Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    153s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/11/2023, 15:52

General

  • Target

    3a9e8369a177a1ed90e1f50bea862286666d00a5b2fe2f01f4c0b53c66d9a888.exe

  • Size

    203KB

  • MD5

    bd301c11fa85dca192e868fcc640351b

  • SHA1

    29bbb52634027378cc92382508c7bcb07f17fb03

  • SHA256

    3a9e8369a177a1ed90e1f50bea862286666d00a5b2fe2f01f4c0b53c66d9a888

  • SHA512

    f691ee9a80495cb1739a77b0b47d8d6a63068b15d7e93a8c073076f62056f1f2ecc451c849e1b10708f7d39fcf9ea765c0e6f7ea5ed4af53bc9839ff265c3362

  • SSDEEP

    3072:wsftffjmNrZgxhlhGeJJrJsQ+qHcNL6LyZI6nQpL4jRXFiOkg3kLcm5LUlJ9t:3VfjmNefnCM9yZVnQpLuNEbLc0UL9t

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3380
      • C:\Users\Admin\AppData\Local\Temp\3a9e8369a177a1ed90e1f50bea862286666d00a5b2fe2f01f4c0b53c66d9a888.exe
        "C:\Users\Admin\AppData\Local\Temp\3a9e8369a177a1ed90e1f50bea862286666d00a5b2fe2f01f4c0b53c66d9a888.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:3404
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a945B.bat
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3264
          • C:\Users\Admin\AppData\Local\Temp\3a9e8369a177a1ed90e1f50bea862286666d00a5b2fe2f01f4c0b53c66d9a888.exe
            "C:\Users\Admin\AppData\Local\Temp\3a9e8369a177a1ed90e1f50bea862286666d00a5b2fe2f01f4c0b53c66d9a888.exe"
            4⤵
            • Executes dropped EXE
            PID:2296
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3096
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:4780
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
                PID:1648

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files\7-Zip\7z.exe

        Filesize

        484KB

        MD5

        26ad1955e49c77461922b8167b40178b

        SHA1

        edad5fd8dc1b6d7c5075e293764fea4297a2e3e6

        SHA256

        8e2ecb63e3e5c25092fa0bd05abae885774fdbb58b5ec0b9ace93fd11b81f79d

        SHA512

        48dd7a625fa33b8da6f41980c0d09395a4e4d3a89e64b9c3657ce46abb1417344d5132ac4963ed1cb0ddc31483d283e00f021029a4d4400287ce3f25e1656c5e

      • C:\Users\Admin\AppData\Local\Temp\$$a945B.bat

        Filesize

        722B

        MD5

        134b14ce9f927dfdbd8a445126473556

        SHA1

        f2026a401081d62d20a268cdeab5dfce51f546b3

        SHA256

        df4fe5f00b233244a61849eb9710a61a7ba79600776535ab0e8d9c8eaa5d7de1

        SHA512

        b2b10094200145826138246378ab2f16b9805b1538679c12dcbd6f62824e66d2900d510f47120397de2c3495d3e9db75cedd808d8b41ff214d053c7fe91a53e1

      • C:\Users\Admin\AppData\Local\Temp\3a9e8369a177a1ed90e1f50bea862286666d00a5b2fe2f01f4c0b53c66d9a888.exe

        Filesize

        177KB

        MD5

        38ced7c7dca88182d3d8e02aaa889338

        SHA1

        c702b28c7b267d6034cd06ebfc2e7b10b6700aa9

        SHA256

        8b8bfe9d542b109edd6418d5679187abc1074e0c0f090c7ada0c608ce868d353

        SHA512

        473ccf1f9b3265c192384140a48bef06a65105ab1f7d63a274a0e06487aea477206514bce1258a3bd0b74329dd2b678c71028d6eee166a1a497dd42deaabf70d

      • C:\Users\Admin\AppData\Local\Temp\3a9e8369a177a1ed90e1f50bea862286666d00a5b2fe2f01f4c0b53c66d9a888.exe.exe

        Filesize

        177KB

        MD5

        38ced7c7dca88182d3d8e02aaa889338

        SHA1

        c702b28c7b267d6034cd06ebfc2e7b10b6700aa9

        SHA256

        8b8bfe9d542b109edd6418d5679187abc1074e0c0f090c7ada0c608ce868d353

        SHA512

        473ccf1f9b3265c192384140a48bef06a65105ab1f7d63a274a0e06487aea477206514bce1258a3bd0b74329dd2b678c71028d6eee166a1a497dd42deaabf70d

      • C:\Windows\Logo1_.exe

        Filesize

        26KB

        MD5

        4f6b7b7dd1e90f9968e5197d34085d7c

        SHA1

        e49e73e61aede77f897b3be38716b22a9ed86e37

        SHA256

        c203da2bf8f27304bf94615ee5c238a6fefed6c557aaf65869306f68955756bf

        SHA512

        4225a9c7c3cd1092ca2215fd915a1bd7cd5cc3f4bc8ffb83909f2a9a0b70b2b08281ae2b9f7302cbc5e4282d0ecf94654e4ce8538218b504fee05ff7b4834da2

      • C:\Windows\Logo1_.exe

        Filesize

        26KB

        MD5

        4f6b7b7dd1e90f9968e5197d34085d7c

        SHA1

        e49e73e61aede77f897b3be38716b22a9ed86e37

        SHA256

        c203da2bf8f27304bf94615ee5c238a6fefed6c557aaf65869306f68955756bf

        SHA512

        4225a9c7c3cd1092ca2215fd915a1bd7cd5cc3f4bc8ffb83909f2a9a0b70b2b08281ae2b9f7302cbc5e4282d0ecf94654e4ce8538218b504fee05ff7b4834da2

      • C:\Windows\rundl132.exe

        Filesize

        26KB

        MD5

        4f6b7b7dd1e90f9968e5197d34085d7c

        SHA1

        e49e73e61aede77f897b3be38716b22a9ed86e37

        SHA256

        c203da2bf8f27304bf94615ee5c238a6fefed6c557aaf65869306f68955756bf

        SHA512

        4225a9c7c3cd1092ca2215fd915a1bd7cd5cc3f4bc8ffb83909f2a9a0b70b2b08281ae2b9f7302cbc5e4282d0ecf94654e4ce8538218b504fee05ff7b4834da2

      • F:\$RECYCLE.BIN\S-1-5-21-3125601242-331447593-1512828465-1000\_desktop.ini

        Filesize

        9B

        MD5

        a496dc6e67a7c97fe6b5f93f052c5de1

        SHA1

        91d1cbd786e4ca543f5d364b42273efd1be384c5

        SHA256

        f656a696c47b2c37afecab6674210ad082849577f4763b778f81ca947bef3e63

        SHA512

        850c4fe29e0fa3388cb06d91a85330c1ac5eed337d23d2b6ee3d74142941dba27a49485ecf4a8cc73800c8c22d207b6586447ee3b20443f9a0e355614a6a1cb2

      • memory/3096-21-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/3096-10-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/3096-22-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/3096-30-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/3096-36-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/3096-41-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/3096-45-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/3096-111-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/3404-2-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/3404-0-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/3404-16-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/3404-1-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB