Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231020-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/10/2023, 07:47

General

  • Target

    201cff169b47cdb925ca24fe47584599281b6ecd0bb65e5960411e93dff7b59d.exe

  • Size

    116KB

  • MD5

    a625bffbcc9f310a3998ca5ade8f14f4

  • SHA1

    a76829a264359eccc14f4d30db97102234be49e8

  • SHA256

    201cff169b47cdb925ca24fe47584599281b6ecd0bb65e5960411e93dff7b59d

  • SHA512

    1585c30d9b5ae16988c6b1c9ca924bf69b86b2b8b73bc6f235fd7c474db30c5f3628197bae95e22154c8ceaa2a615d950eddd0c580732a2dead218c4572811ec

  • SSDEEP

    3072:BftffjmN3Jo/FQXy+uc//korlDFtNel3kaIFH/B0CyPvO3c0gCajNCg:JVfjmN3Jo/qi+k

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3256
      • C:\Users\Admin\AppData\Local\Temp\201cff169b47cdb925ca24fe47584599281b6ecd0bb65e5960411e93dff7b59d.exe
        "C:\Users\Admin\AppData\Local\Temp\201cff169b47cdb925ca24fe47584599281b6ecd0bb65e5960411e93dff7b59d.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:4448
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA5B6.bat
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:808
          • C:\Users\Admin\AppData\Local\Temp\201cff169b47cdb925ca24fe47584599281b6ecd0bb65e5960411e93dff7b59d.exe
            "C:\Users\Admin\AppData\Local\Temp\201cff169b47cdb925ca24fe47584599281b6ecd0bb65e5960411e93dff7b59d.exe"
            4⤵
            • Executes dropped EXE
            PID:2112
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1196
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:4892
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
                PID:1648

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

        Filesize

        251KB

        MD5

        bd68d43c687d28dd7a767928ee356a04

        SHA1

        683eeecef7f75194de1fc21296a31742351ec07f

        SHA256

        f50e651f61f0b43219f84425b96bb29d04067158c9a2090824501c128eb322f5

        SHA512

        d5d8bbc180782a5c648a44003622105904ac4d39018083631d3f56eb9b3ccb2990f7b295670e2920d7420d8ca785311b245ae46cc15d93c18f91fd74d028ddd4

      • C:\Program Files\7-Zip\7z.exe

        Filesize

        484KB

        MD5

        dd7289d41bdd1d4e797fb59ec03c9ced

        SHA1

        d42c057bcd13b424abe11adfef721a10d2609288

        SHA256

        29bc1fa38ad291825d1e2d43db6bca71124243251b52df5b31922ff0f377684e

        SHA512

        bb2585c9bf1a9e8ab0f393b6e2e24eeea430c4a610ff5912b22b6ac860ba97b05dba5179159343a935bdecccaf1cdc3de03e437f86a0ea988d6e73ce4f832c14

      • C:\Users\Admin\AppData\Local\Temp\$$aA5B6.bat

        Filesize

        722B

        MD5

        0bdf235b86dd154c383f64a7e530e872

        SHA1

        4edc6100625e36546df0b7bbe70def610ac99c7d

        SHA256

        ba44298319dd653dbfaea75bbe40879a7f1f83eff5b51663b24e635d7bd7a959

        SHA512

        ea32c216e6efd13b693ea6e686443ecd7074197f285ddc2774af8995877f3e9dd577bb347e9efca98a44e959c6ea2b4373cca511f42325099f54de9ef65b3396

      • C:\Users\Admin\AppData\Local\Temp\201cff169b47cdb925ca24fe47584599281b6ecd0bb65e5960411e93dff7b59d.exe

        Filesize

        90KB

        MD5

        c8c3b8fb878ce29b75a69219abff4ccf

        SHA1

        e2e5d4feb0dff20ad1d83f72062f5816d365bc37

        SHA256

        4656a73e3e8ae7ab4dc9bcdcda922f18787978c758871c9bd51e4340d46e5113

        SHA512

        70c68e1c770cc806b2d2edf5d40cc86dd1781d8a01849cffc08a511133c1efcf892bd8a56dd4a7f8e307c46b038fff3a309ce9c1d78feb6190347ae6d77d6ad1

      • C:\Users\Admin\AppData\Local\Temp\201cff169b47cdb925ca24fe47584599281b6ecd0bb65e5960411e93dff7b59d.exe.exe

        Filesize

        90KB

        MD5

        c8c3b8fb878ce29b75a69219abff4ccf

        SHA1

        e2e5d4feb0dff20ad1d83f72062f5816d365bc37

        SHA256

        4656a73e3e8ae7ab4dc9bcdcda922f18787978c758871c9bd51e4340d46e5113

        SHA512

        70c68e1c770cc806b2d2edf5d40cc86dd1781d8a01849cffc08a511133c1efcf892bd8a56dd4a7f8e307c46b038fff3a309ce9c1d78feb6190347ae6d77d6ad1

      • C:\Windows\Logo1_.exe

        Filesize

        26KB

        MD5

        2001b3d40d05330d0c289354fd39c442

        SHA1

        31c0c109110e336da3bdfee62d6986e50be0affd

        SHA256

        ba1346ea33d2c9d045b75592ce50046974aaf474b530fd4c4d16dbf16cbaf815

        SHA512

        92847dfb9be7c658b61063cedaf0f7faa51fc8afe4dae11ab4bdfdeb4ad1f8a976f20901d2d8532a60df5ad528dbd907064889412d14370dd17f5e73289cde69

      • C:\Windows\Logo1_.exe

        Filesize

        26KB

        MD5

        2001b3d40d05330d0c289354fd39c442

        SHA1

        31c0c109110e336da3bdfee62d6986e50be0affd

        SHA256

        ba1346ea33d2c9d045b75592ce50046974aaf474b530fd4c4d16dbf16cbaf815

        SHA512

        92847dfb9be7c658b61063cedaf0f7faa51fc8afe4dae11ab4bdfdeb4ad1f8a976f20901d2d8532a60df5ad528dbd907064889412d14370dd17f5e73289cde69

      • C:\Windows\rundl132.exe

        Filesize

        26KB

        MD5

        2001b3d40d05330d0c289354fd39c442

        SHA1

        31c0c109110e336da3bdfee62d6986e50be0affd

        SHA256

        ba1346ea33d2c9d045b75592ce50046974aaf474b530fd4c4d16dbf16cbaf815

        SHA512

        92847dfb9be7c658b61063cedaf0f7faa51fc8afe4dae11ab4bdfdeb4ad1f8a976f20901d2d8532a60df5ad528dbd907064889412d14370dd17f5e73289cde69

      • F:\$RECYCLE.BIN\S-1-5-21-1873812795-1433807462-1429862679-1000\_desktop.ini

        Filesize

        10B

        MD5

        e0b221b9338753deceb4d4e7a6bf13e8

        SHA1

        56521251ff5aab737b3617dd82eb07df74ad588f

        SHA256

        3e46e7e2c6c9cf629a9230a5b1c5b196f727959b334cbb517641244ec5c4b065

        SHA512

        391e4ed4ed44dc677fd663677cb7e69e4c23e4a3629940e46cf757d812395a7876a93c3568d12e5dd99e06b7068e22397694cf54723efa3f0f5789b9687b5810

      • memory/1196-37-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/1196-19-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/1196-26-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/1196-32-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/1196-41-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/1196-295-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/1196-1084-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/1196-3483-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/1196-9-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/1196-4636-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/4448-0-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/4448-12-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB