Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    190s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    04/12/2022, 12:58

General

  • Target

    b3fea5464c7d3e94de9d9bc746ab0ca18cffefcd701376dcfb669cb7d0203300.exe

  • Size

    43KB

  • MD5

    af29bb51932c629db68517588718951e

  • SHA1

    609810cd2fa4f35c58cad7fb0754f092fd29fd39

  • SHA256

    b3fea5464c7d3e94de9d9bc746ab0ca18cffefcd701376dcfb669cb7d0203300

  • SHA512

    6b31fbad7506f34aff42415e2de41392eb876274bbff37f82ecd89d33ca9f5e1f3d9a1cbdf46f57fd3843d5e87445c85e5df06ab28f9bf9c8dd317637ab9cd70

  • SSDEEP

    768:ptq16GVRu1yK9fMnJG2V9dHS8clXNGSs8zCaLWE4bCfJ:ptM3SHuJV9NwllCaadCfJ

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1396
      • C:\Users\Admin\AppData\Local\Temp\b3fea5464c7d3e94de9d9bc746ab0ca18cffefcd701376dcfb669cb7d0203300.exe
        "C:\Users\Admin\AppData\Local\Temp\b3fea5464c7d3e94de9d9bc746ab0ca18cffefcd701376dcfb669cb7d0203300.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:1896
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c C:\Users\Admin\AppData\Local\Temp\$$aEA2.bat
          3⤵
          • Deletes itself
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:1064
          • C:\Users\Admin\AppData\Local\Temp\b3fea5464c7d3e94de9d9bc746ab0ca18cffefcd701376dcfb669cb7d0203300.exe
            "C:\Users\Admin\AppData\Local\Temp\b3fea5464c7d3e94de9d9bc746ab0ca18cffefcd701376dcfb669cb7d0203300.exe"
            4⤵
            • Executes dropped EXE
            PID:2028
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1116
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1976
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
                PID:1124

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\$$aEA2.bat

        Filesize

        721B

        MD5

        ce85eb988902bd0a03e887d9c362fc8a

        SHA1

        ff2207dcc35b164a644d5cf2ad3b3b48073ce52b

        SHA256

        e7d1a37049f250d5e3eb54b3c1b44c2eebfbef7edf71ef5a30faca82d8a81654

        SHA512

        5b1fdbb1cee15f78c1a0e752ec94877383eb7ea8f903eb5b2eb405f4a52e2d6637c78cbdd885cafc081d95d1df214bc5e96590e81cd5b46ae1f2daec7ed3923d

      • C:\Users\Admin\AppData\Local\Temp\b3fea5464c7d3e94de9d9bc746ab0ca18cffefcd701376dcfb669cb7d0203300.exe

        Filesize

        14KB

        MD5

        13871c4426dda78f91e88e43d51844a8

        SHA1

        3e5dc5d662ac718ac29da73ef5ba00662a3601ce

        SHA256

        9c6a5caa334daecabb9b9080f10973aa3d3971ea12d16e218a71a23248634621

        SHA512

        020e67422bfc212aa0d7d45eeedb76bc86a8ad254ef1463fdc783596c400680e144bbd6859ae6a58db2cc4ddfaab25711cf8e3a20680e6d121c14d3fa9a32802

      • C:\Users\Admin\AppData\Local\Temp\b3fea5464c7d3e94de9d9bc746ab0ca18cffefcd701376dcfb669cb7d0203300.exe.exe

        Filesize

        14KB

        MD5

        13871c4426dda78f91e88e43d51844a8

        SHA1

        3e5dc5d662ac718ac29da73ef5ba00662a3601ce

        SHA256

        9c6a5caa334daecabb9b9080f10973aa3d3971ea12d16e218a71a23248634621

        SHA512

        020e67422bfc212aa0d7d45eeedb76bc86a8ad254ef1463fdc783596c400680e144bbd6859ae6a58db2cc4ddfaab25711cf8e3a20680e6d121c14d3fa9a32802

      • C:\Windows\Logo1_.exe

        Filesize

        29KB

        MD5

        bed9993f2e1de936175e3e499262bda3

        SHA1

        04d9ec2bcc4cc85dcd808b6488363885be37576c

        SHA256

        5ff2dbbf149a7e8813431b1ff403576a78c201e3d0c514e5f787cce55e4315f2

        SHA512

        a90e44de3aa527424f2fd9d3c4dc9e7ab39c444966bd0e27c65ebe00c724c4dfbd410aa3b7bb2687beb3b989a9cd07feabf9ee95d52324ea948dfae1c064b763

      • C:\Windows\Logo1_.exe

        Filesize

        29KB

        MD5

        bed9993f2e1de936175e3e499262bda3

        SHA1

        04d9ec2bcc4cc85dcd808b6488363885be37576c

        SHA256

        5ff2dbbf149a7e8813431b1ff403576a78c201e3d0c514e5f787cce55e4315f2

        SHA512

        a90e44de3aa527424f2fd9d3c4dc9e7ab39c444966bd0e27c65ebe00c724c4dfbd410aa3b7bb2687beb3b989a9cd07feabf9ee95d52324ea948dfae1c064b763

      • C:\Windows\rundl132.exe

        Filesize

        29KB

        MD5

        bed9993f2e1de936175e3e499262bda3

        SHA1

        04d9ec2bcc4cc85dcd808b6488363885be37576c

        SHA256

        5ff2dbbf149a7e8813431b1ff403576a78c201e3d0c514e5f787cce55e4315f2

        SHA512

        a90e44de3aa527424f2fd9d3c4dc9e7ab39c444966bd0e27c65ebe00c724c4dfbd410aa3b7bb2687beb3b989a9cd07feabf9ee95d52324ea948dfae1c064b763

      • \Users\Admin\AppData\Local\Temp\b3fea5464c7d3e94de9d9bc746ab0ca18cffefcd701376dcfb669cb7d0203300.exe

        Filesize

        14KB

        MD5

        13871c4426dda78f91e88e43d51844a8

        SHA1

        3e5dc5d662ac718ac29da73ef5ba00662a3601ce

        SHA256

        9c6a5caa334daecabb9b9080f10973aa3d3971ea12d16e218a71a23248634621

        SHA512

        020e67422bfc212aa0d7d45eeedb76bc86a8ad254ef1463fdc783596c400680e144bbd6859ae6a58db2cc4ddfaab25711cf8e3a20680e6d121c14d3fa9a32802

      • memory/1116-63-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/1116-68-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/1896-54-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB