Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    88s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231020-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/10/2023, 07:33

General

  • Target

    f9e5fe496c762d6113bb6c36170ce7dea4ec17bda910a0d031368683b4814062.exe

  • Size

    2.3MB

  • MD5

    b143680ba62e4a74c9ab57e701214e5d

  • SHA1

    3d9b9a063e40583ff5950faa6115007b31cb7449

  • SHA256

    f9e5fe496c762d6113bb6c36170ce7dea4ec17bda910a0d031368683b4814062

  • SHA512

    fc2e8f8adbf764c1f343debd89c9b8d3124516db218ed2d66cabd2c7f0a6ff67924875cfc7f567bb709a24537a7d4ba65cbbf2d8cb52962b6e22fc6fcefad144

  • SSDEEP

    49152:bQN2skpzPXDFBjWRJTCAIHuDeeaJ98mjRC9YC2Ns+/X0h54GEewKk:b62bz/5YvpI2eey98CRC4L0ZRbk

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3148
      • C:\Users\Admin\AppData\Local\Temp\f9e5fe496c762d6113bb6c36170ce7dea4ec17bda910a0d031368683b4814062.exe
        "C:\Users\Admin\AppData\Local\Temp\f9e5fe496c762d6113bb6c36170ce7dea4ec17bda910a0d031368683b4814062.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:312
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB805.bat
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4616
          • C:\Users\Admin\AppData\Local\Temp\f9e5fe496c762d6113bb6c36170ce7dea4ec17bda910a0d031368683b4814062.exe
            "C:\Users\Admin\AppData\Local\Temp\f9e5fe496c762d6113bb6c36170ce7dea4ec17bda910a0d031368683b4814062.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:1944
            • \??\c:\271b7930ff86e95a8892814260ae2f5e\install.exe
              c:\271b7930ff86e95a8892814260ae2f5e\.\install.exe
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:1428
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3816
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2144
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
                PID:3476

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\271b7930ff86e95a8892814260ae2f5e\eula.1031.txt

        Filesize

        17KB

        MD5

        9147a93f43d8e58218ebcb15fda888c9

        SHA1

        8277c722ba478be8606d8429de3772b5de4e5f09

        SHA256

        a75019ac38e0d3570633fa282f3d95d20763657f4a2fe851fae52a3185d1eded

        SHA512

        cc9176027621a590a1d4f6e17942012023e3fabc3316bc62c4b17cd61ce76bf5cf270bd32da95dba7ddf3163e84114be1103a6f810ca1a05d914712895f09705

      • C:\271b7930ff86e95a8892814260ae2f5e\install.exe

        Filesize

        835KB

        MD5

        e015a2d8890e2a96a93ca818f834c45b

        SHA1

        30bda2b4464b1c41210cba367e444aed56502360

        SHA256

        dc1ba9cb15d0808dc2d80ce13acfa0b07acdfcfe2cdf94da47e0e570e7345f6d

        SHA512

        20a80b50486e938b92f3aef85e59307f644b69dc5d1edee38038182b57caf636f5f1909959f6fafcfc2e915010d2b3d230cba8300fbc0f63ee2ee3ad8ad64123

      • C:\271b7930ff86e95a8892814260ae2f5e\install.res.1033.dll

        Filesize

        88KB

        MD5

        43fb29e3a676d26fcbf0352207991523

        SHA1

        c485159b01baa676167c414fd15f1026e3ae7c14

        SHA256

        4107f4813bc41ed6a6586d1ba01a5c3703ed60c2df060cba6791f449f3689de7

        SHA512

        ad748c63d912e194bb5be42f6db192b22f59f760e0536118dfa963fe29001e7fe635d035f31d86aa5e77a1d4f7ceabf27b03645d0037f147293af1e32eab57a4

      • C:\Program Files\7-Zip\7z.exe

        Filesize

        485KB

        MD5

        b25874c30a9d2eeb6e97e1fbaebed221

        SHA1

        04d6fc2f90b367932d540f2af159bcf0e2f68b28

        SHA256

        3e3df8253b8618d772bff65912de7c9375d3dd7f792e8d4a7860251844fbc97c

        SHA512

        3446f9a649201bd3eb2734d8107ea9d1fdd72fa03a702e0f7ea1b5894ba8e2d7a8b18cc1e9d59c1f0096bb2929a5a7077938027bcf56f07d8e58cbce17a42fa6

      • C:\Users\Admin\AppData\Local\Temp\$$aB805.bat

        Filesize

        722B

        MD5

        e0027d279089f8a282c730aca5f6f557

        SHA1

        a36d8946e052c8bc857f5c3cfc55af3195967da8

        SHA256

        b59e5447481933e936e60653dbc7be1b9a589b77d96b8c8ba2bee8063149a087

        SHA512

        6cd227e5f0fa94075ee612c9d1c769a897ffa8ba3e8457a3674a4dd3a56850f59ac2c1ad08a1b0d7b7994d37cd78896a178684f7398faf831eadfb90edfcfddb

