Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/10/2023, 19:20

General

  • Target

    9d1ddb755df44bab574a2c88125ca4fca7d8d3f5f9373456f1529d55f9efdc1e.exe

  • Size

    270KB

  • MD5

    53c4eef25803a956d163431aea2326fb

  • SHA1

    06a1b33c1660f65e960bddf4b9a7542594c65207

  • SHA256

    9d1ddb755df44bab574a2c88125ca4fca7d8d3f5f9373456f1529d55f9efdc1e

  • SHA512

    567d688d46e44c48a1f8912d2609c2b9689a3792e0171c079beeccf71e4189e99ec7c1a6b6bcfdfbe6f02939958ee366a7e8b9729390082ddc50f4f7d9827a1c

  • SSDEEP

    6144:ZVfjmN5yMqd+wKVVrcAaTaJaeQ5uFhODs3pXsGKLu8N:v7+YHKV5cA3J04OD0tmx

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3192
      • C:\Users\Admin\AppData\Local\Temp\9d1ddb755df44bab574a2c88125ca4fca7d8d3f5f9373456f1529d55f9efdc1e.exe
        "C:\Users\Admin\AppData\Local\Temp\9d1ddb755df44bab574a2c88125ca4fca7d8d3f5f9373456f1529d55f9efdc1e.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:2316
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6949.bat
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2820
          • C:\Users\Admin\AppData\Local\Temp\9d1ddb755df44bab574a2c88125ca4fca7d8d3f5f9373456f1529d55f9efdc1e.exe
            "C:\Users\Admin\AppData\Local\Temp\9d1ddb755df44bab574a2c88125ca4fca7d8d3f5f9373456f1529d55f9efdc1e.exe"
            4⤵
            • Executes dropped EXE
            PID:2248
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1120
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:4152
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
                PID:1392

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

        Filesize

        251KB

        MD5

        4df9f5846fa9747b1b7d5f543b65f872

        SHA1

        19609926804d5e8fb8d7b2018a79b929d8b1a5c2

        SHA256

        c3508a574a46ca5e7faa5be9cd40e200ef7d168ffe0437423f75e775f1bfc267

        SHA512

        3830e5ab004f302e0e03e647834e7562d4a100a3dd5ebd8ae5b65551d58dd7ad17960c90e67b494d750985ed37719f8fd718f00335673890f295703ea436f992

      • C:\Program Files\7-Zip\7z.exe

        Filesize

        484KB

        MD5

        588fc700b9d21a282aa63e1b999b7e20

        SHA1

        76dcdac47073b2f966f2f1d0ef89674b81323869

        SHA256

        83710853ff1b81c482bca2496a8c57be7a987f9f0db4b4d4660098d7f19921ce

        SHA512

        073d2f78eaa7399041e2d3b88f367e400a1c9df688dc0b0f644178a53d93685d68bfd46138a467831ca654905ee6fd44d883a88d0091dcc1249c7910881f7aef

      • C:\Users\Admin\AppData\Local\Temp\$$a6949.bat

        Filesize

        722B

        MD5

        1eeed9e36862c1cb4b6fc49ef5fa2d62

        SHA1

        89ac1dd3f83bb4152ecf92a17cad53696116c8cc

        SHA256

        d6f26ae82a4e4da6266fe44d08f3736ba73f67399d835f858db65891313c68cb

        SHA512

        e6615d2f386a9b55a1de8234d2c1908f68aea46fd2a48cb92b431cf5d9c6ad94a0aeb4c0a9e82e461f98f0385d0e62981b6f8eb09e810dc1059a7490b9cf96e4

      • C:\Users\Admin\AppData\Local\Temp\9d1ddb755df44bab574a2c88125ca4fca7d8d3f5f9373456f1529d55f9efdc1e.exe

        Filesize

        244KB

        MD5

        efcc672f35bd784a307e079c8da923bd

        SHA1

        17de07708d7eab2b470ce9bc5e08cc125e195600

        SHA256

        3a88047a62dd27ae8993aa3d490e14924d60a53c8f3773205a47d6f5fcf4332b

        SHA512

        e8fc08bfc2bd6be154f3133c4baa90261836523512735060910fd3ef02e8698489ec5375a6d876ea76cf455c202cf78acd0079a25b8136ee1553a4dc9c037bca

      • C:\Users\Admin\AppData\Local\Temp\9d1ddb755df44bab574a2c88125ca4fca7d8d3f5f9373456f1529d55f9efdc1e.exe.exe

        Filesize

        244KB

        MD5

        efcc672f35bd784a307e079c8da923bd

        SHA1

        17de07708d7eab2b470ce9bc5e08cc125e195600

        SHA256

        3a88047a62dd27ae8993aa3d490e14924d60a53c8f3773205a47d6f5fcf4332b

        SHA512

        e8fc08bfc2bd6be154f3133c4baa90261836523512735060910fd3ef02e8698489ec5375a6d876ea76cf455c202cf78acd0079a25b8136ee1553a4dc9c037bca

      • C:\Windows\Logo1_.exe

        Filesize

        26KB

        MD5

        c272effd2155088a7c7aee29b42312c5

        SHA1

        34592ffcdd3f33e73878b5bade9e55a309efcbd7

        SHA256

        97ae00a29c9b4abc2281399cebdbc1d63381b67ee4e24ddbc724456ab217873c

        SHA512

        0c90d9a5a3bf7df2779257f6f71c34b9a9f6b0f50f05a3489c4eaa467e7904396b36b5dd2a61fac49933fce02ff8196c21603d596e6fca08c859c41c9d70ff28

      • C:\Windows\Logo1_.exe

        Filesize

        26KB

        MD5

        c272effd2155088a7c7aee29b42312c5

        SHA1

        34592ffcdd3f33e73878b5bade9e55a309efcbd7

        SHA256

        97ae00a29c9b4abc2281399cebdbc1d63381b67ee4e24ddbc724456ab217873c

        SHA512

        0c90d9a5a3bf7df2779257f6f71c34b9a9f6b0f50f05a3489c4eaa467e7904396b36b5dd2a61fac49933fce02ff8196c21603d596e6fca08c859c41c9d70ff28

      • C:\Windows\rundl132.exe

        Filesize

        26KB

        MD5

        c272effd2155088a7c7aee29b42312c5

        SHA1

        34592ffcdd3f33e73878b5bade9e55a309efcbd7

        SHA256

        97ae00a29c9b4abc2281399cebdbc1d63381b67ee4e24ddbc724456ab217873c

        SHA512

        0c90d9a5a3bf7df2779257f6f71c34b9a9f6b0f50f05a3489c4eaa467e7904396b36b5dd2a61fac49933fce02ff8196c21603d596e6fca08c859c41c9d70ff28

      • F:\$RECYCLE.BIN\S-1-5-21-1926387074-3400613176-3566796709-1000\_desktop.ini

        Filesize

        9B

        MD5

        0387f4acd0cfa16ac07fab88bff7f344

        SHA1

        60da1a37a16077ad337f6a91cc4acb9fba2940b3

        SHA256

        0b1b21f717a6f4add9692073f01b9b560898213b197ef3b47165d56be17c617d

        SHA512

        7d52216da22ceed1afe2b9d31fcea1798b2879eb6426d3634f38b7ea296627c516ff022d3cfe34df3aac4fa6fb6e2ad8eb21d2c9c040c83c53ea79487b1d13ab

      • memory/1120-19-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/1120-26-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/1120-32-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/1120-37-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/1120-41-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/1120-8-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/1120-123-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/1120-1278-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/1120-4454-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/1120-4831-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/2316-0-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/2316-9-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB