Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    14/10/2023, 01:41

General

  • Target

    772e3beaa0f907d51a494fa8c9f9452008123e8eabeb5bdde1960f68a496d224.exe

  • Size

    158KB

  • MD5

    c14ff8f1e88d8a6ead775e7767013f08

  • SHA1

    27c0ec0cac4aa705bd0b7f075805c31a5772ccb1

  • SHA256

    772e3beaa0f907d51a494fa8c9f9452008123e8eabeb5bdde1960f68a496d224

  • SHA512

    55a1aa8f0d5f74e818cf3e75bd595b60df34ba1d7e7e82782cb47a3734c2751320b28d114043a8cad90a2032d220936a0c7b0af392e8a35a9e9b47041764a891

  • SSDEEP

    3072:H9faY46tGNttyCa670vTjy9+1w3qG5okf8DMq44NHfva:dx46tGdyr6MT8+1QqGR8DMcJva

Score
8/10

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 43 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1236
      • C:\Users\Admin\AppData\Local\Temp\772e3beaa0f907d51a494fa8c9f9452008123e8eabeb5bdde1960f68a496d224.exe
        "C:\Users\Admin\AppData\Local\Temp\772e3beaa0f907d51a494fa8c9f9452008123e8eabeb5bdde1960f68a496d224.exe"
        2⤵
        • Drops file in Drivers directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2472
        • C:\Windows\SysWOW64\net.exe
          net stop "Kingsoft AntiVirus Service"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3008
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
            4⤵
              PID:1168
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c C:\Users\Admin\AppData\Local\Temp\$$a37A4.bat
            3⤵
            • Deletes itself
            PID:2396
          • C:\Windows\Logo1_.exe
            C:\Windows\Logo1_.exe
            3⤵
            • Drops file in Drivers directory
            • Executes dropped EXE
            • Enumerates connected drives
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2656
            • C:\Windows\SysWOW64\net.exe
              net stop "Kingsoft AntiVirus Service"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:2664
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                5⤵
                  PID:2520
              • C:\Windows\SysWOW64\net.exe
                net stop "Kingsoft AntiVirus Service"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:2804
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                  5⤵
                    PID:1500

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

            Filesize

            478KB

            MD5

            fb271cab82b104fe3c0671241f253f23

            SHA1

            05bcae6ba22dd6be1eeef73481aa179bd46288c4

            SHA256

            4c2dd523f52d4c7e6e7edb151126522c74cb9f0211f48cb38751116883a2b1e0

            SHA512

            6d2ab4559512e431418a43f6a3bd8657a782b1f543ef4f86b4c8083b7f7fe47b2128888daa9e987c7524bc417a0a917d35993b3a80e488c5f04ed90c005df5cc

          • C:\Users\Admin\AppData\Local\Temp\$$a37A4.bat

            Filesize

            722B

            MD5

            b5625490f67181fec7bbf66716b1cf92

            SHA1

            c5f45c2b6b4884e45533e7479e532c3197dc4843

            SHA256

            23a110e1f4ade8ec94ed4c48f454f917d60bbff4ef12cff3aa2cd164e37353b3

            SHA512

            a922fbeb572c7cafd4f7cb89639d4f6ab4ce00f44ea5b5217f8d5f933db751093253dfd35a5c5d64e551ac95743d00a848e18e1fb691e78f5e8cf7e3552ea002

          • C:\Users\Admin\AppData\Local\Temp\$$a37A4.bat

            Filesize

            722B

            MD5

            b5625490f67181fec7bbf66716b1cf92

            SHA1

            c5f45c2b6b4884e45533e7479e532c3197dc4843

            SHA256

            23a110e1f4ade8ec94ed4c48f454f917d60bbff4ef12cff3aa2cd164e37353b3

            SHA512

            a922fbeb572c7cafd4f7cb89639d4f6ab4ce00f44ea5b5217f8d5f933db751093253dfd35a5c5d64e551ac95743d00a848e18e1fb691e78f5e8cf7e3552ea002

          • C:\Users\Admin\AppData\Local\Temp\772e3beaa0f907d51a494fa8c9f9452008123e8eabeb5bdde1960f68a496d224.exe.exe

            Filesize

            125KB

            MD5

            30713c3e1367afd2663a603396e98c1a

            SHA1

            3b9d3aacb874872324056839db21c8aee8fbaa39

            SHA256

            a6b88e30966fb951e49d50421bfbc5324df361bdf8a84e3a951877717c13fb5d

            SHA512

            62817eb3296fbd6be1005d355bb720bcf6ce6cd8b942c1a80025ad4dee17c536e1035a97d695fcc00a6ef1e1aeb00dd475d34359ea8008572a33c16225474399

          • C:\Windows\Logo1_.exe

            Filesize

            33KB

            MD5

            c4243f1db78936b73308850e39b944bb

            SHA1

            071f074afae0baebea0e3664d833abdc434bdbb1

            SHA256

            547e606076e11aec551e63be3b67ea72a8b2806661927af9ff4b1efa2f096358

            SHA512

            c7161512ab41ae9b683bbb40aab5f17c9fcc6730abda08d7cedc343c563d5b7d9561372572557e092274e208883f7455f5462ae240a5af359f702f5772ad9bd2

          • C:\Windows\Logo1_.exe

            Filesize

            33KB

            MD5

            c4243f1db78936b73308850e39b944bb

            SHA1

            071f074afae0baebea0e3664d833abdc434bdbb1

            SHA256

            547e606076e11aec551e63be3b67ea72a8b2806661927af9ff4b1efa2f096358

            SHA512

            c7161512ab41ae9b683bbb40aab5f17c9fcc6730abda08d7cedc343c563d5b7d9561372572557e092274e208883f7455f5462ae240a5af359f702f5772ad9bd2

          • C:\Windows\Logo1_.exe

            Filesize

            33KB

            MD5

            c4243f1db78936b73308850e39b944bb

            SHA1

            071f074afae0baebea0e3664d833abdc434bdbb1

            SHA256

            547e606076e11aec551e63be3b67ea72a8b2806661927af9ff4b1efa2f096358

            SHA512

            c7161512ab41ae9b683bbb40aab5f17c9fcc6730abda08d7cedc343c563d5b7d9561372572557e092274e208883f7455f5462ae240a5af359f702f5772ad9bd2

          • C:\Windows\rundl132.exe

            Filesize

            33KB

            MD5

            c4243f1db78936b73308850e39b944bb

            SHA1

            071f074afae0baebea0e3664d833abdc434bdbb1

            SHA256

            547e606076e11aec551e63be3b67ea72a8b2806661927af9ff4b1efa2f096358

            SHA512

            c7161512ab41ae9b683bbb40aab5f17c9fcc6730abda08d7cedc343c563d5b7d9561372572557e092274e208883f7455f5462ae240a5af359f702f5772ad9bd2

          • C:\Windows\system32\drivers\etc\hosts

            Filesize

            832B

            MD5

            7e3a0edd0c6cd8316f4b6c159d5167a1

            SHA1

            753428b4736ffb2c9e3eb50f89255b212768c55a

            SHA256

            1965854dfa54c72529c88c7d9f41fa31b4140cad04cf03d3f0f2e7601fcbdc6c

            SHA512

            9c68f7f72dfa109fcfba6472a1cced85bc6c2a5481232c6d1d039c88b2f65fb86070aeb26ac23e420c6255daca02ea6e698892f7670298d2c4f741b9e9415c7f

          • F:\$RECYCLE.BIN\S-1-5-21-3849525425-30183055-657688904-1000\_desktop.ini

            Filesize

            10B

            MD5

            b00c1a89b15effd3d1fb2de4fdc7bee5

            SHA1

            0c3a4f06bcd397d1d3a63ab2ca05e64cc7ae554d

            SHA256

            0767fccea7e57d6427b0a9b440f28687f4b835409c5dcdeb337a479009222cd9

            SHA512

            b50a3c1df331ecd7dbbd88c202c7b7b8fe6ece8df96249d88f40138952fb3c523f6f133a2d12daa2fd892643b53e4c19b39bcb16ef810f789c996e00bad03bc0

          • memory/1236-28-0x0000000002A10000-0x0000000002A11000-memory.dmp

            Filesize

            4KB

          • memory/2472-0-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

          • memory/2472-13-0x0000000000880000-0x00000000008BE000-memory.dmp

            Filesize

            248KB

          • memory/2472-18-0x0000000000880000-0x00000000008BE000-memory.dmp

            Filesize

            248KB

          • memory/2472-17-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

          • memory/2656-22-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

          • memory/2656-32-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

          • memory/2656-216-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

          • memory/2656-2834-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

          • memory/2656-3793-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

          • memory/2656-3866-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

          • memory/2656-4049-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB