Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    21/02/2024, 15:47

General

  • Target

    a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe

  • Size

    93KB

  • MD5

    97517e1998bd7e881101a01efe0b4c68

  • SHA1

    79b7b6159779aa9d4e09e55d08e5bbefbceac788

  • SHA256

    a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3

  • SHA512

    7d0ddb4e6bbaf2aac5d8de86c2c269ffa5effd4cdcc2b8ce49f48ed2182413a90fa62205daf6815064e52ca6d5f2758719ea6783e0cd9ba555594ad8b84d1634

  • SSDEEP

    1536:cAsxN92ppTSahtA3AWHB0UxMkzOt7HcvJGt5AdHIOWnToIf12Z9:cfNIv7MwWhAWJGSCTBf12Z9

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 43 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1272
      • C:\Users\Admin\AppData\Local\Temp\a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe
        "C:\Users\Admin\AppData\Local\Temp\a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3048
        • C:\Windows\SysWOW64\net.exe
          net stop "Kingsoft AntiVirus Service"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3068
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
            4⤵
              PID:2140
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c C:\Users\Admin\AppData\Local\Temp\$$aA248.bat
            3⤵
            • Deletes itself
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:2764
            • C:\Users\Admin\AppData\Local\Temp\a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe
              "C:\Users\Admin\AppData\Local\Temp\a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe"
              4⤵
              • Executes dropped EXE
              PID:2724
          • C:\Windows\Logo1_.exe
            C:\Windows\Logo1_.exe
            3⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2164
            • C:\Windows\SysWOW64\net.exe
              net stop "Kingsoft AntiVirus Service"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:2732
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                5⤵
                  PID:2856
              • C:\Windows\SysWOW64\net.exe
                net stop "Kingsoft AntiVirus Service"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:2584
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                  5⤵
                    PID:2736

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

            Filesize

            108KB

            MD5

            003f5729d264f6604effd8c07b7eb1a5

            SHA1

            fd8b89c487f048985fa703ed68367532a406eec7

            SHA256

            6e2d8b0c6e9be5fdeac0a81dc0820691500643aec80061e674981136bbabef9a

            SHA512

            60b408dcb586d9a3a1553697fba435ac15c8a3780ae05c792db9c4baea0b9479c95daf79e35b1cb7629908a25ef9fbeb6c50249d16b1641e6cab5e2b190f1e87

          • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

            Filesize

            478KB

            MD5

            85bfd80e5e2a61689d1273c6efa51ccc

            SHA1

            8ae8a160124cc56983f24a933fbecdac08da435a

            SHA256

            892cf1575e0cc60639951f9a5a37323f3ca7d06f335e8a39635c3b858596ea3c

            SHA512

            96dd851f4d17a65aa6dfddfdc134a46d30b0417451b4c4b31092b66056cae59302d49b706294547e5766e347dc368ff4bd176d90376c5e2ad5c7a52aa8718a79

          • C:\Users\Admin\AppData\Local\Temp\$$aA248.bat

            Filesize

            722B

            MD5

            28316969f0feda37fd55b312eb2bc938

            SHA1

            ea00ab0378380fa580e818d855c18d74846d97ce

            SHA256

            7986a745d887fa0e023c0f13fa91adc98a4ff15aa42de857133e40c93ea45db8

            SHA512

            4eacbd3c6c5fcd32afc9153e615a799c5938daab5e3f6702c00b4a30205829e0654a1c7cf65e32f908b63f9b069f7fa511191b7779fdea115e3d64c64cf8e974

          • C:\Users\Admin\AppData\Local\Temp\a65f123243d3b3f1a67fe7e1c1e8b13f139d9bdadfacf102bc8760cc33b243c3.exe.exe

            Filesize

            60KB

            MD5

            ed0fde686788caec4f2cb1ec9c31680c

            SHA1

            81ae63b87eaa9fa5637835d2122c50953ae19d34

            SHA256

            e362670f93cdd952335b1a41e5529f184f2022ea4d41817a9781b150b062511c

            SHA512

            d90d5e74a9be23816a93490ed30c0aae9f7f038a42bd14aa2ce78e95967b4aabd848f006f00ade619c9976755658d45aa0f5b6d5babbbb2d59a6ed3a3a12ac6b

          • C:\Windows\Logo1_.exe

            Filesize

            33KB

            MD5

            74de944429af39f54ac31888ee07b892

            SHA1

            7c05f329379c5a396dbdf1e3857f59734eeaaf07

            SHA256

            22a484df9625b0a17e2e7b65945360f0b031ec1bea68fb96d3553d07ab354f52

            SHA512

            d4a8d643b207e1742071a11b05b3044c0750849f767ecbecb5e957d1df1bc95a312a0a595c7c34cc8a09523ef25deac47fddb4801735bcff6087879ef8d10fd7

          • F:\$RECYCLE.BIN\S-1-5-21-3427588347-1492276948-3422228430-1000\_desktop.ini

            Filesize

            9B

            MD5

            62b5f4cbf35e0811170865d2c1b514b0

            SHA1

            eb9ab8cea4d5052efe5126141140269f2fc29e7b

            SHA256

            0c2b516efab7a741c31502cb6f7828de32cd4feb088b683d651225489f183bb3

            SHA512

            4632536c26324e72b20e87d53546ea1d012bc1f3457ce5d8e1b33dd3eebc41ad5e4a3d3f6a3a542d7ce103f95ca5a5a1973c6c036980f1e8860c6c5d93c5696f

          • memory/1272-28-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

            Filesize

            4KB

          • memory/2164-32-0x0000000000400000-0x0000000000440000-memory.dmp

            Filesize

            256KB

          • memory/2164-1318-0x0000000000400000-0x0000000000440000-memory.dmp

            Filesize

            256KB

          • memory/2164-19-0x0000000000400000-0x0000000000440000-memory.dmp

            Filesize

            256KB

          • memory/2164-4082-0x0000000000400000-0x0000000000440000-memory.dmp

            Filesize

            256KB

          • memory/3048-15-0x0000000000260000-0x00000000002A0000-memory.dmp

            Filesize

            256KB

          • memory/3048-0-0x0000000000400000-0x0000000000440000-memory.dmp

            Filesize

            256KB

          • memory/3048-16-0x0000000000400000-0x0000000000440000-memory.dmp

            Filesize

            256KB