Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230831-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/09/2023, 09:53 UTC

General

  • Target

    b9075508755ff209b4b4d621dc2e60dd3e5b1400b456ac4dc91ba2a2fd902f47.exe

  • Size

    61KB

  • MD5

    2224d723081f8600cd557e3e7afa0327

  • SHA1

    6371dba08a4de5c714d5e01815aa237d18ced619

  • SHA256

    b9075508755ff209b4b4d621dc2e60dd3e5b1400b456ac4dc91ba2a2fd902f47

  • SHA512

    6dbda848b02b4b95785d397743c369101afddd797776f6702b09737a6d3b68d3d5773ef48482a9f9beb6be2d4455645a0252a4b43f65c0f582bf6cdd2d92ee74

  • SSDEEP

    1536:Ta13SHuJV9QaxSzc1kVQctbHB1gTXL7heiEE:TkkuJVFSqctbHB1ufQJE

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3176
      • C:\Users\Admin\AppData\Local\Temp\b9075508755ff209b4b4d621dc2e60dd3e5b1400b456ac4dc91ba2a2fd902f47.exe
        "C:\Users\Admin\AppData\Local\Temp\b9075508755ff209b4b4d621dc2e60dd3e5b1400b456ac4dc91ba2a2fd902f47.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:1444
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA98E.bat
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1128
          • C:\Users\Admin\AppData\Local\Temp\b9075508755ff209b4b4d621dc2e60dd3e5b1400b456ac4dc91ba2a2fd902f47.exe
            "C:\Users\Admin\AppData\Local\Temp\b9075508755ff209b4b4d621dc2e60dd3e5b1400b456ac4dc91ba2a2fd902f47.exe"
            4⤵
            • Executes dropped EXE
            PID:2696
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:5016
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1540
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
                PID:5020

      Network

      • flag-us
        DNS
        2.159.190.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        2.159.190.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        26.35.223.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        26.35.223.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        26.165.165.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        26.165.165.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        198.187.3.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        198.187.3.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        22.236.111.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        22.236.111.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        126.177.238.8.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        126.177.238.8.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        66.112.168.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        66.112.168.52.in-addr.arpa
        IN PTR
        Response
      No results found
      • 8.8.8.8:53
        2.159.190.20.in-addr.arpa
        dns
        71 B
        157 B
        1
        1

        DNS Request

        2.159.190.20.in-addr.arpa

      • 8.8.8.8:53
        26.35.223.20.in-addr.arpa
        dns
        71 B
        157 B
        1
        1

        DNS Request

        26.35.223.20.in-addr.arpa

      • 8.8.8.8:53
        26.165.165.52.in-addr.arpa
        dns
        72 B
        146 B
        1
        1

        DNS Request

        26.165.165.52.in-addr.arpa

      • 8.8.8.8:53
        198.187.3.20.in-addr.arpa
        dns
        71 B
        157 B
        1
        1

        DNS Request

        198.187.3.20.in-addr.arpa

      • 8.8.8.8:53
        22.236.111.52.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        22.236.111.52.in-addr.arpa

      • 8.8.8.8:53
        126.177.238.8.in-addr.arpa
        dns
        72 B
        126 B
        1
        1

        DNS Request

        126.177.238.8.in-addr.arpa

      • 8.8.8.8:53
        66.112.168.52.in-addr.arpa
        dns
        72 B
        146 B
        1
        1

        DNS Request

        66.112.168.52.in-addr.arpa

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

        Filesize

        254KB

        MD5

        b2b6ae1421d2be0d90ea86141066f966

        SHA1

        a3560801ceaf269bf35fa26f46eefb627247f04d

        SHA256

        4cbace4b732b3150e3a61a8d7b7abc796ddad3902ecbadb315e7b7b271e18aa0

        SHA512

        ae1e0fc0cc765f3ea17f72187af6e871445d4cc8e67fd7a023c8ed96633807608ae4437eabbf6e2c84cc2dbfec3785a26f3c17793f31e1701d21b9b82e2d6bc3

      • C:\Program Files\7-Zip\7z.exe

        Filesize

        487KB

        MD5

        c061e7f482b3e1a8f6cadee8cd4ff18b

        SHA1

        bd09fe0f105e964c0b54b887748d65ca61f5ca76

        SHA256

        6f2cdb9367b16f1b40342c11b5184fd5b0a902dce2d525fd6fcf4110cdc23e51

        SHA512

        2d1eb4be83a6931fc32326e7b628097e02a85e9c33850bbc0225a282465513b12f158e1ba32c8f54298817e9d4bb6ca54844d5ad8c398a26d0e8c93db37a0d9c

