Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    157s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/08/2023, 18:13

General

  • Target

    08fe09f46ad8f6a47621d2371fa997a217e9d0ba941361ccb7bb647a45ec4f37.exe

  • Size

    170KB

  • MD5

    e88564b4b8b90025c4a5030c335e9e1d

  • SHA1

    0ec482e5e1ca40c6e67e5791f5330c1fa06d719b

  • SHA256

    08fe09f46ad8f6a47621d2371fa997a217e9d0ba941361ccb7bb647a45ec4f37

  • SHA512

    67e6d34ca75fe0e13bb6cff2f773add5b621f086ec61b41a8729026092c5c61c84ca2b8e0c60b76c1ef1138955f409dab7544a7597a982b587b71a7292f752fa

  • SSDEEP

    3072:DftffjmNwfRoFANgYolUuvJj6YTpxmw8n2jbR0M+dtY4B1PrYsCdS2K:TVfjmNgGFANgYrQJjfTyT2jvChB1zc5K

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:780
      • C:\Users\Admin\AppData\Local\Temp\08fe09f46ad8f6a47621d2371fa997a217e9d0ba941361ccb7bb647a45ec4f37.exe
        "C:\Users\Admin\AppData\Local\Temp\08fe09f46ad8f6a47621d2371fa997a217e9d0ba941361ccb7bb647a45ec4f37.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:3780
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7B3B.bat
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1296
          • C:\Users\Admin\AppData\Local\Temp\08fe09f46ad8f6a47621d2371fa997a217e9d0ba941361ccb7bb647a45ec4f37.exe
            "C:\Users\Admin\AppData\Local\Temp\08fe09f46ad8f6a47621d2371fa997a217e9d0ba941361ccb7bb647a45ec4f37.exe"
            4⤵
            • Executes dropped EXE
            PID:4304
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4980
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1832
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
                PID:3928

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

        Filesize

        251KB

        MD5

        9b0bc8b1993876f0e2827074f00b2bbc

        SHA1

        5ad84492247a9e78bd49b81391cdf66395828c11

        SHA256

        f2abf093d8a85efe8804e03df77ef3f7b7393240449e24ecd2b7ff5a371e64a1

        SHA512

        780b1a15d3caf3ef07b63dc1def60ad024a85695c3a8fa99a2c57c13f005e3273ec9708ac9ae1094ed6efdcbb2eb92414292d081bc58ba7ab55ba6d81304b89a

      • C:\Program Files\7-Zip\7z.exe

        Filesize

        484KB

        MD5

        b5bf44324f573fc6f90ae98238b90c7d

        SHA1

        b9870832f19ab804a147b24841e6e4921a453827

        SHA256

        4f74f94b21b361178d621ec211f663643ed71cc399d5a3c001cfd327982f8f6c

        SHA512

        4224c96dd8730ae7ba558baa807a2e0ae388c9202b26c843b7d8bbe9264d939ad8c976fa7e30a83e272049de5f9367efd1d450b36a9a4aeae672e1f47951c113

      • C:\Users\Admin\AppData\Local\Temp\$$a7B3B.bat

        Filesize

        722B

        MD5

        e6f0510d209a6ab4550c3bf66580ed26

        SHA1

        1d7e06490967df779410dde54ca668b21d24e3be

        SHA256

        c55a3fa6e97dc088a43f827b1ddd57ffdac178e4718ae2d6773c0c8afe92d4d3

        SHA512

        89ce875e291be912895e34218dfdf430cb675fac51e05e7b5339289e1c6ef9ae416017ebfb3df72b059ebfd6ab6aca96d9bc7c7412d0f7ffbcd2eaab4e9f91b6

      • C:\Users\Admin\AppData\Local\Temp\08fe09f46ad8f6a47621d2371fa997a217e9d0ba941361ccb7bb647a45ec4f37.exe

        Filesize

        144KB

        MD5

        8730e7c3de224d3521593dfec6b4af8e

        SHA1

        13d95b1ee77d16135a5bcfc9021128657757dbd5

        SHA256

        e2e08144cf62bac6a7325125abbe3e64452fa2455a5210f5ed9c362f95e4009e

        SHA512

        8f4345da0cc35ed1f04372e216efb0fe2edcdef7d353bb586f3ae8ff92de25bb18e4a03e08465328a3103b649c3b03855835e5eae6b726f983408989cde02cf4

      • C:\Users\Admin\AppData\Local\Temp\08fe09f46ad8f6a47621d2371fa997a217e9d0ba941361ccb7bb647a45ec4f37.exe.exe

        Filesize

        144KB

        MD5

        8730e7c3de224d3521593dfec6b4af8e

        SHA1

        13d95b1ee77d16135a5bcfc9021128657757dbd5

        SHA256

        e2e08144cf62bac6a7325125abbe3e64452fa2455a5210f5ed9c362f95e4009e

        SHA512

        8f4345da0cc35ed1f04372e216efb0fe2edcdef7d353bb586f3ae8ff92de25bb18e4a03e08465328a3103b649c3b03855835e5eae6b726f983408989cde02cf4

      • C:\Windows\Logo1_.exe

        Filesize

        26KB

        MD5

        8ffc219ecd87d53276239ce7e62a7bb9

        SHA1

        5181c0e6bab0852e9f8139df9771ff6f5db64d20

        SHA256

        c5f1c38f3615c99b0bec3e310b9806480a66fa230db4eb216875e20465f4ebe0

        SHA512

        7cc6c938404420ce4175723b1339292ceeabc42728304e720350588c605b84277e64b5e009eea5b0ae56f6cd50534a334b49d2b45b467b598e45699275e6481f

      • C:\Windows\Logo1_.exe

        Filesize

        26KB

        MD5

        8ffc219ecd87d53276239ce7e62a7bb9

        SHA1

        5181c0e6bab0852e9f8139df9771ff6f5db64d20

        SHA256

        c5f1c38f3615c99b0bec3e310b9806480a66fa230db4eb216875e20465f4ebe0

        SHA512

        7cc6c938404420ce4175723b1339292ceeabc42728304e720350588c605b84277e64b5e009eea5b0ae56f6cd50534a334b49d2b45b467b598e45699275e6481f

      • C:\Windows\rundl132.exe

        Filesize

        26KB

        MD5

        8ffc219ecd87d53276239ce7e62a7bb9

        SHA1

        5181c0e6bab0852e9f8139df9771ff6f5db64d20

        SHA256

        c5f1c38f3615c99b0bec3e310b9806480a66fa230db4eb216875e20465f4ebe0

        SHA512

        7cc6c938404420ce4175723b1339292ceeabc42728304e720350588c605b84277e64b5e009eea5b0ae56f6cd50534a334b49d2b45b467b598e45699275e6481f

      • F:\$RECYCLE.BIN\S-1-5-21-1722984668-1829624581-3022101259-1000\_desktop.ini

        Filesize

        9B

        MD5

        c0232c2f01c543d260713210da47a57b

        SHA1

        63f2c13c2c5c83091133c2802e69993d52e3ec65

        SHA256

        278e1b8fd3f40d95faaecf548098b8d9ee4b32e98a8878559c8c8dfcd5cd1197

        SHA512

        2ccfd67393a63f03f588296bb798d7a7d4ec2ea5d6ac486cb7bdf8a5a66b1df944d8b548f317e58bfe17dea2ae54e536ffe77bc11a43c931f3d10e299ab3fca0

      • memory/3780-0-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/3780-8-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/4980-19-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/4980-26-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/4980-28-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/4980-33-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/4980-38-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/4980-42-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/4980-10-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/4980-1278-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/4980-1911-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/4980-2266-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB