Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

7

993dce8e99...c6.exe

windows7-x64

7

993dce8e99...c6.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    139s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/02/2024, 10:56 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    993dce8e99765166d85c5049951f52c6.exe

  • Size

    86KB

  • MD5

    993dce8e99765166d85c5049951f52c6

  • SHA1

    1ff33f44c6f4179ca4dfceeedc6dbd10259bf325

  • SHA256

    de997cabab2bda1334d129112199ba780d250dd923db4b4035def25755df8200

  • SHA512

    0f1ebf2b075f3b045fd7885eba700ed82fb67055401e500753138083201a1d36bf3ef9c06dff18802fed6c15b2b33167f44b58aa9aae279c3439baaffc976d2a

  • SSDEEP

    1536:kuMyiWMPfQSiy6kWLVvBOQ+ptrblnouy8:5SW+fQSIkQVv8QGJ9out

Score
7/10
upx

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\993dce8e99765166d85c5049951f52c6.exe
    "C:\Users\Admin\AppData\Local\Temp\993dce8e99765166d85c5049951f52c6.exe"
    1⤵
    • Enumerates connected drives
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1608
    • C:\Windows\SysWOW64\SiZhu.exe
      C:\Windows\system32\SiZhu.exe SiZhu
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4092
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~SiGou.bat
        3⤵
          PID:3816
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~SiGou.bat
        2⤵
          PID:4956

      Network

      • flag-us
        DNS
        www.haorenjia11.cn
        993dce8e99765166d85c5049951f52c6.exe
        Remote address:
        8.8.8.8:53
        Request
        www.haorenjia11.cn
        IN A
        Response
      • flag-us
        DNS
        180.178.17.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        180.178.17.96.in-addr.arpa
        IN PTR
        Response
        180.178.17.96.in-addr.arpa
        IN PTR
        a96-17-178-180deploystaticakamaitechnologiescom
      • flag-us
        DNS
        209.205.72.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        209.205.72.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        6.181.190.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        6.181.190.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        95.221.229.192.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        95.221.229.192.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        97.17.167.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        97.17.167.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        154.239.44.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        154.239.44.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        183.59.114.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        183.59.114.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        56.126.166.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        56.126.166.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        18.134.221.88.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        18.134.221.88.in-addr.arpa
        IN PTR
        Response
        18.134.221.88.in-addr.arpa
        IN PTR
        a88-221-134-18deploystaticakamaitechnologiescom
      • flag-us
        DNS
        194.178.17.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        194.178.17.96.in-addr.arpa
        IN PTR
        Response
        194.178.17.96.in-addr.arpa
        IN PTR
        a96-17-178-194deploystaticakamaitechnologiescom
      • flag-us
        DNS
        14.227.111.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        14.227.111.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        90.16.208.104.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        90.16.208.104.in-addr.arpa
        IN PTR
        Response
      No results found
      • 8.8.8.8:53
        www.haorenjia11.cn
        dns
        993dce8e99765166d85c5049951f52c6.exe
        64 B
         117 B
         1
        1

        DNS Request

        www.haorenjia11.cn

      • 8.8.8.8:53
        180.178.17.96.in-addr.arpa
        dns
        72 B
         137 B
         1
        1

        DNS Request

        180.178.17.96.in-addr.arpa

      • 8.8.8.8:53
        209.205.72.20.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        209.205.72.20.in-addr.arpa

      • 8.8.8.8:53
        6.181.190.20.in-addr.arpa
        dns
        71 B
         157 B
         1
        1

        DNS Request

        6.181.190.20.in-addr.arpa

      • 8.8.8.8:53
        95.221.229.192.in-addr.arpa
        dns
        73 B
         144 B
         1
        1

        DNS Request

        95.221.229.192.in-addr.arpa

      • 8.8.8.8:53
        97.17.167.52.in-addr.arpa
        dns
        71 B
         145 B
         1
        1

        DNS Request

        97.17.167.52.in-addr.arpa

      • 8.8.8.8:53
        154.239.44.20.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        154.239.44.20.in-addr.arpa

      • 8.8.8.8:53
        183.59.114.20.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        183.59.114.20.in-addr.arpa

      • 8.8.8.8:53
        56.126.166.20.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        56.126.166.20.in-addr.arpa

      • 8.8.8.8:53
        18.134.221.88.in-addr.arpa
        dns
        72 B
         137 B
         1
        1

        DNS Request

        18.134.221.88.in-addr.arpa

      • 8.8.8.8:53
        194.178.17.96.in-addr.arpa
        dns
        72 B
         137 B
         1
        1

        DNS Request

        194.178.17.96.in-addr.arpa

      • 8.8.8.8:53
        14.227.111.52.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        14.227.111.52.in-addr.arpa

      • 8.8.8.8:53
        90.16.208.104.in-addr.arpa
        dns
        72 B
         146 B
         1
        1

        DNS Request

        90.16.208.104.in-addr.arpa

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\~SiGou.bat
        Filesize

        130B

        MD5

        05f52e759c787bfbf843ba36ccf734a2

        SHA1

        2d81a279dd24a320a62d184fec747ca5f70570ee

        SHA256

        4c9b671f2169b55c0265974d2d618e9e03060a0664da88c05ea580be9eb2a7a9

        SHA512

        efcbce3fbcb8a0e22d4b41bfcf7afe73e5dd1bf4ceded4892fdd060e993dcf7c3930c989b6eb4fe1b690ced1f70a0e9ef75dfe6b5e2a61f9be14ef9169c6d172

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\~SiGou.bat
        Filesize

        212B

        MD5

        35c88858eb2492deb15d19f51e685c4a

        SHA1

        e3ace5f65b36afb0d7b440512064c4996109d043

        SHA256

        1728d38596a01364d3a8627dadc3d7b89da23df98be7a41b29667d6de90dfed0

        SHA512

        bb583503a0184509c35630ea0f4868523b15706ecc700cbd701052154f8c0a5dca4b5230a28019b88c4500dec082980c637ba370c806a08c2c854198fade6449

        Download Submit

      • C:\Windows\SysWOW64\SiZhu.exe
        Filesize

        86KB

        MD5

        993dce8e99765166d85c5049951f52c6

        SHA1

        1ff33f44c6f4179ca4dfceeedc6dbd10259bf325

        SHA256

        de997cabab2bda1334d129112199ba780d250dd923db4b4035def25755df8200

        SHA512

        0f1ebf2b075f3b045fd7885eba700ed82fb67055401e500753138083201a1d36bf3ef9c06dff18802fed6c15b2b33167f44b58aa9aae279c3439baaffc976d2a

        Download Submit

      • memory/1608-0-0x0000000000400000-0x0000000000429000-memory.dmp

        Filesize

        164KB

        Download

      • memory/1608-14-0x0000000000400000-0x0000000000429000-memory.dmp

        Filesize

        164KB

        Download

      • memory/4092-13-0x0000000000400000-0x0000000000429000-memory.dmp

        Filesize

        164KB

        Download

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.