      • C:\Users\Admin\AppData\Local\Temp\$$aA98E.bat

        Filesize

        722B

        MD5

        8b1a07152c1a273457b7ea61a5f1b285

        SHA1

        7c46072448a2d944ffcf784ec3873fde96d487c8

        SHA256

        d48f3af92b817e8b83e051d220ab6337d2b46675d911ee847758e84481676a6a

        SHA512

        dcbd767499ad47a45782074074787499ad8786e6a57e94d16e9d1ba914e4bd68a9182d466663d7e577cdbdc6be3673632187e22a565dd5832838f3bbc81b3d2f

      • C:\Users\Admin\AppData\Local\Temp\b9075508755ff209b4b4d621dc2e60dd3e5b1400b456ac4dc91ba2a2fd902f47.exe

        Filesize

        32KB

        MD5

        3de16cea01950aac6a7a5eeb8cb102b0

        SHA1

        c89dd3ce02600d1ef68a83e85947d7e8c4e62cc8

        SHA256

        cd60e89b2ff2743bad3c298ab6f44e005e4986413d1cf97bede0185ac3f12280

        SHA512

        7120b8226aac32933bc1561b432093422a4d708b3c75bd4eea506f7f6586b0014ce2debf7da71874947274632db6f7ffd67b5ec0c88dd9d8f2ecff0b34e12df2

      • C:\Users\Admin\AppData\Local\Temp\b9075508755ff209b4b4d621dc2e60dd3e5b1400b456ac4dc91ba2a2fd902f47.exe.exe

        Filesize

        32KB

        MD5

        3de16cea01950aac6a7a5eeb8cb102b0

        SHA1

        c89dd3ce02600d1ef68a83e85947d7e8c4e62cc8

        SHA256

        cd60e89b2ff2743bad3c298ab6f44e005e4986413d1cf97bede0185ac3f12280

        SHA512

        7120b8226aac32933bc1561b432093422a4d708b3c75bd4eea506f7f6586b0014ce2debf7da71874947274632db6f7ffd67b5ec0c88dd9d8f2ecff0b34e12df2

      • C:\Windows\Logo1_.exe

        Filesize

        29KB

        MD5

        a784c027199a4a152e6bda9335389b6d

        SHA1

        1471692fc01a6efbcdd85bddecb7f189dc2a0223

        SHA256

        ba4901782d6a771d84a51d248b886ac5635c84f353de97c47770667301ee484e

        SHA512

        6eef613061deb1a53d47021aba5861ff6d79efb794b290bee7e2d4e5f20febf1a31cf76da43db53ec0b33d8f19a633c4d5a82fe5efda3887e06472fe8d787999

      • C:\Windows\Logo1_.exe

        Filesize

        29KB

        MD5

        a784c027199a4a152e6bda9335389b6d

        SHA1

        1471692fc01a6efbcdd85bddecb7f189dc2a0223

        SHA256

        ba4901782d6a771d84a51d248b886ac5635c84f353de97c47770667301ee484e

        SHA512

        6eef613061deb1a53d47021aba5861ff6d79efb794b290bee7e2d4e5f20febf1a31cf76da43db53ec0b33d8f19a633c4d5a82fe5efda3887e06472fe8d787999

      • C:\Windows\rundl132.exe

        Filesize

        29KB

        MD5

        a784c027199a4a152e6bda9335389b6d

        SHA1

        1471692fc01a6efbcdd85bddecb7f189dc2a0223

        SHA256

        ba4901782d6a771d84a51d248b886ac5635c84f353de97c47770667301ee484e

        SHA512

        6eef613061deb1a53d47021aba5861ff6d79efb794b290bee7e2d4e5f20febf1a31cf76da43db53ec0b33d8f19a633c4d5a82fe5efda3887e06472fe8d787999

      • F:\$RECYCLE.BIN\S-1-5-21-2848203831-2014322062-3611574811-1000\_desktop.ini

        Filesize

        8B

        MD5

        587438ba3214d6958f23eced1b2cd39c

        SHA1

        56d9150b977089419b026aaf6ee032981c437dfd

        SHA256

        4a9d4c3f321c10e2bb0319dca7695b9b3252a0e1d35cfc2a09bac15d5c36e090

        SHA512

        31309fcfa73bf18bb138cbe3744414acc13498184290586c8f185e828027f7b0c647f3f102826099465c7995a29e8a33d95f832ffac8d16b619b53f037e4fd63

      • memory/1444-0-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/1444-9-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/5016-41-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/5016-32-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/5016-37-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/5016-26-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/5016-19-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/5016-270-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/5016-1278-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/5016-2771-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/5016-8-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/5016-4820-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.