Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
14/06/2023, 12:12
Behavioral task
behavioral1
Sample
CrystalDiskInfo.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
CrystalDiskInfo.exe
Resource
win10v2004-20230220-en
General
-
Target
CrystalDiskInfo.exe
-
Size
1.5MB
-
MD5
54b2bbbbde3a88b692f793ad4f95f17d
-
SHA1
c85acbfeec23c26953da18c9d4f90cc1591d7c79
-
SHA256
01f4965a9cb79bb5008613244fb231b8b7da260643c0793812821bb19bfe0c4e
-
SHA512
a21058eec89755220d7ea16d44bbf7d56866d3f8ac70abc6ce96c246f94d3ec416e6d1c497fa748c27553b299442e3c1f428755b8e80648fb3badf8df07dc20e
-
SSDEEP
24576:yjpNR3HDq1+EOuiGCw6F5yig3zMg1AInmwbU8gHisNObpL/aMJkWsj9jw2D9M4:yjp3HDw+OiFngDMu9nmLypHuWsjC2xV
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation CrystalDiskInfo.exe -
Executes dropped EXE 1 IoCs
pid Process 2296 DiskInfo64.exe -
resource yara_rule behavioral2/memory/1872-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1872-515-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: DiskInfo64.exe File opened (read-only) \??\L: DiskInfo64.exe File opened (read-only) \??\O: DiskInfo64.exe File opened (read-only) \??\F: DiskInfo64.exe File opened (read-only) \??\H: DiskInfo64.exe File opened (read-only) \??\J: DiskInfo64.exe File opened (read-only) \??\R: DiskInfo64.exe File opened (read-only) \??\S: DiskInfo64.exe File opened (read-only) \??\T: DiskInfo64.exe File opened (read-only) \??\M: DiskInfo64.exe File opened (read-only) \??\P: DiskInfo64.exe File opened (read-only) \??\Q: DiskInfo64.exe File opened (read-only) \??\I: DiskInfo64.exe File opened (read-only) \??\N: DiskInfo64.exe File opened (read-only) \??\U: DiskInfo64.exe File opened (read-only) \??\V: DiskInfo64.exe File opened (read-only) \??\W: DiskInfo64.exe File opened (read-only) \??\A: DiskInfo64.exe File opened (read-only) \??\E: DiskInfo64.exe File opened (read-only) \??\G: DiskInfo64.exe File opened (read-only) \??\X: DiskInfo64.exe File opened (read-only) \??\B: DiskInfo64.exe File opened (read-only) \??\Y: DiskInfo64.exe File opened (read-only) \??\Z: DiskInfo64.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 DiskInfo64.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2296 DiskInfo64.exe 2296 DiskInfo64.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1872 wrote to memory of 2296 1872 CrystalDiskInfo.exe 83 PID 1872 wrote to memory of 2296 1872 CrystalDiskInfo.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\CrystalDiskInfo.exe"C:\Users\Admin\AppData\Local\Temp\CrystalDiskInfo.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\DiskInfo64.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\DiskInfo64.exe"2⤵
- Executes dropped EXE
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
PID:2296
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD5006b850ce85cfbcc92bbee6966bdf0d5
SHA132b80697347d6c40d606926f4adc05f1150ea8c3
SHA256647860cda8fdf6f344b835472c04acb929ea411270f780b4fa27161e9e145c35
SHA5127e385ca9fe5d7099a9f47ab472f9d13f86f459298a2f375c186091d3d5a32117b1d9d7e504a9220a313eb6c55c7cc0d56a8be60457d11dee696a284e935c6f98
-
Filesize
63KB
MD541b3a8ccb3544b7b6778c073caf85672
SHA12a2663c7f56e5f0bfcf2d1e753569d18d0fbbf8d
SHA2568ef5e8de05813a8f3955aadfd0fa5aface6999e3931a89f28588f4e596b31e35
SHA512fded4a1c6227829d3d252c952ce01f98fb88f336dc114c431267f7bddb9f839394f3e568548a37a665299f9953c947ad33f043d93564da566d24a77793f91ad8
-
Filesize
39KB
MD55126a43b9bebaada8799f6387c8b4a97
SHA144f01724a121d98d9961da88beb75427926401a0
SHA256119b68f5a622ae322a777369de4ad240fc0c01547dcd1e257bedc5029049a8e1
SHA5126f8243091192b4a844b549ba49a00c318a30a5630ca76e8ef0d13787c0dc82ce540aa43d991e4c245127476ecc5a61ce706275291e5c66e0986291a59062cf6b
-
Filesize
1KB
MD5c0e81a6dd776dcedbe2107bcad87bdcd
SHA11d1bbc27de9329d287179b36cdcaad1083359ea3
SHA25641e8e14948103b7ba676fceaccef1f6b4fb08b70ea6f207f4d6fb6aef3f1e71f
SHA51238b57f9cee97ac10b61a2fe9222c0085b0e6ffe18ac6457963a5a5e21ff5b602350204675f1ff9606c384d5b8484e4588ad9bac9208aeaf0008215c6fae678b6
-
Filesize
665B
MD50abfaef38bc9e297cd79be0f2e691cdd
SHA1bdf71d8a6d227d1fc858c047855ed3df841e11d4
SHA25645e84adbec967aa386d4c94c3a33421fff02baaa59ad0c6e5f3ed842efb5abae
SHA5124fa815d590a6415a03a432da28632063c96620bc0b657c770825759e26a6b11039c2136fe19f96b81b22be54a2e5dc1a880d7ee525cb91abe7e770a033fcf897
-
Filesize
1KB
MD5dc3be62f884c9b96af9a3d5b2a937cb6
SHA17a06d204ea1bb9130845305face66d7f74efa2e5
SHA256cb9099db8ccb5d69db902858ebdd0657667fdc4c2ac1b8211b0d2503be18639a
SHA5122b8163d191793ddda76ce36c08d87b343dd528ca042cfb795a816b96c8d7be90d584a34e4734d217a24ed54db1ce11332108540bd34baa64778f785c0bcd4a19
-
Filesize
137B
MD5aca9c4d69b8c4779167452f77f415a9a
SHA1d40806f8ef1a7cb989dfbe9cfb4b3be717a47292
SHA2560229291a30857f8ce7499e7f9a6ac30be452419bd5327b98468deba097ae76ee
SHA51291652e2bdb710a11c25e78a8192c0da52538690e2743ba2f228e29279e0175d02e30ee01e4213b866552c4cf4e8c18ce687da13bd64d4ee554054f2efbc2df8a
-
Filesize
1KB
MD5b49a97118724c54530d4c4eaefd729c8
SHA1102187b9534a2c6359d37b68f9509e0fd227b473
SHA2564358ec9b50bf01820f6037299941916c196616fa08d8150b57607957cecda485
SHA5125a5ab0d9cec7aa61b99cb1b3742df2acdadff43cb12dcdc48cfea95eb9479ae4c5673870f2b85560ed3285961837fe0c4eed3e31f1ada33fdcdcd23336dc236c
-
Filesize
529B
MD52d48c03e3e4e9b960eb0c5714aa55db6
SHA18d3785b771879702f75c512222396816549ff813
SHA256a28638b3152f1bf898a2a14570077bfd599fa0a31c67d72856c2ec77dbd56865
SHA512fe5103e542c9392768dc25fed57a69f5fa5b9a4e60696027f33294c699264a88bbde56763332013906033aba29bd20c17b27fc2d5a373d2b1adcd9f1787f5750
-
Filesize
267B
MD5ec7be8d591e7fc9b16b7700fe78f2d1a
SHA1a167edd91f9f0bce9b9d93785e683942bd7dbde2
SHA2562b95db1daf862a5c38c8628fdf941512004bcea7b56b22e44fa52709e57c6ddb
SHA512d884e807e773bfb48bfe6c26a99ad7e9316bf4aea08bda148e84fd2922064a46696d830b327dee24eb0d8db3ad9e6d93d62f3965e6cd1c64330f5abc5015b8ee
-
Filesize
282B
MD5059eac0063cf233a5c076351a1a044c7
SHA13388220c4250b6d066da7c0ff3d49e8af612b4f0
SHA256930ca713c1af1cd06cc15ed56fa142d9910216a0e97e572f80458c625dad941b
SHA5127a3d1c87a53482a7b6ee0627bfdb9684d2d5655bdfeecf1d72396b96f48eb816d2a564388a05196dfc054014e70e8158fb7d4b2d2a06bcc86e1165cf3d287b07
-
Filesize
282B
MD5d6cb20b3215ce676fd2aeb1b89f0fb8f
SHA1531d8e6c312de8b000feb58ac0e19b1dddf6e3e1
SHA256103000a2afff7073b289179482d4f49cba9043783caf848bdf33d703eb578bcd
SHA512f7b72132559500529aa9d699a61a68f4e546470141dbe041398d7b08dfa9e260852ac17aff9c40bdd0a3e547439779f300cbe7d5e5d86a9e578e6ab978e5b3c4
-
Filesize
318B
MD5af4b7632a5ee3495de2f390106769d6b
SHA1dbcddb75a0504cb115d2a7f225c2dd16cb3df591
SHA2564929c09fdc295a477129af6424e2602dd9b35cb1d40fa0f0cdd465cca0ab9ffe
SHA512422b7e53af245c3f2f281c496c308a7538c8946d3816d541dc0a7add901f986a6a39150ef9cb44a333d8c45139865e631c71d029a03037215ac017c9b4f93f73
-
Filesize
342B
MD55d9aca5bf347b64cb7f129542b1a9e03
SHA15bc3638b230321ae82041d7f045ab71994557c41
SHA256eae96d397d7fa146e4809750250c15bc1413fe6591e7ca3468581f28638b1fa7
SHA512c12a02e5ac4fecb141d363f6191573d5465852a7d066d824a2a79fa335195edcc7cc78852ddf21a8e5a884ef942239c9b2ed91e8c63e499395ed0984e62de06a
-
Filesize
2.6MB
MD5841cdd6726b716d781c1b201a2e3ae34
SHA1bf5162eb6b5df01d871f4a054f95e5924ff0681e
SHA256dab7cdaf31535f12185cf03b885459cce95e1f6749da8c7838df3df0da5720c4
SHA512c6f61694b29a9c8caf000122d04a2de654626f7452958b88f79af67fcc12cd2714f7916eb97583bca01f92b5eb8176e8a01b9c76add1c6cc235a2ba34b8896ec
-
Filesize
2.6MB
MD5841cdd6726b716d781c1b201a2e3ae34
SHA1bf5162eb6b5df01d871f4a054f95e5924ff0681e
SHA256dab7cdaf31535f12185cf03b885459cce95e1f6749da8c7838df3df0da5720c4
SHA512c6f61694b29a9c8caf000122d04a2de654626f7452958b88f79af67fcc12cd2714f7916eb97583bca01f92b5eb8176e8a01b9c76add1c6cc235a2ba34b8896ec
-
Filesize
25B
MD503e85e3bc7b406cae8edd477f2dbe467
SHA1fdedce1ef92f8d53a8b224a83a78ff7733625155
SHA256927db88d4d92d7bf247a77427a709fc30692e3ac194ee6d64058d38895f8a42f
SHA51254c488fab8b89da7ee0c358ace43b3e9ca2f44cb2037dc1f52df4c56581ad0d8db8fb8896fb1c6cca79eab65d87877212fa4ed74df3728b0853ab7ed1b3d3933
-
Filesize
472B
MD52c837c212574a3fad1db151482c1eaf0
SHA15daa4fde65064228167d81a6fc5f5576d5263c66
SHA2567d6befa1f74073ba8f8ab222275b11aec3629172077d322c99ee8466295d751e
SHA512c69ebe0694c373fdaafd6ef83ad8671361bae883005195b87b90818f3be0e42540734fe723098b0d4e858fcc0d047b8318ca8e6e383bea2ccccf795156b6201b