Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/11/2023, 16:44

General

  • Target

    54bad935a11a0d5e7a8d12a023c486ca87e310bd1168ecd7bb7f0203218f20a4.exe

  • Size

    292KB

  • MD5

    7aac4fbe5c22841c84e8690a836e46af

  • SHA1

    27e470e94a988e4a6d6bccf8b862d59e66c409d0

  • SHA256

    54bad935a11a0d5e7a8d12a023c486ca87e310bd1168ecd7bb7f0203218f20a4

  • SHA512

    25b6ac5bc1ee8132443c88e0c65069e8eff1314152b4688dfc00ddb75723c16025fb5b9f1af6b29eed78ca9d152912ed57c7b3100bad1f6357a18808738f0d41

  • SSDEEP

    3072:UftffjmNSGNWHDzttk5pLzSMEjF47yctMYTWfYj9DfWxRmY7jyP0ejUl:sVfjmNfNmZtb4wNQBDfWxRvs0ewl

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3292
      • C:\Users\Admin\AppData\Local\Temp\54bad935a11a0d5e7a8d12a023c486ca87e310bd1168ecd7bb7f0203218f20a4.exe
        "C:\Users\Admin\AppData\Local\Temp\54bad935a11a0d5e7a8d12a023c486ca87e310bd1168ecd7bb7f0203218f20a4.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:4088
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2CA.bat
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1780
          • C:\Users\Admin\AppData\Local\Temp\54bad935a11a0d5e7a8d12a023c486ca87e310bd1168ecd7bb7f0203218f20a4.exe
            "C:\Users\Admin\AppData\Local\Temp\54bad935a11a0d5e7a8d12a023c486ca87e310bd1168ecd7bb7f0203218f20a4.exe"
            4⤵
            • Executes dropped EXE
            PID:4728
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2688
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:3312
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
                PID:3116

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

        Filesize

        251KB

        MD5

        533ce215a7c274602dc456ca375cef93

        SHA1

        76c502d7c45eca3fd96f6b04eb850e751bc785dd

        SHA256

        d70c9f73bbeed5cbc0df4a4d14bae68789f84d8092281337d2919322b288ce9c

        SHA512

        09d9dee36c48567921de4b7c31c4a822d5f9ed5e0b1cb0330031b320f40b5ba9b15e89dc37d52561094642c0ff16c14d32e81ed5b1dac06150fefbbd6f3365bf

      • C:\Program Files\7-Zip\7z.exe

        Filesize

        484KB

        MD5

        fd58f71e0890b5a3ac35509793a22fc4

        SHA1

        551de654d702a61a909c4d0d1950b8a4f7e371af

        SHA256

        2196336905b9d8d2cfd886bc18e4f2b9bd503e1a9fa29c66f8390075157f34e8

        SHA512

        682604f8be963b826da1d002d0e7f953255fa26301b3715821df1023ecba66c5aca289ac9ae4acddefd0588e2bd13b921f3bc32b8fb90f00d00bf6ad33ba3fb6

      • C:\Users\Admin\AppData\Local\Temp\$$a2CA.bat

        Filesize

        721B

        MD5

        fac5bb090c2c8ccd3a3140566ffe3ebb

        SHA1

        47657e786de2327f208fba97b8f9d40fc51ed713

        SHA256

        d5a21cbab8d8b2cd481a0be4f18c240d44ae3d0705684d57d82df5969152f80f

        SHA512

        f887fc271f1667d6de402669ecef621bdeb52b8259384e3a5a9530d93fe6b5bd76ad1aea811115e3a25a01ee82471943bd60680602e5d22f6b11ce5e74859233

      • C:\Users\Admin\AppData\Local\Temp\54bad935a11a0d5e7a8d12a023c486ca87e310bd1168ecd7bb7f0203218f20a4.exe

        Filesize

        266KB

        MD5

        b0dcc380e6b5d51460eafeba2a4c0d3b

        SHA1

        1fedbf0b02f7a7ce4149b96ff6b296f81574a7e1

        SHA256

        ebffb0122f9787bf691068614d576a634fdc0c6bb28ba565ecc3d7d49b41001c

        SHA512

        6d098af85eb8e12da482ec6347f4c19a8f75c72cdcfa0885a7a0f5a6b3718417bfdce1009648b9a29e64b61d1b1c5bd76744596f4182816171863fa8b72245d2

      • C:\Users\Admin\AppData\Local\Temp\54bad935a11a0d5e7a8d12a023c486ca87e310bd1168ecd7bb7f0203218f20a4.exe.exe

        Filesize

        266KB

        MD5

        b0dcc380e6b5d51460eafeba2a4c0d3b

        SHA1

        1fedbf0b02f7a7ce4149b96ff6b296f81574a7e1

        SHA256

        ebffb0122f9787bf691068614d576a634fdc0c6bb28ba565ecc3d7d49b41001c

        SHA512

        6d098af85eb8e12da482ec6347f4c19a8f75c72cdcfa0885a7a0f5a6b3718417bfdce1009648b9a29e64b61d1b1c5bd76744596f4182816171863fa8b72245d2

      • C:\Windows\Logo1_.exe

        Filesize

        26KB

        MD5

        ed9c69fcace8a0c07f7596f17c76cd92

        SHA1

        31fe334a5cd033d7688ae7cbf49b78db9f888cec

        SHA256

        0cff4e74e436b6c06ff1c99d2e9a605d6ecc4fcfb6fc20fd3942c19cee76e073

        SHA512

        80a86988ca56652428132faf8169a156d4ce88c7cc7a6c1cc825f120ec8e813d261fcaccdb462969346d690b6c14b60e40bbe421933fc68627fc975b9036ffdf

      • C:\Windows\Logo1_.exe

        Filesize

        26KB

        MD5

        ed9c69fcace8a0c07f7596f17c76cd92

        SHA1

        31fe334a5cd033d7688ae7cbf49b78db9f888cec

        SHA256

        0cff4e74e436b6c06ff1c99d2e9a605d6ecc4fcfb6fc20fd3942c19cee76e073

        SHA512

        80a86988ca56652428132faf8169a156d4ce88c7cc7a6c1cc825f120ec8e813d261fcaccdb462969346d690b6c14b60e40bbe421933fc68627fc975b9036ffdf

      • C:\Windows\rundl132.exe

        Filesize

        26KB

        MD5

        ed9c69fcace8a0c07f7596f17c76cd92

        SHA1

        31fe334a5cd033d7688ae7cbf49b78db9f888cec

        SHA256

        0cff4e74e436b6c06ff1c99d2e9a605d6ecc4fcfb6fc20fd3942c19cee76e073

        SHA512

        80a86988ca56652428132faf8169a156d4ce88c7cc7a6c1cc825f120ec8e813d261fcaccdb462969346d690b6c14b60e40bbe421933fc68627fc975b9036ffdf

      • F:\$RECYCLE.BIN\S-1-5-21-3125601242-331447593-1512828465-1000\_desktop.ini

        Filesize

        10B

        MD5

        7af371ae7aad351d505f1b26382de243

        SHA1

        0a19bf0a1ccfb902a03b3da68bdd289190e62f5f

        SHA256

        4fcc643d52dbc25dd57a011e27cbb0503711cf1a2ad1610a4f9e7b9f17c5bc1b

        SHA512

        1127b9c88de9e2d58f7a512dd52c31bb9d96b0543f13e4cfff59ca2b73e60307538dd9bcd1c480e6d260fe45b44208a5554a5a60e8c2e3da8385b2cdd0e77d3e

      • memory/2688-20-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/2688-27-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/2688-34-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/2688-38-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/2688-42-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/2688-9-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/2688-331-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/2688-1085-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/2688-3088-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/2688-4634-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/4088-0-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/4088-10-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/4728-18-0x0000000000400000-0x0000000000457000-memory.dmp

        Filesize

        348KB