Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    02/02/2024, 23:44

General

  • Target

    VirusShare-0171808505a112da368c02f92fe0f9f9.exe

  • Size

    1.0MB

  • MD5

    0171808505a112da368c02f92fe0f9f9

  • SHA1

    cc9fca798284946358112e6034a3ef74bb4ba046

  • SHA256

    0f6285f95e98d7b40f80a03d2d90b350bdc35b139a2d90338375aa97bd303d86

  • SHA512

    201e5743f0ee6d7e935909c1a1c998e92f7683fccf02127ee2e3e2792ddbe15d33f7796aa6a6b3522b4d694a4e342ebae602b62bab287af0787e594ca3c8a208

  • SSDEEP

    24576:BSuFhCwUuqDluBMfEhJX3z5mKhwbLeoMP:FhxqDosEL3F/w+P

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 13 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\VirusShare-0171808505a112da368c02f92fe0f9f9.exe
    "C:\Users\Admin\AppData\Local\Temp\VirusShare-0171808505a112da368c02f92fe0f9f9.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2236
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "C:\ProgramData\smes\u.bat"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2400
      • C:\ProgramData\smes\smes.exe
        smes.exe -install
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        PID:2708
      • C:\ProgramData\smes\smes.exe
        smes.exe -start
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        PID:2748
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\temg_tmp.bat"
      2⤵
        PID:2768
    • C:\ProgramData\smes\smes.exe
      C:\ProgramData\smes\smes.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2796
      • C:\ProgramData\smes\smes.exe
        C:\ProgramData\smes\smes.exe -run
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:2560

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\kingsoft\kws\kws.ini

      Filesize

      718B

      MD5

      0318d2f94f0145e80c51bfbb3aed769d

      SHA1

      ba8ec32df73b8539eeca46f39e29a4e9af371ea1

      SHA256

      58ea7e766662ed6cd9274313db7824261e16246b2b0d232b973d8e76a1291e43

      SHA512

      00312951c03f6f0caf88d7ad0537c7b29c425d4b4ba08975f2d7a1ac222aa15611488b7fd7b31229aada46d4c0df4d68affe8bdbd860f7aadcaa03e39ead312b

    • C:\ProgramData\smes\KWSSVC.log

      Filesize

      202B

      MD5

      82c928ce93e8a95e9d509875ef658d93

      SHA1

      62b51b1b583acd51d4da1719cf509aa2095b380d

      SHA256

      f8c6b067df3adc0aea0e047d3ac5f99b50bfbabe666e14c97caab78df05ea931

      SHA512

      50bebfdc9dcbcd45075e219207fab371ebf270e21a39d4b6b3c3618c4939a2ff7ba4c10160a895fece4c664a4701c210c614b3dffbbc9b25ef2a8074ef41181e

    • C:\ProgramData\smes\KWSSVC.log

      Filesize

      356B

      MD5

      94a5a50febe111e141832a7189d0e5d1

      SHA1

      0f5ff0a4a088412bec5d1f993ec1d3ced022a7a2

      SHA256

      f50be76d6d0f3871897ff4587f11b6a666579d9f58f9b899485215956e8cb372

      SHA512

      ab6f7baa6baf71036dd0052f7d6e76a1978f6b12294202b5c9c1ac8ff23f80a5c8b0d4a34a73ac75dc3c5e2b78182b022c2e580db0455d52dc749b8000761cea

    • C:\ProgramData\smes\KWSSVC.log

      Filesize

      546B

      MD5

      6910863c811dc2bc90f23e9baa9829be

      SHA1

      5588a18a50c5adbb09a0fa2f9c80e69ab6a4ce91

      SHA256

      ef2010e74a4bcb5dedcc7d1fa8fffbd7e78c3521b85ae7584aa319f7e2277ecc

      SHA512

      3e0cd1efbbfa1915eb95799d43e53cfca9fd68f59f53deeed4dcfdf213abc9a882943089cf395e35537348651f99279c78bb0221048a78be8af4aedf2261fd6b

    • C:\ProgramData\smes\kwssp.dll

      Filesize

      425KB

      MD5

      bf5dcfd9da0514334d41cbd80d2a9138

      SHA1

      802f9e0b82edca56be08a33b2ba874b34c31f1e3

      SHA256

      f9506cf9a87aa6bfbf07f2124f2785a711b27a70839ebb95bdd4b2cf747fb060

      SHA512

      246796f2e201cde30043eaa2c0ffb4d2b3bea2bae97261a022824c31a42d2b08998b1bdcd436e8392bdd153dd6fadf9ba69361c7316a6bfda5d475678b7aa5cc