      • C:\Users\Admin\AppData\Local\Temp\f9e5fe496c762d6113bb6c36170ce7dea4ec17bda910a0d031368683b4814062.exe

        Filesize

        2.3MB

        MD5

        a31dc1a74f1dee5caf63aec8ebb5fe20

        SHA1

        5580072a056fdd50cdf93d470239538636f8f3a9

        SHA256

        baaaeddc17bcda8d20c0a82a9eb1247be06b509a820d65dda1342f4010bdb4a0

        SHA512

        fc65d9c85503ff2a3444a6b57abe376ad78d8f476ebbc1d51e7f4bbbbc7e3a3ae1fdf4d00ef9198e4f9a356585fbdff1d932ffd95606a575dfc192fb26e40cf9

      • C:\Users\Admin\AppData\Local\Temp\f9e5fe496c762d6113bb6c36170ce7dea4ec17bda910a0d031368683b4814062.exe.exe

        Filesize

        2.3MB

        MD5

        a31dc1a74f1dee5caf63aec8ebb5fe20

        SHA1

        5580072a056fdd50cdf93d470239538636f8f3a9

        SHA256

        baaaeddc17bcda8d20c0a82a9eb1247be06b509a820d65dda1342f4010bdb4a0

        SHA512

        fc65d9c85503ff2a3444a6b57abe376ad78d8f476ebbc1d51e7f4bbbbc7e3a3ae1fdf4d00ef9198e4f9a356585fbdff1d932ffd95606a575dfc192fb26e40cf9

      • C:\Windows\Logo1_.exe

        Filesize

        27KB

        MD5

        d7c4b5686865c6e1a408b27b513a7a9a

        SHA1

        2ba388ebbf4ffd608b6e3c05a7ce4e5b8f78803c

        SHA256

        17fc395a9bb03e3cb59b29b51646ce1e021170b85a68ead67c7fa9a167d4a50b

        SHA512

        e211b3bfe1bd30dceb9e9f6c4b8098ea9e4f39dd1bf19f2d965ddcee380e430974ca969c9794d56ee0ac65f60821fd8a6e72ff149c532264780726b3cd70294b

      • C:\Windows\Logo1_.exe

        Filesize

        27KB

        MD5

        d7c4b5686865c6e1a408b27b513a7a9a

        SHA1

        2ba388ebbf4ffd608b6e3c05a7ce4e5b8f78803c

        SHA256

        17fc395a9bb03e3cb59b29b51646ce1e021170b85a68ead67c7fa9a167d4a50b

        SHA512

        e211b3bfe1bd30dceb9e9f6c4b8098ea9e4f39dd1bf19f2d965ddcee380e430974ca969c9794d56ee0ac65f60821fd8a6e72ff149c532264780726b3cd70294b

      • C:\Windows\rundl132.exe

        Filesize

        27KB

        MD5

        d7c4b5686865c6e1a408b27b513a7a9a

        SHA1

        2ba388ebbf4ffd608b6e3c05a7ce4e5b8f78803c

        SHA256

        17fc395a9bb03e3cb59b29b51646ce1e021170b85a68ead67c7fa9a167d4a50b

        SHA512

        e211b3bfe1bd30dceb9e9f6c4b8098ea9e4f39dd1bf19f2d965ddcee380e430974ca969c9794d56ee0ac65f60821fd8a6e72ff149c532264780726b3cd70294b

      • F:\$RECYCLE.BIN\S-1-5-21-356073083-3299209671-3108880702-1000\_desktop.ini

        Filesize

        10B

        MD5

        d3c36a72fc1c8bd61b57107d5d012a29

        SHA1

        2a13da90a3c63c88dd43ae9c670876f0dd0fc03e

        SHA256

        a2f94b462f3497d26399b1f5eda449b87e3ded10e09de07369f6a984eff5383d

        SHA512

        4c08a9bdba23ece3ba391c1cd3696b046892c028f94e04e955fbee3a13dc181f1073c8f6e686529dd613bd468297d6b21a7de318ae61b88a2d642f3215c20232

      • \??\c:\271b7930ff86e95a8892814260ae2f5e\eula.1033.txt

        Filesize

        9KB

        MD5

        99c22d4a31f4ead4351b71d6f4e5f6a1

        SHA1

        73207ebe59f6e1073c0d76c8835a312c367b6104

        SHA256

        93a3c629fecfd10c1cf614714efd69b10e89cfcaf94c2609d688b27754e4ab41

        SHA512

        47b7ec5fed06d6c789935e9e95ea245c7c498b859e2c0165a437a7bf0006e447c4df4beeb97484c56446f1dae547a01387bea4e884970380f37432825eb16e94

      • \??\c:\271b7930ff86e95a8892814260ae2f5e\globdata.ini

        Filesize

        1KB

        MD5

        0a6b586fabd072bd7382b5e24194eac7

        SHA1

        60e3c7215c1a40fbfb3016d52c2de44592f8ca95

        SHA256

        7912e3fcf2698cf4f8625e563cd8215c6668739cae18bd6f27af2d25bec5c951

        SHA512

        b96b0448e9f0e94a7867b6bb103979e9ef2c0e074bcb85988d450d63de6edcf21dc83bb154aafb7de524af3c3734f0bb1ba649db0408612479322e1aa85be9f4

      • \??\c:\271b7930ff86e95a8892814260ae2f5e\install.exe

        Filesize

        835KB

        MD5

        e015a2d8890e2a96a93ca818f834c45b

        SHA1

        30bda2b4464b1c41210cba367e444aed56502360

        SHA256

        dc1ba9cb15d0808dc2d80ce13acfa0b07acdfcfe2cdf94da47e0e570e7345f6d

        SHA512

        20a80b50486e938b92f3aef85e59307f644b69dc5d1edee38038182b57caf636f5f1909959f6fafcfc2e915010d2b3d230cba8300fbc0f63ee2ee3ad8ad64123

      • \??\c:\271b7930ff86e95a8892814260ae2f5e\install.ini

        Filesize

        843B

        MD5

        0da9ab4977f3e7ba8c65734df42fdab6

        SHA1

        b4ed6eea276f1a7988112f3bde0bd89906237c3f

        SHA256

        672621b056188f8d3fa5ab8cd3df4f95530c962af9bb11cf7c9bd1127b3c3605

        SHA512

        1ef58271cdedbdc53615631cc823483f874c89c2d62e0678de9d469a82bd676eb8abd34656caa5128b7edb0eb24dbf0992e5e571a97f7782c933b2be88af3144

      • \??\c:\271b7930ff86e95a8892814260ae2f5e\install.res.1033.dll

        Filesize

        88KB

        MD5

        43fb29e3a676d26fcbf0352207991523

        SHA1

        c485159b01baa676167c414fd15f1026e3ae7c14

        SHA256

        4107f4813bc41ed6a6586d1ba01a5c3703ed60c2df060cba6791f449f3689de7

        SHA512

        ad748c63d912e194bb5be42f6db192b22f59f760e0536118dfa963fe29001e7fe635d035f31d86aa5e77a1d4f7ceabf27b03645d0037f147293af1e32eab57a4

      • \??\c:\271b7930ff86e95a8892814260ae2f5e\vc_red.msi

        Filesize

        236KB

        MD5

        d53737cea320b066c099894ed1780705

        SHA1

        d8dc8c2c761933502307a331660bd3fb7bd2c078

        SHA256

        be6288737ea9691f29a17202eccbc0a2e3e1b1b4bacc090ceee2436970aec240

        SHA512

        0af685e4ffb9f7f2e5b28982b9cf3da4ee00e26bd05e830d5316bce277dc91dfee3fe557719ab3406ad866d1ce72644e7a5400dcd561b93d367e12eb96078ffe

      • \??\c:\271b7930ff86e95a8892814260ae2f5e\vcredist.bmp

        Filesize

        5KB

        MD5

        06fba95313f26e300917c6cea4480890

        SHA1

        31beee44776f114078fc403e405eaa5936c4bc3b

        SHA256

        594884a8006e24ad5b1578cd7c75aca21171bb079ebdc4f6518905bcf2237ba1

        SHA512

        7dca0f1ab5d3fd1ac8755142a7ca4d085bb0c2f12a7272e56159dadfa22da79ec8261815be71b9f5e7c32f6e8121ecb2443060f7db76feaf01eb193200e67dfd

      • memory/312-0-0x0000000000400000-0x0000000000435000-memory.dmp

        Filesize

        212KB

      • memory/312-10-0x0000000000400000-0x0000000000435000-memory.dmp

        Filesize

        212KB

      • memory/1428-71-0x00000000027E0000-0x00000000027E1000-memory.dmp

        Filesize

        4KB

      • memory/1428-65-0x00000000027E0000-0x00000000027E1000-memory.dmp

        Filesize

        4KB

      • memory/3816-70-0x0000000000400000-0x0000000000435000-memory.dmp

        Filesize

        212KB

      • memory/3816-8-0x0000000000400000-0x0000000000435000-memory.dmp

        Filesize

        212KB

      • memory/3816-78-0x0000000000400000-0x0000000000435000-memory.dmp

        Filesize

        212KB

      • memory/3816-84-0x0000000000400000-0x0000000000435000-memory.dmp

        Filesize

        212KB

      • memory/3816-98-0x0000000000400000-0x0000000000435000-memory.dmp

        Filesize

        212KB

      • memory/3816-104-0x0000000000400000-0x0000000000435000-memory.dmp

        Filesize

        212KB

      • memory/3816-108-0x0000000000400000-0x0000000000435000-memory.dmp

        Filesize

        212KB

      • memory/3816-1151-0x0000000000400000-0x0000000000435000-memory.dmp

        Filesize

        212KB