Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    18/02/2024, 09:39

General

  • Target

    a30d02353f12750de0cef614b676478c2a25bd7463f5af704d1e2cee43c7b6b5.exe

  • Size

    250KB

  • MD5

    e2213852fc8a351313125454150660fd

  • SHA1

    3ccc1537d29fd2f70b45cb658a2b5409da55273a

  • SHA256

    a30d02353f12750de0cef614b676478c2a25bd7463f5af704d1e2cee43c7b6b5

  • SHA512

    50c6cc3557a3aa0cbcbe45093669f29efa527ecba8879253a2b8eb0c369a7795de6b021b7e222f7e03b6d1003d5f30fb4838200743654d08a2953d333aeda373

  • SSDEEP

    3072:UftffjmNR1KwhdmWWKp9pSVLCDJGhyBw948qNYpWdunn4rSpYKOQwq:sVfjmN/Kwhdt9t8LLyBw948kwn4WpgN

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1216
      • C:\Users\Admin\AppData\Local\Temp\a30d02353f12750de0cef614b676478c2a25bd7463f5af704d1e2cee43c7b6b5.exe
        "C:\Users\Admin\AppData\Local\Temp\a30d02353f12750de0cef614b676478c2a25bd7463f5af704d1e2cee43c7b6b5.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:1268
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c C:\Users\Admin\AppData\Local\Temp\$$aEEF.bat
          3⤵
          • Deletes itself
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:2728
          • C:\Users\Admin\AppData\Local\Temp\a30d02353f12750de0cef614b676478c2a25bd7463f5af704d1e2cee43c7b6b5.exe
            "C:\Users\Admin\AppData\Local\Temp\a30d02353f12750de0cef614b676478c2a25bd7463f5af704d1e2cee43c7b6b5.exe"
            4⤵
            • Executes dropped EXE
            PID:2540
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2600
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2620
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
                PID:2916

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

        Filesize

        251KB

        MD5

        99c8f62c614e57d982794cb60ed34dd3

        SHA1

        ae21b94005dffc23085bfa84938011703cf62341

        SHA256

        6c8a8a5c788ca6330693c0be9a11a630a7cccfab9a1c2d8270ed9624eb9b4cd3

        SHA512

        8db3d0754d569b05d9eeba2e83630f0b94d87b809d9918294b8b8920f4ddc4591b08fe3759dad966216174cc308fb7850d84e1b5e6ac17415c6df70b52f871a2

      • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

        Filesize

        471KB

        MD5

        99ea9b604a7a734d3087fa6159684c42

        SHA1

        709fa1068ad4d560fe03e05b68056f1b0bedbfc8

        SHA256

        3f733f9e6fec7c4165ca8ba41eb23f604a248babe794c4ad2c6c3ce8032aab1c

        SHA512

        7af8008c7e187f925c62efc97e1891a7a38d089302dba39fbde137fb895e0592847ed0982c824c2075be8e6b95b6ce165ecb848ab85adf53779ebef613410fbb

      • C:\Users\Admin\AppData\Local\Temp\$$aEEF.bat

        Filesize

        721B

        MD5

        e837f7e7894d289c935fa3c774366574

        SHA1

        3dae71367115fea88c6a8b1302123561f7780143

        SHA256

        cf00e72a816ed7d5197a8b87132c0b63481b4dbbccd5a4ab164b9985f48bd195

        SHA512

        ca28fafe4df4e66f93e739560f8a57a31fb1cd4fc2f87ea9c005841d8c0f8431290758a9c926e93b0181e4b4116a9b2df2a5be1568f80e469e99da5803d95c99

      • C:\Users\Admin\AppData\Local\Temp\a30d02353f12750de0cef614b676478c2a25bd7463f5af704d1e2cee43c7b6b5.exe.exe

        Filesize

        224KB

        MD5

        7c0ffab1bad3ca02411a7044b11577fa

        SHA1

        70c83e69d16ce603eef0150670e2d412b5891433

        SHA256

        52f7c5e40477df6ca3e7a82eab1ae2cc570f7891daeb124649970a1e508d61f0

        SHA512

        0cf2cc7b522b7b12224b79a05a622b13607d5a0d6afee22b92129a68896c20cbd80c06588ece95bf55a1054b05454ac3a989b109c6c73e832a5c3c2b5c4c8e2e

      • C:\Windows\Logo1_.exe

        Filesize

        26KB

        MD5

        d2a8721a9ab0785cc63008221bed7014

        SHA1

        b3b61e2dfe21e53c998bae3626cd51babf43ef2c

        SHA256

        6a54a916b9c41f2aae07186bd293005cd3af983bd85039d4a03b13acca905ccb

        SHA512

        b6f049f934951051bfc226a43ce3e957d22d44ad15e057b009e76d07f9f00a63c1d4411c77362db7ace866c0d99e46ee9fb56ae810683d783436b4e972c744e0

      • F:\$RECYCLE.BIN\S-1-5-21-2248906074-2862704502-246302768-1000\_desktop.ini

        Filesize

        9B

        MD5

        9eb559d99f8f10c8af6f6d1c5624b40d

        SHA1

        6bd3c9c30ab64be20819ce184dfeb093f664ec68

        SHA256

        60748c106f2d8f06a3c713e00fab9fc8fd7bd9938dc4f8ee91317dcaaf1bc881

        SHA512

        7f7a165bbddce5030f223b60a6f968a30458f7be999e6374ae52d4723dbb24ff571a7db89410ce516b17f535b278da436ed35710dab7c8ec1c18b12278ad1e62

      • memory/1216-31-0x0000000002DE0000-0x0000000002DE1000-memory.dmp

        Filesize

        4KB

      • memory/1268-16-0x0000000000350000-0x0000000000384000-memory.dmp

        Filesize

        208KB

      • memory/1268-18-0x0000000000350000-0x0000000000384000-memory.dmp

        Filesize

        208KB

      • memory/1268-15-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/1268-0-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/2600-46-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/2600-19-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/2600-92-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/2600-98-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/2600-642-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/2600-1851-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/2600-2345-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/2600-40-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/2600-3311-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/2600-33-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB