Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    02/10/2023, 19:20

General

  • Target

    9d1ddb755df44bab574a2c88125ca4fca7d8d3f5f9373456f1529d55f9efdc1e.exe

  • Size

    270KB

  • MD5

    53c4eef25803a956d163431aea2326fb

  • SHA1

    06a1b33c1660f65e960bddf4b9a7542594c65207

  • SHA256

    9d1ddb755df44bab574a2c88125ca4fca7d8d3f5f9373456f1529d55f9efdc1e

  • SHA512

    567d688d46e44c48a1f8912d2609c2b9689a3792e0171c079beeccf71e4189e99ec7c1a6b6bcfdfbe6f02939958ee366a7e8b9729390082ddc50f4f7d9827a1c

  • SSDEEP

    6144:ZVfjmN5yMqd+wKVVrcAaTaJaeQ5uFhODs3pXsGKLu8N:v7+YHKV5cA3J04OD0tmx

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1348
      • C:\Users\Admin\AppData\Local\Temp\9d1ddb755df44bab574a2c88125ca4fca7d8d3f5f9373456f1529d55f9efdc1e.exe
        "C:\Users\Admin\AppData\Local\Temp\9d1ddb755df44bab574a2c88125ca4fca7d8d3f5f9373456f1529d55f9efdc1e.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:2960
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c C:\Users\Admin\AppData\Local\Temp\$$a4808.bat
          3⤵
          • Deletes itself
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:2400
          • C:\Users\Admin\AppData\Local\Temp\9d1ddb755df44bab574a2c88125ca4fca7d8d3f5f9373456f1529d55f9efdc1e.exe
            "C:\Users\Admin\AppData\Local\Temp\9d1ddb755df44bab574a2c88125ca4fca7d8d3f5f9373456f1529d55f9efdc1e.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2704
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2176
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1612
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
                PID:2616

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

        Filesize

        251KB

        MD5

        4df9f5846fa9747b1b7d5f543b65f872

        SHA1

        19609926804d5e8fb8d7b2018a79b929d8b1a5c2

        SHA256

        c3508a574a46ca5e7faa5be9cd40e200ef7d168ffe0437423f75e775f1bfc267

        SHA512

        3830e5ab004f302e0e03e647834e7562d4a100a3dd5ebd8ae5b65551d58dd7ad17960c90e67b494d750985ed37719f8fd718f00335673890f295703ea436f992

      • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

        Filesize

        471KB

        MD5

        4cfdb20b04aa239d6f9e83084d5d0a77

        SHA1

        f22863e04cc1fd4435f785993ede165bd8245ac6

        SHA256

        30ed17ca6ae530e8bf002bcef6048f94dba4b3b10252308147031f5c86ace1b9

        SHA512

        35b4c2f68a7caa45f2bb14b168947e06831f358e191478a6659b49f30ca6f538dc910fe6067448d5d8af4cb8558825d70f94d4bd67709aee414b2be37d49be86

      • C:\Users\Admin\AppData\Local\Temp\$$a4808.bat

        Filesize

        722B

        MD5

        3906e453cac662fe56b38c19a0369d5f

        SHA1

        fef9a0ef92d166377ebba626a9dba50ce1a2c124

        SHA256

        910790851741f09a0fe7520687d3d87744d7c8be2cb3506802f946b81fba0b2f

        SHA512

        8ad0608c30e41442faae8c82a03c0627678b834ad8e92e0cf82b0a6e44a41c43f8d62dd6fbad1edc097d6e064de747bc400dee7ac47fc008a3ef2e1d33c949f0

      • C:\Users\Admin\AppData\Local\Temp\$$a4808.bat

        Filesize

        722B

        MD5

        3906e453cac662fe56b38c19a0369d5f

        SHA1

        fef9a0ef92d166377ebba626a9dba50ce1a2c124

        SHA256

        910790851741f09a0fe7520687d3d87744d7c8be2cb3506802f946b81fba0b2f

        SHA512

        8ad0608c30e41442faae8c82a03c0627678b834ad8e92e0cf82b0a6e44a41c43f8d62dd6fbad1edc097d6e064de747bc400dee7ac47fc008a3ef2e1d33c949f0

      • C:\Users\Admin\AppData\Local\Temp\9d1ddb755df44bab574a2c88125ca4fca7d8d3f5f9373456f1529d55f9efdc1e.exe

        Filesize

        244KB

        MD5

        efcc672f35bd784a307e079c8da923bd

        SHA1

        17de07708d7eab2b470ce9bc5e08cc125e195600

        SHA256

        3a88047a62dd27ae8993aa3d490e14924d60a53c8f3773205a47d6f5fcf4332b

        SHA512

        e8fc08bfc2bd6be154f3133c4baa90261836523512735060910fd3ef02e8698489ec5375a6d876ea76cf455c202cf78acd0079a25b8136ee1553a4dc9c037bca

      • C:\Users\Admin\AppData\Local\Temp\9d1ddb755df44bab574a2c88125ca4fca7d8d3f5f9373456f1529d55f9efdc1e.exe.exe

        Filesize

        244KB

        MD5

        efcc672f35bd784a307e079c8da923bd

        SHA1

        17de07708d7eab2b470ce9bc5e08cc125e195600

        SHA256

        3a88047a62dd27ae8993aa3d490e14924d60a53c8f3773205a47d6f5fcf4332b

        SHA512

        e8fc08bfc2bd6be154f3133c4baa90261836523512735060910fd3ef02e8698489ec5375a6d876ea76cf455c202cf78acd0079a25b8136ee1553a4dc9c037bca

      • C:\Windows\Logo1_.exe

        Filesize

        26KB

        MD5

        c272effd2155088a7c7aee29b42312c5

        SHA1

        34592ffcdd3f33e73878b5bade9e55a309efcbd7

        SHA256

        97ae00a29c9b4abc2281399cebdbc1d63381b67ee4e24ddbc724456ab217873c

        SHA512

        0c90d9a5a3bf7df2779257f6f71c34b9a9f6b0f50f05a3489c4eaa467e7904396b36b5dd2a61fac49933fce02ff8196c21603d596e6fca08c859c41c9d70ff28

      • C:\Windows\Logo1_.exe

        Filesize

        26KB

        MD5

        c272effd2155088a7c7aee29b42312c5

        SHA1

        34592ffcdd3f33e73878b5bade9e55a309efcbd7

        SHA256

        97ae00a29c9b4abc2281399cebdbc1d63381b67ee4e24ddbc724456ab217873c

        SHA512

        0c90d9a5a3bf7df2779257f6f71c34b9a9f6b0f50f05a3489c4eaa467e7904396b36b5dd2a61fac49933fce02ff8196c21603d596e6fca08c859c41c9d70ff28

      • C:\Windows\Logo1_.exe

        Filesize

        26KB

        MD5

        c272effd2155088a7c7aee29b42312c5

        SHA1

        34592ffcdd3f33e73878b5bade9e55a309efcbd7

        SHA256

        97ae00a29c9b4abc2281399cebdbc1d63381b67ee4e24ddbc724456ab217873c

        SHA512

        0c90d9a5a3bf7df2779257f6f71c34b9a9f6b0f50f05a3489c4eaa467e7904396b36b5dd2a61fac49933fce02ff8196c21603d596e6fca08c859c41c9d70ff28

      • C:\Windows\rundl132.exe

        Filesize

        26KB

        MD5

        c272effd2155088a7c7aee29b42312c5

        SHA1

        34592ffcdd3f33e73878b5bade9e55a309efcbd7

        SHA256

        97ae00a29c9b4abc2281399cebdbc1d63381b67ee4e24ddbc724456ab217873c

        SHA512

        0c90d9a5a3bf7df2779257f6f71c34b9a9f6b0f50f05a3489c4eaa467e7904396b36b5dd2a61fac49933fce02ff8196c21603d596e6fca08c859c41c9d70ff28

      • F:\$RECYCLE.BIN\S-1-5-21-3513876443-2771975297-1923446376-1000\_desktop.ini

        Filesize

        9B

        MD5

        0387f4acd0cfa16ac07fab88bff7f344

        SHA1

        60da1a37a16077ad337f6a91cc4acb9fba2940b3

        SHA256

        0b1b21f717a6f4add9692073f01b9b560898213b197ef3b47165d56be17c617d

        SHA512

        7d52216da22ceed1afe2b9d31fcea1798b2879eb6426d3634f38b7ea296627c516ff022d3cfe34df3aac4fa6fb6e2ad8eb21d2c9c040c83c53ea79487b1d13ab

      • \Users\Admin\AppData\Local\Temp\9d1ddb755df44bab574a2c88125ca4fca7d8d3f5f9373456f1529d55f9efdc1e.exe

        Filesize

        244KB

        MD5

        efcc672f35bd784a307e079c8da923bd

        SHA1

        17de07708d7eab2b470ce9bc5e08cc125e195600

        SHA256

        3a88047a62dd27ae8993aa3d490e14924d60a53c8f3773205a47d6f5fcf4332b

        SHA512

        e8fc08bfc2bd6be154f3133c4baa90261836523512735060910fd3ef02e8698489ec5375a6d876ea76cf455c202cf78acd0079a25b8136ee1553a4dc9c037bca

      • \Users\Admin\AppData\Local\Temp\9d1ddb755df44bab574a2c88125ca4fca7d8d3f5f9373456f1529d55f9efdc1e.exe

        Filesize

        244KB

        MD5

        efcc672f35bd784a307e079c8da923bd

        SHA1

        17de07708d7eab2b470ce9bc5e08cc125e195600

        SHA256

        3a88047a62dd27ae8993aa3d490e14924d60a53c8f3773205a47d6f5fcf4332b

        SHA512

        e8fc08bfc2bd6be154f3133c4baa90261836523512735060910fd3ef02e8698489ec5375a6d876ea76cf455c202cf78acd0079a25b8136ee1553a4dc9c037bca

      • \Users\Admin\AppData\Local\Temp\9d1ddb755df44bab574a2c88125ca4fca7d8d3f5f9373456f1529d55f9efdc1e.exe

        Filesize

        244KB

        MD5

        efcc672f35bd784a307e079c8da923bd

        SHA1

        17de07708d7eab2b470ce9bc5e08cc125e195600

        SHA256

        3a88047a62dd27ae8993aa3d490e14924d60a53c8f3773205a47d6f5fcf4332b

        SHA512

        e8fc08bfc2bd6be154f3133c4baa90261836523512735060910fd3ef02e8698489ec5375a6d876ea76cf455c202cf78acd0079a25b8136ee1553a4dc9c037bca

      • \Users\Admin\AppData\Local\Temp\9d1ddb755df44bab574a2c88125ca4fca7d8d3f5f9373456f1529d55f9efdc1e.exe

        Filesize

        244KB

        MD5

        efcc672f35bd784a307e079c8da923bd

        SHA1

        17de07708d7eab2b470ce9bc5e08cc125e195600

        SHA256

        3a88047a62dd27ae8993aa3d490e14924d60a53c8f3773205a47d6f5fcf4332b

        SHA512

        e8fc08bfc2bd6be154f3133c4baa90261836523512735060910fd3ef02e8698489ec5375a6d876ea76cf455c202cf78acd0079a25b8136ee1553a4dc9c037bca

      • memory/1348-33-0x0000000002600000-0x0000000002601000-memory.dmp

        Filesize

        4KB

      • memory/2176-44-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/2176-96-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/2176-35-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/2176-3315-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/2176-21-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/2176-1855-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/2176-50-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/2176-189-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/2176-103-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/2960-0-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/2960-15-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/2960-22-0x0000000000220000-0x0000000000254000-memory.dmp

        Filesize

        208KB

      • memory/2960-37-0x0000000000220000-0x0000000000254000-memory.dmp

        Filesize

        208KB

      • memory/2960-16-0x0000000000220000-0x0000000000254000-memory.dmp

        Filesize

        208KB