d61eb

            Download Submit

          • C:\Windows\rundl132.exe
            Filesize

            48KB

            MD5

            3e2de32f3ea909656d52b570d8c7dd29

            SHA1

            0ae3fa4ffc39e4f5faf4d6fadca810a3414832f9

            SHA256

            546dcbd7105ff7e2f9d8231711d582d557ec1ab1ed08c15b95aa74ba1673ed99

            SHA512

            3b5055aeab86d4f6f5a24105a869024035e7090e5e56f5a1e656e0a9422fd928f111d6f2611e7c77cfcbaffafc9894e9c2b269a3673a0d54a5bc2cfe547d61eb

            Download Submit

          • memory/1336-134-0x0000000000400000-0x0000000000439000-memory.dmp

            Filesize

            228KB

            Download

          • memory/1336-138-0x0000000000400000-0x0000000000439000-memory.dmp

            Filesize

            228KB

            Download

          • memory/1980-160-0x0000000000400000-0x0000000000439000-memory.dmp

            Filesize

            228KB

            Download

          • memory/2160-174-0x0000000000400000-0x0000000000439000-memory.dmp

            Filesize

            228KB

            Download

          • memory/2160-154-0x0000000000400000-0x0000000000439000-memory.dmp

            Filesize

            228KB

            Download

          • memory/3088-166-0x0000000000400000-0x0000000000439000-memory.dmp

            Filesize

            228KB

            Download

          • memory/3700-153-0x0000000000400000-0x0000000000439000-memory.dmp

            Filesize

            228KB

            Download

          • memory/4732-147-0x0000000000400000-0x0000000000439000-memory.dmp

            Filesize

            228KB

            Download