Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

6

Static

static

6fdf0d28d1...39.exe

windows7-x64

6

6fdf0d28d1...39.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    189s
  • max time network
    206s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/11/2022, 03:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6fdf0d28d1e4bfbfa499deb22ae05f532ac22b0a6cdf3e929dc7dc8da089e639.exe

  • Size

    29KB

  • MD5

    0701fbc99dad965d1ab22853b0d8f9b6

  • SHA1

    e45c77895880af26f88edc1fcd4563c495616a40

  • SHA256

    6fdf0d28d1e4bfbfa499deb22ae05f532ac22b0a6cdf3e929dc7dc8da089e639

  • SHA512

    85eee0fac51f84e2a3fcdf2d8a735c16d1bdc8f591cbe695ec0ae3beb8f5bf1d524df2725115d9cf657e0c58d6e32968e15f35776db94296b459551d7140817b

  • SSDEEP

    384:sbbPuKaS80Nat1Gt5M0zhIV/DZ3KZp7JcTO4yf9Knuf2MqlUV2V9wVfUnfRqOzG4:40Hht16GVRu1yK9fMnJG2V9dHS8

Score
6/10

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:2080
      • C:\Users\Admin\AppData\Local\Temp\6fdf0d28d1e4bfbfa499deb22ae05f532ac22b0a6cdf3e929dc7dc8da089e639.exe
        "C:\Users\Admin\AppData\Local\Temp\6fdf0d28d1e4bfbfa499deb22ae05f532ac22b0a6cdf3e929dc7dc8da089e639.exe"
        2⤵
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3604
        • C:\Windows\SysWOW64\net.exe
          net stop "Kingsoft AntiVirus Service"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2580
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
            4⤵
              PID:5076

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/3604-132-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

        Download

      • memory/3604-135-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

        Download