Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    153s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/09/2023, 19:37

General

  • Target

    ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe

  • Size

    26KB

  • MD5

    cab628bceb8b3c9bb2b79a71a0d68319

  • SHA1

    a20587dd81165b8e1e22b056c40677d94bece6cb

  • SHA256

    ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e

  • SHA512

    d71b4eea641bec4c2d86d55702f6d96eca1af92ca4ab87b24fc3eeab2b705134629ef80b9f5d1cb29c5212b0866d39963708851bd39e1f6774198a6e7df2af78

  • SSDEEP

    768:1Z1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoGwXnKx:tfgLdQAQfcfymNG+Kx

Score
6/10

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 53 IoCs
  • Drops file in Windows directory 1 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:2812
      • C:\Users\Admin\AppData\Local\Temp\ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
        "C:\Users\Admin\AppData\Local\Temp\ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe"
        2⤵
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3236
        • C:\Windows\SysWOW64\net.exe
          net stop "Kingsoft AntiVirus Service"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1912
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
            4⤵
              PID:1808

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files\Google\Chrome\Application\chrome.exe

        Filesize

        2.8MB

        MD5

        a2a48363162d1b1a1163bb6067c1913c

        SHA1

        52cac85e0d046325a601ab194335eef55b2ffb1b

        SHA256

        cb93b8234901d93d048515c5abe8a56e931653e0f7aa13e7eed6a4b579333490

        SHA512

        a4fea1ff27926fc83fc09c77d82a7ace4fee1d5f3e38d16ea581fb0aa5e698045ec47fa5c78f7dba2785ead50d4a1c4a811a9ad6940bdadf856365681a88a59f

      • C:\odt\_desktop.ini

        Filesize

        9B

        MD5

        872506f1dadcc0cedd1e9dee11f54da4

        SHA1

        d1e87145ed1d918f10ae4e93ccdbb994bc906ed5

        SHA256

        a0049e98811438481e150df54f7b555026746c943cb03106677bf75b4e412104

        SHA512

        6cf3aeeed18e66a16ed653a5c33133ec8d5fb58cf42aab9e712cf473233e506d4f14692dff04b7c20847718e5c344ec2651e57d2ae7a034610b07679b786344c

      • F:\$RECYCLE.BIN\S-1-5-21-1045988481-1457812719-2617974652-1000\_desktop.ini

        Filesize

        9B

        MD5

        0d8cc6d8ad77008e4eea5193ba074b8b

        SHA1

        ed3ef3737662f0b0d7dabb8a681fdab8882322a1

        SHA256

        02cb6e1ee5bc2475b62b35df1ff95d9d38080ea818c3fea2c65ceb449c761999

        SHA512

        8cf0f361865203a0b8ea23fb3a33827b86958c4035294db074562956d6fe213d9069f3e5687ea66284e14f4406d74d348d98eec1af10b2538acd7a302752813f

      • memory/3236-13-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/3236-16-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/3236-19-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/3236-0-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/3236-24-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/3236-28-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/3236-34-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/3236-5-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/3236-51-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/3236-75-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/3236-84-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB