Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    158s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    07/11/2022, 20:58

General

  • Target

    83210f152adb2e903a58d8c9d7edc14a5f28420ccaa1928e720667fb361f2c55.exe

  • Size

    656KB

  • MD5

    00b7c65ca3b12ad7a444a5b44da56220

  • SHA1

    00a4f28d98dc8b39cfb1ee8d6d2215b85517c7cb

  • SHA256

    83210f152adb2e903a58d8c9d7edc14a5f28420ccaa1928e720667fb361f2c55

  • SHA512

    889c369ab3c8265c44762c37bd84ccc431d559e5c914dc99822cb060f3412190204f29832481abf1cc5b4ce257636dd50d7e786b7075e6c47cf403e2118c4edb

  • SSDEEP

    12288:0+a5ShViVnhiAEZFkQWLTMrq2yh+SQPHNYnUDBcvODK6ZTbkYFHWJa:0BQhViVn4AEZa1Gq2HPNMUSODNZTL2c

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 43 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1200
      • C:\Users\Admin\AppData\Local\Temp\83210f152adb2e903a58d8c9d7edc14a5f28420ccaa1928e720667fb361f2c55.exe
        "C:\Users\Admin\AppData\Local\Temp\83210f152adb2e903a58d8c9d7edc14a5f28420ccaa1928e720667fb361f2c55.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1412
        • C:\Windows\SysWOW64\net.exe
          net stop "Kingsoft AntiVirus Service"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2004
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
            4⤵
              PID:924
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c C:\Users\Admin\AppData\Local\Temp\$$aAFE0.bat
            3⤵
            • Deletes itself
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:1976
            • C:\Users\Admin\AppData\Local\Temp\83210f152adb2e903a58d8c9d7edc14a5f28420ccaa1928e720667fb361f2c55.exe
              "C:\Users\Admin\AppData\Local\Temp\83210f152adb2e903a58d8c9d7edc14a5f28420ccaa1928e720667fb361f2c55.exe"
              4⤵
              • Executes dropped EXE
              PID:1540
          • C:\Windows\Logo1_.exe
            C:\Windows\Logo1_.exe
            3⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1716
            • C:\Windows\SysWOW64\net.exe
              net stop "Kingsoft AntiVirus Service"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:1948
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                5⤵
                  PID:1440
              • C:\Windows\SysWOW64\net.exe
                net stop "Kingsoft AntiVirus Service"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:564
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                  5⤵
                    PID:1324

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\$$aAFE0.bat

            Filesize

            722B

            MD5

            bd33cb8a3d5d9db14537aba150f9fea8

            SHA1

            69e098a1955ef2a665dfd5e2be22ff2472e31ba9

            SHA256

            53c124d425c688a57d123ff07b07dd09ca0a921c660f6ff448f138f165f9573e

            SHA512

            fc122ede0a65b678268416aa6cfe5f2caee87438cb5874870c83381cd65acc8f4c3069ba8bb0b03302b142c3adf165b84d5a9d6dc537b9dfbb18958b777215b5

          • C:\Users\Admin\AppData\Local\Temp\83210f152adb2e903a58d8c9d7edc14a5f28420ccaa1928e720667fb361f2c55.exe

            Filesize

            623KB

            MD5

            e5ca2ebcf1d6ecb6dacef20fcde132e9

            SHA1

            bc3ad7d5b426535604b3573c960efb12cbb5d8f4

            SHA256

            6f952b39c013fced1686cf6fbcd2a7bc75d947629e3b9e5dbc7aceb7786d145f

            SHA512

            747f6b70524c10149111d0b1a0c5fc8224c324ea8e6914c511b002b6542d19cba460f9fdf77d97a2d6148f725d4e27d413f8406408ffb659b4644cace14ae1c7

          • C:\Users\Admin\AppData\Local\Temp\83210f152adb2e903a58d8c9d7edc14a5f28420ccaa1928e720667fb361f2c55.exe.exe

            Filesize

            623KB

            MD5

            e5ca2ebcf1d6ecb6dacef20fcde132e9

            SHA1

            bc3ad7d5b426535604b3573c960efb12cbb5d8f4

            SHA256

            6f952b39c013fced1686cf6fbcd2a7bc75d947629e3b9e5dbc7aceb7786d145f

            SHA512

            747f6b70524c10149111d0b1a0c5fc8224c324ea8e6914c511b002b6542d19cba460f9fdf77d97a2d6148f725d4e27d413f8406408ffb659b4644cace14ae1c7

          • C:\Windows\Logo1_.exe

            Filesize

            33KB

            MD5

            6a6f427787f08bc9dd4011586840fea6

            SHA1

            bfdd466f2766de3873ea7fd8e0c11c4c15c67a2b

            SHA256

            10681f0d26abaa23bfc8f2aff9729f656ae9fefbf74e842a89529555b1d64c6c

            SHA512

            2bc15635aef97dba954a481b3f294e81348cd28aa238d5521d9e6bd9a66a378217460106bc0b301cb46e2a0fc0aee6e1a132cfe17eed87f2b6fe24fe699cd82b

          • C:\Windows\Logo1_.exe

            Filesize

            33KB

            MD5

            6a6f427787f08bc9dd4011586840fea6

            SHA1

            bfdd466f2766de3873ea7fd8e0c11c4c15c67a2b

            SHA256

            10681f0d26abaa23bfc8f2aff9729f656ae9fefbf74e842a89529555b1d64c6c

            SHA512

            2bc15635aef97dba954a481b3f294e81348cd28aa238d5521d9e6bd9a66a378217460106bc0b301cb46e2a0fc0aee6e1a132cfe17eed87f2b6fe24fe699cd82b

          • C:\Windows\rundl132.exe

            Filesize

            33KB

            MD5

            6a6f427787f08bc9dd4011586840fea6

            SHA1

            bfdd466f2766de3873ea7fd8e0c11c4c15c67a2b

            SHA256

            10681f0d26abaa23bfc8f2aff9729f656ae9fefbf74e842a89529555b1d64c6c

            SHA512

            2bc15635aef97dba954a481b3f294e81348cd28aa238d5521d9e6bd9a66a378217460106bc0b301cb46e2a0fc0aee6e1a132cfe17eed87f2b6fe24fe699cd82b

          • \Users\Admin\AppData\Local\Temp\83210f152adb2e903a58d8c9d7edc14a5f28420ccaa1928e720667fb361f2c55.exe

            Filesize

            623KB

            MD5

            e5ca2ebcf1d6ecb6dacef20fcde132e9

            SHA1

            bc3ad7d5b426535604b3573c960efb12cbb5d8f4

            SHA256

            6f952b39c013fced1686cf6fbcd2a7bc75d947629e3b9e5dbc7aceb7786d145f

            SHA512

            747f6b70524c10149111d0b1a0c5fc8224c324ea8e6914c511b002b6542d19cba460f9fdf77d97a2d6148f725d4e27d413f8406408ffb659b4644cace14ae1c7

          • memory/1412-60-0x0000000000400000-0x000000000043F000-memory.dmp

            Filesize

            252KB

          • memory/1412-54-0x0000000000400000-0x000000000043F000-memory.dmp

            Filesize

            252KB

          • memory/1716-65-0x0000000000400000-0x000000000043F000-memory.dmp

            Filesize

            252KB

          • memory/1716-73-0x0000000000400000-0x000000000043F000-memory.dmp

            Filesize

            252KB