Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    177s
  • max time network
    173s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/10/2023, 22:26

General

  • Target

    472dcadda6b0c009deb997b83ad3dd89e4b80b5fbf4637f64cc280521a822be2.exe

  • Size

    122KB

  • MD5

    d28d3d4d2d8c5cd938d85beada8ad680

  • SHA1

    7279e7100d1e7ab52d1373062571fdc4c53feeb0

  • SHA256

    472dcadda6b0c009deb997b83ad3dd89e4b80b5fbf4637f64cc280521a822be2

  • SHA512

    34fe40b7dced69e6d02a7510749f209aaa269705fbf330c71c878dd83b8278bb24880ebfda4ac7a9c44d264dbbd18240c1fc78ed99829fa7d62541c4214e1099

  • SSDEEP

    3072:OftffjmNSoFHzg2I0PpPNX6RLXWertCQyyNU:2VfjmNvZzhPpPNq6QyH

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3132
      • C:\Users\Admin\AppData\Local\Temp\472dcadda6b0c009deb997b83ad3dd89e4b80b5fbf4637f64cc280521a822be2.exe
        "C:\Users\Admin\AppData\Local\Temp\472dcadda6b0c009deb997b83ad3dd89e4b80b5fbf4637f64cc280521a822be2.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:3036
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD7A3.bat
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4584
          • C:\Users\Admin\AppData\Local\Temp\472dcadda6b0c009deb997b83ad3dd89e4b80b5fbf4637f64cc280521a822be2.exe
            "C:\Users\Admin\AppData\Local\Temp\472dcadda6b0c009deb997b83ad3dd89e4b80b5fbf4637f64cc280521a822be2.exe"
            4⤵
            • Executes dropped EXE
            PID:3280
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4944
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1552
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
                PID:4020

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files\7-Zip\7z.exe

        Filesize

        484KB

        MD5

        4e68211d5ca5b4384780da7163aca122

        SHA1

        067ede6d5d2e700aede8416cbc1344b48bc7f403

        SHA256

        3fc8a84a337c74c13ea397c9fd998726b36ccab37404f05a3460c0ee4be2d38d

        SHA512

        9e0d960b1bba53fef5641d5b26ac1798547882cf3d556d58a14bdaf30c00dd5e88b569a7ea362f9f60c92b001aa3267e1968854f45f0897f4b27fdacf16f14de

      • C:\Users\Admin\AppData\Local\Temp\$$aD7A3.bat

        Filesize

        722B

        MD5

        2192838a0bdfb0364f54f7d45baf4cfd

        SHA1

        824709ed9984fcacfc3c52b6b4b6def689f68d75

        SHA256

        8ba74dca1243f18b992dd79b8127170b7a5e51e0e50f3315a1d8a2b15ad544a9

        SHA512

        977fdaa1b6507a35dc762119e7611fcdcec47c4b05d1160727a3104f4aa9ad2e7cc3b1e5542e1290d9adca1de3de05fa54a98bbbf91738102ef5578f22c3c0ef

      • C:\Users\Admin\AppData\Local\Temp\472dcadda6b0c009deb997b83ad3dd89e4b80b5fbf4637f64cc280521a822be2.exe

        Filesize

        96KB

        MD5

        4f777a9f156035ab4670da6cdcbd651c

        SHA1

        78b6f97056e6d5674bbcb94f13c4bf5527319c02

        SHA256

        77a8efbcc5e81e9534ad80aa2836105491f015d8a7355d0ba960f8fe5df3d0c8

        SHA512

        244dae23bcabfe4f7bcd10af02f24f88840fd91defd989cd39ad8a7ea4cb2829f9101e966a8d8ff95099269461afef587c7f8008437d8c23a91fee08acd33437

      • C:\Users\Admin\AppData\Local\Temp\472dcadda6b0c009deb997b83ad3dd89e4b80b5fbf4637f64cc280521a822be2.exe.exe

        Filesize

        96KB

        MD5

        4f777a9f156035ab4670da6cdcbd651c

        SHA1

        78b6f97056e6d5674bbcb94f13c4bf5527319c02

        SHA256

        77a8efbcc5e81e9534ad80aa2836105491f015d8a7355d0ba960f8fe5df3d0c8

        SHA512

        244dae23bcabfe4f7bcd10af02f24f88840fd91defd989cd39ad8a7ea4cb2829f9101e966a8d8ff95099269461afef587c7f8008437d8c23a91fee08acd33437

      • C:\Windows\Logo1_.exe

        Filesize

        26KB

        MD5

        28948521636f027a6e321d0ece85f68b

        SHA1

        4cc393871c2174328558347094d44cef430836d9

        SHA256

        37d128b4b8f41d2ed52a38ef4b628fa082d4693729b1af11d4067a1781a1a197

        SHA512

        2952a8aca9924a6c5a1dbdb94f79a9da49696e88c06f50ca1ce3390efb2b9bb86c8fd1184a160e810485c8f7ff11bc0d58c22787877ae5a46c66d1a6a8173c3b

      • C:\Windows\Logo1_.exe

        Filesize

        26KB

        MD5

        28948521636f027a6e321d0ece85f68b

        SHA1

        4cc393871c2174328558347094d44cef430836d9

        SHA256

        37d128b4b8f41d2ed52a38ef4b628fa082d4693729b1af11d4067a1781a1a197

        SHA512

        2952a8aca9924a6c5a1dbdb94f79a9da49696e88c06f50ca1ce3390efb2b9bb86c8fd1184a160e810485c8f7ff11bc0d58c22787877ae5a46c66d1a6a8173c3b

      • C:\Windows\rundl132.exe

        Filesize

        26KB

        MD5

        28948521636f027a6e321d0ece85f68b

        SHA1

        4cc393871c2174328558347094d44cef430836d9

        SHA256

        37d128b4b8f41d2ed52a38ef4b628fa082d4693729b1af11d4067a1781a1a197

        SHA512

        2952a8aca9924a6c5a1dbdb94f79a9da49696e88c06f50ca1ce3390efb2b9bb86c8fd1184a160e810485c8f7ff11bc0d58c22787877ae5a46c66d1a6a8173c3b

      • F:\$RECYCLE.BIN\S-1-5-21-919254492-3979293997-764407192-1000\_desktop.ini

        Filesize

        10B

        MD5

        81570c50286369016cef7a9f904c4b04

        SHA1

        b5758b23667cb35cad0adb23371b830fcee4f4e5

        SHA256

        b882f41a5c84d248a75714eaf215a9e363a49361b6a14beedb921ee3dfdb46a1

        SHA512

        0e6c479b0252e24635810b7d030cc9b5b17603ee20ccf62812446b8d15884521c6c7be65dfc0090bb1502e859fae27c2a63b3e58be714021f473a88407982162

      • memory/3036-12-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/3036-0-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/4944-26-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/4944-19-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/4944-32-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/4944-37-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/4944-41-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/4944-9-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/4944-270-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/4944-1278-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/4944-1411-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/4944-2352-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB