Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/08/2023, 01:39

General

  • Target

    040c5e40ee70b77f45308c0db5fcfb14a3d2933ae638ef7b3d1e6c9f937c996b.exe

  • Size

    66KB

  • MD5

    b0740d80c3b9d5106fe78701189af31f

  • SHA1

    a269636c61fa84ab72b59a5a06b4e0d7b9cc886c

  • SHA256

    040c5e40ee70b77f45308c0db5fcfb14a3d2933ae638ef7b3d1e6c9f937c996b

  • SHA512

    5af31140dd0766e97e9306ba1c92c5843518977eb09929747a96abf7541fd298ccbd05f70091f33b721150d312d351da2fa11b809ca2f7bfacfa1c8d6ce42c71

  • SSDEEP

    1536:Ai4srz8dOBN9aunrxb4yzwC132n6RbK1A:A48oBN9aulb4yzjRbaA

Score
7/10

Malware Config

Signatures

  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3152
      • C:\Users\Admin\AppData\Local\Temp\040c5e40ee70b77f45308c0db5fcfb14a3d2933ae638ef7b3d1e6c9f937c996b.exe
        "C:\Users\Admin\AppData\Local\Temp\040c5e40ee70b77f45308c0db5fcfb14a3d2933ae638ef7b3d1e6c9f937c996b.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2468
        • C:\Windows\SysWOW64\net.exe
          net stop "Kingsoft AntiVirus Service"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3868
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
            4⤵
              PID:4316
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD958.bat
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:3456
            • C:\Users\Admin\AppData\Local\Temp\040c5e40ee70b77f45308c0db5fcfb14a3d2933ae638ef7b3d1e6c9f937c996b.exe
              "C:\Users\Admin\AppData\Local\Temp\040c5e40ee70b77f45308c0db5fcfb14a3d2933ae638ef7b3d1e6c9f937c996b.exe"
              4⤵
              • Executes dropped EXE
              PID:4404
          • C:\Windows\Logo1_.exe
            C:\Windows\Logo1_.exe
            3⤵
            • Drops startup file
            • Executes dropped EXE
            • Enumerates connected drives
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2476
            • C:\Windows\SysWOW64\net.exe
              net stop "Kingsoft AntiVirus Service"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:3684
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                5⤵
                  PID:4644
              • C:\Windows\SysWOW64\net.exe
                net stop "Kingsoft AntiVirus Service"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:3824
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                  5⤵
                    PID:4092

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

            Filesize

            258KB

            MD5

            3d85e6d92ac7be70637f958dde2b011e

            SHA1

            de203840649525f16e0bca64ac03d6288a1b7316

            SHA256

            7d1496ae1660972107f77423879bcf3dbd8c4d4feed5690d8a756d1aadc5ded7

            SHA512

            7744e7e7570e10113f07b2f576679642a16269979978edac66a3e311171635dadc407d08533761e97231f77fc37684b6b7aca655b7d6a6d95fd4ac6764e34afd

          • C:\Program Files\SuspendResolve.exe

            Filesize

            619KB

            MD5

            6960486b0b15bbc16ebd4880d6d8cf53

            SHA1

            a6e64425f1f3a00497bcfaa1b19f77795a457645

            SHA256

            eb2550f51212b4aff4fb87768a016dba7b9a32e1d4d317a815614c751444cd41

            SHA512

            0063c2899f173dd5bf8824e39ea74eda931cbc7a4a69d4805239eb0b3e574849787ea3542568c3096504836c3d08c7713e599b8239eeb3c6d0894693287ab02b

          • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

            Filesize

            478KB

            MD5

            f42c7fca4a74677fc3f9dff9c92bc66a

            SHA1

            485aefa513bd7cf9546571c9d5bbfaea2e2aa761

            SHA256

            a762874c0c4e1b60ae4dd0d93778af865eceff9edb71debfc90b7827cec0665f

            SHA512

            afd338ea3b920930eb18853143277705d7a481611d207c732bbaea188e289481c42f80a48af4d2712e823424d993346a01b148aa64583198e4dbf2bf75c791f4

          • C:\Users\Admin\AppData\Local\Temp\$$aD958.bat

            Filesize

            722B

            MD5

            75adc8799a9ca60b428dddf402b5d3bc

            SHA1

            8ead366ecded946e6d93007058d7325a8cd8f78e

            SHA256

            84a38e45e38f6e231b6a4b55dc60fd1b0f32e1821286adc92827e983959ad6c1

            SHA512

            652202d59686b7a770eb49a8b915a3b308e74885dd61006f1948e442b457a6b0eaeb21845a2dad1c56b0ba7b9b42123d0c9e0ca2d13f33136ccdf42d3937ef3b

          • C:\Users\Admin\AppData\Local\Temp\040c5e40ee70b77f45308c0db5fcfb14a3d2933ae638ef7b3d1e6c9f937c996b.exe

            Filesize

            33KB

            MD5

            52886e1f39689e26425482ee3a448ec2

            SHA1

            ac125f76ce72cc9afb6d45a9d416f414d89aa526

            SHA256

            6ec5438e178d75a9598cc4a56f3a91975537bc7357d42dd7a95b663cc45ecb1c

            SHA512

            f3c4e4513bdd3b420320c38383b7fc41d0d0a16ba023db47cd48ba5803e86103e9ac134cddf9b0d9deef076819784f77bbd8c8c24aef4293bed9803ad3e85508

          • C:\Users\Admin\AppData\Local\Temp\040c5e40ee70b77f45308c0db5fcfb14a3d2933ae638ef7b3d1e6c9f937c996b.exe.exe

            Filesize

            33KB

            MD5

            52886e1f39689e26425482ee3a448ec2

            SHA1

            ac125f76ce72cc9afb6d45a9d416f414d89aa526

            SHA256

            6ec5438e178d75a9598cc4a56f3a91975537bc7357d42dd7a95b663cc45ecb1c

            SHA512

            f3c4e4513bdd3b420320c38383b7fc41d0d0a16ba023db47cd48ba5803e86103e9ac134cddf9b0d9deef076819784f77bbd8c8c24aef4293bed9803ad3e85508

          • C:\Windows\Logo1_.exe

            Filesize

            33KB

            MD5

            4b8d5611897671cb722c88a92fea57cd

            SHA1

            d2bd76334c02d3aff4a8dfe3477162c85f8c14c9

            SHA256

            0a05a55fa316d55995d50de7a9ebcde75cbedee25846d320bffaef1eec6b34a2

            SHA512

            821aaadb27a1d2f0ac1b2fd3c9da43dc65ad00481d18f4a4c660b1bf0065dbe8ba1a736c713c40923b98ad8858f14e5c50efa21530efbe430db54a477b9075a8

          • C:\Windows\Logo1_.exe

            Filesize

            33KB

            MD5

            4b8d5611897671cb722c88a92fea57cd

            SHA1

            d2bd76334c02d3aff4a8dfe3477162c85f8c14c9

            SHA256

            0a05a55fa316d55995d50de7a9ebcde75cbedee25846d320bffaef1eec6b34a2

            SHA512

            821aaadb27a1d2f0ac1b2fd3c9da43dc65ad00481d18f4a4c660b1bf0065dbe8ba1a736c713c40923b98ad8858f14e5c50efa21530efbe430db54a477b9075a8

          • C:\Windows\rundl132.exe

            Filesize

            33KB

            MD5

            4b8d5611897671cb722c88a92fea57cd

            SHA1

            d2bd76334c02d3aff4a8dfe3477162c85f8c14c9

            SHA256

            0a05a55fa316d55995d50de7a9ebcde75cbedee25846d320bffaef1eec6b34a2

            SHA512

            821aaadb27a1d2f0ac1b2fd3c9da43dc65ad00481d18f4a4c660b1bf0065dbe8ba1a736c713c40923b98ad8858f14e5c50efa21530efbe430db54a477b9075a8

          • F:\$RECYCLE.BIN\S-1-5-21-4176143399-3250363947-192774652-1000\_desktop.ini

            Filesize

            9B

            MD5

            16548fefb55deef0a354259a11e1cc14

            SHA1

            6e4f38c24333eb1c8bcc91e4e4042ce600a44c4f

            SHA256

            f6d78c8a802bfc4dded630ac9f8d33fb335ab11d45bb742fac993f8d42ea327c

            SHA512

            1fcd0a93c383bf38b97073a84ac50c78149cd1160299e71676fc5a3a6f655affac3a0e2433cf5bc4c145cda0ec44a23d13e1da953e15feefb0b9cefd84204271

          • memory/2468-143-0x0000000000400000-0x0000000000440000-memory.dmp

            Filesize

            256KB

          • memory/2468-133-0x0000000000400000-0x0000000000440000-memory.dmp

            Filesize

            256KB

          • memory/2476-150-0x0000000000400000-0x0000000000440000-memory.dmp

            Filesize

            256KB

          • memory/2476-930-0x0000000000400000-0x0000000000440000-memory.dmp

            Filesize

            256KB

          • memory/2476-2437-0x0000000000400000-0x0000000000440000-memory.dmp

            Filesize

            256KB

          • memory/2476-5544-0x0000000000400000-0x0000000000440000-memory.dmp

            Filesize

            256KB

          • memory/2476-141-0x0000000000400000-0x0000000000440000-memory.dmp

            Filesize

            256KB

          • memory/2476-8766-0x0000000000400000-0x0000000000440000-memory.dmp

            Filesize

            256KB