Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    10/08/2023, 11:26

General

  • Target

    efacd8ae556cc35d412c45f19e37f3feb4b3fd10bcedbd71b2b47b47dd58ae40.exe

  • Size

    5.8MB

  • MD5

    9b499068571b91be9372076eb2a4bc44

  • SHA1

    aaddf7295ca92283badfec40f0194ea2eb7df964

  • SHA256

    efacd8ae556cc35d412c45f19e37f3feb4b3fd10bcedbd71b2b47b47dd58ae40

  • SHA512

    0348b9b14c50b5404cb8d0c2573059e31132dfcbb83efe2a991fc9db3fb0e423775d9528d816ac4a44678209a9e1551f36b3c920affe5bc2171726c88e83a392

  • SSDEEP

    98304:AqVQ4tml/iUm4XHb8vFtYkQvrSz9rAmLJHORm6UJamI3LeojzZARZpkAdcc6IjWF:/J+jX7oDIrSpru+W3KMZkvdagNXhJs0I

Malware Config

Signatures

  • Generic Chinese Botnet

    A botnet originating from China which is currently unnamed publicly.

  • Chinese Botnet payload 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\efacd8ae556cc35d412c45f19e37f3feb4b3fd10bcedbd71b2b47b47dd58ae40.exe
    "C:\Users\Admin\AppData\Local\Temp\efacd8ae556cc35d412c45f19e37f3feb4b3fd10bcedbd71b2b47b47dd58ae40.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: RenamesItself
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1504
    • C:\Windows\GameLoadep.exe
      C:\Windows\GameLoadep.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      PID:2192
  • C:\Program Files (x86)\Terms.exe
    "C:\Program Files (x86)\Terms.exe"
    1⤵
    • Executes dropped EXE
    PID:652

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Terms.exe

    Filesize

    864KB

    MD5

    645a7e5dc4adc68141447b01cb9cec49

    SHA1

    2f83beeb3031aa238c8eba4ae04398ff38274780

    SHA256

    76931bce0663f68f95a46414d389042181c690749eed44cb09aae325a0b9ef17

    SHA512

    fdf56fcacc1b43c94bd2811ad3926706f7382fc1d3e20c58b050cf254019c3b6226d0ffa8d4ba6aec259d3a99cb63d06d02156dd6dabab59b91418ba462885de

  • C:\Windows\GameLoadep.exe

    Filesize

    864KB

    MD5

    645a7e5dc4adc68141447b01cb9cec49

    SHA1

    2f83beeb3031aa238c8eba4ae04398ff38274780

    SHA256

    76931bce0663f68f95a46414d389042181c690749eed44cb09aae325a0b9ef17

    SHA512

    fdf56fcacc1b43c94bd2811ad3926706f7382fc1d3e20c58b050cf254019c3b6226d0ffa8d4ba6aec259d3a99cb63d06d02156dd6dabab59b91418ba462885de

  • C:\Windows\GameLoadep.exe

    Filesize

    864KB

    MD5

    645a7e5dc4adc68141447b01cb9cec49

    SHA1

    2f83beeb3031aa238c8eba4ae04398ff38274780

    SHA256

    76931bce0663f68f95a46414d389042181c690749eed44cb09aae325a0b9ef17

    SHA512

    fdf56fcacc1b43c94bd2811ad3926706f7382fc1d3e20c58b050cf254019c3b6226d0ffa8d4ba6aec259d3a99cb63d06d02156dd6dabab59b91418ba462885de

  • C:\Windows\GameLoadep.exe

    Filesize

    864KB

    MD5

    645a7e5dc4adc68141447b01cb9cec49

    SHA1

    2f83beeb3031aa238c8eba4ae04398ff38274780

    SHA256

    76931bce0663f68f95a46414d389042181c690749eed44cb09aae325a0b9ef17

    SHA512

    fdf56fcacc1b43c94bd2811ad3926706f7382fc1d3e20c58b050cf254019c3b6226d0ffa8d4ba6aec259d3a99cb63d06d02156dd6dabab59b91418ba462885de

  • memory/652-8767-0x0000000000400000-0x000000000051F000-memory.dmp

    Filesize

    1.1MB

  • memory/652-14493-0x0000000000400000-0x000000000051F000-memory.dmp

    Filesize

    1.1MB

  • memory/652-12801-0x0000000001D10000-0x0000000001E10000-memory.dmp

    Filesize

    1024KB

  • memory/652-11319-0x0000000001E50000-0x0000000001FD1000-memory.dmp

    Filesize

    1.5MB

  • memory/652-11317-0x0000000001D10000-0x0000000001E10000-memory.dmp

    Filesize

    1024KB

  • memory/1504-63-0x0000000003710000-0x000000000382F000-memory.dmp

    Filesize

    1.1MB

  • memory/1504-60-0x0000000003710000-0x000000000382F000-memory.dmp

    Filesize

    1.1MB

  • memory/1504-10328-0x0000000003710000-0x000000000382F000-memory.dmp

    Filesize

    1.1MB

  • memory/2192-905-0x00000000021B0000-0x00000000022C1000-memory.dmp

    Filesize

    1.1MB

  • memory/2192-913-0x00000000021B0000-0x00000000022C1000-memory.dmp

    Filesize

    1.1MB

  • memory/2192-881-0x00000000021B0000-0x00000000022C1000-memory.dmp

    Filesize

    1.1MB

  • memory/2192-883-0x00000000021B0000-0x00000000022C1000-memory.dmp

    Filesize

    1.1MB

  • memory/2192-885-0x00000000021B0000-0x00000000022C1000-memory.dmp

    Filesize

    1.1MB

  • memory/2192-887-0x00000000021B0000-0x00000000022C1000-memory.dmp

    Filesize

    1.1MB

  • memory/2192-889-0x00000000021B0000-0x00000000022C1000-memory.dmp

    Filesize

    1.1MB

  • memory/2192-891-0x00000000021B0000-0x00000000022C1000-memory.dmp

    Filesize

    1.1MB

  • memory/2192-893-0x00000000021B0000-0x00000000022C1000-memory.dmp

    Filesize

    1.1MB

  • memory/2192-895-0x00000000021B0000-0x00000000022C1000-memory.dmp

    Filesize

    1.1MB

  • memory/2192-897-0x00000000021B0000-0x00000000022C1000-memory.dmp

    Filesize

    1.1MB

  • memory/2192-899-0x00000000021B0000-0x00000000022C1000-memory.dmp

    Filesize

    1.1MB

  • memory/2192-901-0x00000000021B0000-0x00000000022C1000-memory.dmp

    Filesize

    1.1MB

  • memory/2192-903-0x00000000021B0000-0x00000000022C1000-memory.dmp

    Filesize

    1.1MB

  • memory/2192-877-0x00000000021B0000-0x00000000022C1000-memory.dmp

    Filesize

    1.1MB

  • memory/2192-907-0x00000000021B0000-0x00000000022C1000-memory.dmp

    Filesize

    1.1MB

  • memory/2192-909-0x00000000021B0000-0x00000000022C1000-memory.dmp

    Filesize

    1.1MB

  • memory/2192-911-0x00000000021B0000-0x00000000022C1000-memory.dmp

    Filesize

    1.1MB

  • memory/2192-915-0x00000000021B0000-0x00000000022C1000-memory.dmp

    Filesize

    1.1MB

  • memory/2192-879-0x00000000021B0000-0x00000000022C1000-memory.dmp

    Filesize

    1.1MB

  • memory/2192-917-0x00000000021B0000-0x00000000022C1000-memory.dmp

    Filesize

    1.1MB

  • memory/2192-919-0x00000000021B0000-0x00000000022C1000-memory.dmp

    Filesize

    1.1MB

  • memory/2192-921-0x00000000021B0000-0x00000000022C1000-memory.dmp

    Filesize

    1.1MB

  • memory/2192-923-0x00000000021B0000-0x00000000022C1000-memory.dmp

    Filesize

    1.1MB

  • memory/2192-925-0x00000000021B0000-0x00000000022C1000-memory.dmp

    Filesize

    1.1MB

  • memory/2192-927-0x00000000021B0000-0x00000000022C1000-memory.dmp

    Filesize

    1.1MB

  • memory/2192-929-0x00000000021B0000-0x00000000022C1000-memory.dmp

    Filesize

    1.1MB

  • memory/2192-931-0x00000000021B0000-0x00000000022C1000-memory.dmp

    Filesize

    1.1MB

  • memory/2192-933-0x00000000021B0000-0x00000000022C1000-memory.dmp

    Filesize

    1.1MB

  • memory/2192-935-0x00000000021B0000-0x00000000022C1000-memory.dmp

    Filesize

    1.1MB

  • memory/2192-2610-0x0000000000520000-0x0000000000620000-memory.dmp

    Filesize

    1024KB

  • memory/2192-2611-0x0000000001EB0000-0x0000000002031000-memory.dmp

    Filesize

    1.5MB

  • memory/2192-8750-0x00000000021B0000-0x00000000022C1000-memory.dmp

    Filesize

    1.1MB

  • memory/2192-875-0x00000000021B0000-0x00000000022C1000-memory.dmp

    Filesize

    1.1MB

  • memory/2192-874-0x00000000021B0000-0x00000000022C1000-memory.dmp

    Filesize

    1.1MB

  • memory/2192-64-0x00000000754E0000-0x0000000075527000-memory.dmp

    Filesize

    284KB

  • memory/2192-62-0x0000000000400000-0x000000000051F000-memory.dmp

    Filesize

    1.1MB

  • memory/2192-8752-0x0000000002090000-0x0000000002191000-memory.dmp

    Filesize

    1.0MB

  • memory/2192-8757-0x0000000000400000-0x000000000051F000-memory.dmp

    Filesize

    1.1MB

  • memory/2192-8762-0x0000000000400000-0x000000000051F000-memory.dmp

    Filesize

    1.1MB