    • C:\ProgramData\smes\kwsui.dll

      Filesize

      433KB

      MD5

      45199dab51eeece95728abfe25e18f35

      SHA1

      59ab0fe25aa2adc253adbecba6862e7432df1c39

      SHA256

      a22006861cac6a849346282e2f7729deeb8f68bf29f13c15ae33d20311f77391

      SHA512

      825c6ae1f88cec3d6c469e6a15cad0430845ecc8d436777092f4c5fe8ecd02abbfeb3e2a17b2f4896b9d6e4b2d229a8b83bfdda75a3e025fc32f86610c6eef12

    • C:\ProgramData\smes\smes.exe

      Filesize

      209KB

      MD5

      1fa47f5b173cee5ef9c3ee1bda0c321e

      SHA1

      60ee40236f960affb01d569a32e1b05888bb081a

      SHA256

      b21526716068d2a8550780038e2b5ddb843d77890a07ec82ed9ce9dd0be52c64

      SHA512

      01f39376269a75510347fcf66ff2585b25d5e6e10e26b7feefa3af66e712a5f50c62bff6d40abee733e1ce965d17a2e443664838268eb7c7a2e36fc1c024224d

    • C:\ProgramData\smes\u.bat

      Filesize

      44B

      MD5

      704efba1aee1454561da552dda430498

      SHA1

      d20fb96683f769eb9cef1b0a068bcba70aeab9c2

      SHA256

      80b08d35bd27636e0774ce35ab57306f76edc6a0f7058cb1f93733cdf88bf94c

      SHA512

      7e0c9ede686238703af4893af8842c05c48ab1681ae273b32d8085cf1a17aae946c0c823a0a418787522a551d684367259ff8203ebca6e4ec69b6ded95231bd0

    • C:\Users\Admin\AppData\Local\Temp\temg_tmp.bat

      Filesize

      132B

      MD5

      46033bedbd1ac80c4fe77702500364f9

      SHA1

      253cefd2eafccb32b931657d6fac5e555fbab1a5

      SHA256

      3c4af158afae2cd33210a217106f39d57ac5ee4b632186e1e0d69d15f43af18e

      SHA512

      029d61b53854dfe64811df3479fefee35e07fd72b0a5319ddccdf3ff786cc7b238b6252400de49699b27c16e0f0cdfe667fa02885b82b0dcdffa2aad7616209a

    • \ProgramData\smes\kswebshield.dll

      Filesize

      441KB

      MD5

      7851449473178f9782263d51bc5e3bbc

      SHA1

      ad5148ee1bed2348b320c62c025d52fbcbb28799

      SHA256

      c3bc7ec8428f0bb210a0597c9a0cad1be412b7fa46ea006819a3df9ac23118b4

      SHA512

      b01fc37ac84b81df8d7657000295aed7eb50aaf7f13ab2b2be9030c9f83ed1559318c83c78b4a29926d7d30e9eea9538d123ef4a649179be5a5b54ee71ed9b49

    • \Users\Admin\AppData\Local\Temp\nsy823B.tmp\AccessControl.dll

      Filesize

      10KB

      MD5

      055f4f9260e07fc83f71877cbb7f4fad

      SHA1

      a245131af1a182de99bd74af9ff1fab17977a72f

      SHA256

      4209588362785b690d08d15cd982b8d1c62c348767ca19114234b21d5df74ddc

      SHA512

      a8e82dc4435ed938f090f43df953ddad9b0075f16218c09890c996299420162d64b1dbfbf613af37769ae796717eec78204dc786b757e8b1d13d423d4ee82e26

    • \Users\Admin\AppData\Local\Temp\nsy823B.tmp\FindProcDLL.dll

      Filesize

      3KB

      MD5

      8614c450637267afacad1645e23ba24a

      SHA1

      e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2

      SHA256

      0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758

      SHA512

      af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b

    • memory/2236-5-0x0000000010000000-0x0000000010003000-memory.dmp

      Filesize

      12KB

    • memory/2560-55-0x0000000001CD0000-0x0000000001D41000-memory.dmp

      Filesize

      452KB