Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    190s
  • max time network
    192s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/12/2022, 23:50

General

  • Target

    8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe

  • Size

    56KB

  • MD5

    1061d59747c43b312f76dafa35c83e30

  • SHA1

    087156122d65dc49bf8eff5468c363a998a87b89

  • SHA256

    8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59

  • SHA512

    1df8001454ad3c830261a7a51ef69e73485931ca8824d7b8eaab66ccaa1c87d85615ae4d2793555ab6529ebd8e7be377b6a42f96f2a2e235b10c70a82a4aa580

  • SSDEEP

    768:pO16GVRu1yK9fMnJG2V9dHS8FY1st5LxI1Q4AwdVGWq0CVacOI+EfAympPvbr:pI3SHuJV9Na1O+GWq0CccR+eenbr

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1192
      • C:\Users\Admin\AppData\Local\Temp\8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe
        "C:\Users\Admin\AppData\Local\Temp\8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:3432
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4B22.bat
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3936
          • C:\Users\Admin\AppData\Local\Temp\8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe
            "C:\Users\Admin\AppData\Local\Temp\8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe"
            4⤵
            • Executes dropped EXE
            PID:3572
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4336
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:3576
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
                PID:3948

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\$$a4B22.bat

        Filesize

        722B

        MD5

        74c06769d20d78c9e28a27f4bd197e20

        SHA1

        98d1f937ad99b94d8e84fff9e125a750d6ae2065

        SHA256

        1b68d6a98e10d5ce2aec5cd4405fbe8616a6e35efb985bc80fc1bbcc0e1d2462

        SHA512

        ca7e36c33f61a975970646fb5eca6d474ddfc6a32e1fd30faffbf6f7b5fcb5bc8063ea82c854106ccf42e75be996637640ef553ce39d9efaaa98070925551532

      • C:\Users\Admin\AppData\Local\Temp\8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe

        Filesize

        26KB

        MD5

        d45503f138788a2fbff13aa4b0dac123

        SHA1

        980166d3ef51cae11933cb398312686272dd8a18

        SHA256

        280e0d1d20a57f099994b228ea013e6e65d5534210d658aa154a90199ab17a72

        SHA512

        2287e99d8fd91c53694348cb75e8aa3f5dc82412061b3cf6c95e28863efce23613b17a0bddeb5309ec29b0c14385e5925b05910b2c143182f23b7975aa867c08

      • C:\Users\Admin\AppData\Local\Temp\8d0fc277ad658f65028cd1405699068d260aab734839c27e3f0667f767f38c59.exe.exe

        Filesize

        26KB

        MD5

        d45503f138788a2fbff13aa4b0dac123

        SHA1

        980166d3ef51cae11933cb398312686272dd8a18

        SHA256

        280e0d1d20a57f099994b228ea013e6e65d5534210d658aa154a90199ab17a72

        SHA512

        2287e99d8fd91c53694348cb75e8aa3f5dc82412061b3cf6c95e28863efce23613b17a0bddeb5309ec29b0c14385e5925b05910b2c143182f23b7975aa867c08

      • C:\Windows\Logo1_.exe

        Filesize

        29KB

        MD5

        77705d80528f0563515f76450582bfa4

        SHA1

        ce91c845049cbe7980acd5047956c84dbe2f58fe

        SHA256

        04f94b514859a1ed823e9a83b91fe81733b87582859167e67ed370c1c9a43edd

        SHA512

        67b1922db696f20afb95570d4cb55331827d55044a2448b79e708beec297d86983ef9c07c32e45732ed59465fb64c2a8bba5959430af5ac2bdb11edd6f421756

      • C:\Windows\Logo1_.exe

        Filesize

        29KB

        MD5

        77705d80528f0563515f76450582bfa4

        SHA1

        ce91c845049cbe7980acd5047956c84dbe2f58fe

        SHA256

        04f94b514859a1ed823e9a83b91fe81733b87582859167e67ed370c1c9a43edd

        SHA512

        67b1922db696f20afb95570d4cb55331827d55044a2448b79e708beec297d86983ef9c07c32e45732ed59465fb64c2a8bba5959430af5ac2bdb11edd6f421756

      • C:\Windows\rundl132.exe

        Filesize

        29KB

        MD5

        77705d80528f0563515f76450582bfa4

        SHA1

        ce91c845049cbe7980acd5047956c84dbe2f58fe

        SHA256

        04f94b514859a1ed823e9a83b91fe81733b87582859167e67ed370c1c9a43edd

        SHA512

        67b1922db696f20afb95570d4cb55331827d55044a2448b79e708beec297d86983ef9c07c32e45732ed59465fb64c2a8bba5959430af5ac2bdb11edd6f421756

      • memory/3432-137-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/3432-132-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/4336-145-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/4336-146-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB