Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/02/2024, 18:40

General

  • Target

    130608a012b4f2a0530f03c514ee98970af2d8a5b59ce4df65131497f9a5a19b.exe

  • Size

    508KB

  • MD5

    4f928378218475436eb1dd16f6c61e5f

  • SHA1

    69f1ddc875ed2b943da2fac852772e4f95f66e1c

  • SHA256

    130608a012b4f2a0530f03c514ee98970af2d8a5b59ce4df65131497f9a5a19b

  • SHA512

    e13debaa71a2ebb4abfd4d19c55f132609e85aa53421691c22198fcffb78ffcdd06c8d2e0ba694acc08f0899b006ead63377ef36b646defda45cf73e8a1e8593

  • SSDEEP

    12288:G7++0rrQQkFFP4oOJmqpwjy9oQNDbOpxozwzgA:G7q/kf0w9QofoSgA

Score
8/10

Malware Config

Signatures

  • Manipulates Digital Signatures 1 TTPs 1 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 6 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3108
      • C:\Users\Admin\AppData\Local\Temp\130608a012b4f2a0530f03c514ee98970af2d8a5b59ce4df65131497f9a5a19b.exe
        "C:\Users\Admin\AppData\Local\Temp\130608a012b4f2a0530f03c514ee98970af2d8a5b59ce4df65131497f9a5a19b.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:5092
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a687E.bat
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4524
          • C:\Users\Admin\AppData\Local\Temp\130608a012b4f2a0530f03c514ee98970af2d8a5b59ce4df65131497f9a5a19b.exe
            "C:\Users\Admin\AppData\Local\Temp\130608a012b4f2a0530f03c514ee98970af2d8a5b59ce4df65131497f9a5a19b.exe"
            4⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious use of WriteProcessMemory
            PID:1592
            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ie6wzd.exe
              C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ie6wzd.exe /S:"C:\Users\Admin\AppData\Local\Temp\130608a012b4f2a0530f03c514ee98970af2d8a5b59ce4df65131497f9a5a19b.exe"
              5⤵
              • Manipulates Digital Signatures
              • Executes dropped EXE
              • Drops file in Windows directory
              PID:636
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4820
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:4444
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
                PID:2008

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

        Filesize

        251KB

        MD5

        e17f1558896b0e5ccfcf63f8cee6844e

        SHA1

        14cc84a3e4ad72a68bd7d7e8c7e18d43386a404f

        SHA256

        7acb42694f825f21fd667d04f387742e16bfe62ca9fe2763cb90a8e0f3cc5214

        SHA512

        bcd88ff774ee00127ba1b494f480004c96a831dfe8c1cebd52283b03afa9a0ced583bf3eec0c2076b441710cfe5245f2d885c4b9ea7d2118f6f9f7e4682e9a19

      • C:\Program Files\7-Zip\7z.exe

        Filesize

        570KB

        MD5

        179eb66f94fc3e6199bc65cdcd2b3b54

        SHA1

        2d3ce2f05ebed0510a44994db41f9d30e600e50a

        SHA256

        5724de281d0800e3be1078df8cc0f84cdc082967fad447907938bc470be8f3c8

        SHA512

        de994daf325c17b5e7a13b0bbc96ed02bd779ce3bdeb863731655ae3695b547b150afef2e752abed8efed56dfeb022aa7cc4569de413f329713d9812664ad89f

      • C:\Users\Admin\AppData\Local\Temp\$$a687E.bat

        Filesize

        722B

        MD5

        da28103c07a7d59f4750699d69af2fef

        SHA1

        a3ca7c993983da160ac7e573aab8546b036d722c

        SHA256

        d88a84d8c8dee51478887ba1892a820f792597504f2f2f91049dbecfe5cc2c4c

        SHA512

        5ae6b0791db7f6f75822f197500b3231cccd2f581fdf8a6f10e9f0412028929d6f24694ae2b0fd82e7045ffab971a3f67d361111638de5a516b61c8efb1467fc

      • C:\Users\Admin\AppData\Local\Temp\130608a012b4f2a0530f03c514ee98970af2d8a5b59ce4df65131497f9a5a19b.exe.exe

        Filesize

        482KB

        MD5

        a17e555c4d2501ee5213b4291d82700a

        SHA1

        6dbd04161f0953383178eb0951f8b288223e0813

        SHA256

        d872478e227f665161940dd96ab1ea43799adf95b38aea7bfbf6af4781a1d091

        SHA512

        08b06c49e65195c6f544d33c213b132538dd5b2f3c823bfffafccfb36c9543e15b0cc9664fa5570f157a181c9f03acf9e58f28e18f28c9a1193fb1fcdd64b94e

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\GLOBE.ANI

        Filesize

        6KB

        MD5

        f3525c9c46c7f01433424e8aa4d0eb7e

        SHA1

        b0faf41ef1e211e73a3d8bb1f26df609e68e12f9

        SHA256

        0c713d5db713333de26a82230c9aa4adb28e4451363a8a37cbfcbb4c6aee84b5

        SHA512

        8df3ff17273fb60e6ce71128eab0cf1fcba69421f3622b443e210d43f6005e5b51523c68e81ac384f8c3202a6d023a592ec51d4238c8c1d0fb371ba335aa4522

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\IESetup.inf

        Filesize

        11KB

        MD5

        90967e30dcd802a520b72e01a7a13afc

        SHA1

        d21e7938dfa8d1be182e633a8a6fd6ef7dd84081

        SHA256

        7ceb01f567eb1583c4c064a0fe06dceb97d21704d6c28ffc023fbc2ab32f7357

        SHA512

        8d7dd0ef0e08415c6109746929e99505f752df07a7e86d5960400a15005358101c2537a493cada09bff4f0243a89918c3882fd8274467e0f024975441f85b809

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\advpack.dll

        Filesize

        89KB

        MD5

        5f643aa069a7dd09ac3102f515abfdbc

        SHA1

        7f93f5b03504071a7e6125a8b93a3d8b143621b1

        SHA256

        b027481de47026961ebe58a7e7fa3fb711fe5cf2bf053196af62f70f1979cdac

        SHA512

        d6b7b5732858a718334a64728a268432526093dd752951ed0cde2313e5c6495505d7cd76130831c4714d8def6ab47645df22938245f87880b3f1dcde2d0fb09b

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ie6wzd.exe

        Filesize

        184KB

        MD5

        fe7c4f4f6e2c9fd0b3dd5308ac1e93b0

        SHA1

        2908ad1f27f580b450075feaf78e9a9ac69b6d52

        SHA256

        4c110e385f5245c3eb49864dd31a7663e81de6d7ea32a02265c264e5a29969f2

        SHA512

        82a9a4ac052c6c2efc1ee98802372e511943aaf0a9c6a5efa795bdd1beabac75eef46408449a72f2f78ef716a65de204f98e73778257879aaaa5c2ec7d649d44

      • C:\Windows\Logo1_.exe

        Filesize

        26KB

        MD5

        dae2367df693aba4bfb4a9c6c3b933ad

        SHA1

        61a4bc9a889005b2880f4e96f0204e2be59a76ef

        SHA256

        7ce6003aef7da57e260e5123acc85287428c7cae84ef5073a1e09baf12220de6

        SHA512

        e3dfb5d7cfc67ee195c4f62e4b131e62a2cddef65cc7445d68270bffb931ad7924a9907329181ed67865420818fa2af6895a9ebf2236a3db746c3951a71f0c5c

      • F:\$RECYCLE.BIN\S-1-5-21-2828415587-3732861812-1919322417-1000\_desktop.ini

        Filesize

        9B

        MD5

        d69146fa3f15be895e219a620fdd153b

        SHA1

        fa21485227046ccf2d7638b4236f749862dd4b64

        SHA256

        406651396485eef0c407fc8241aeaa805a311294cdf7abb18ca20e8540694652

        SHA512

        b0509216c0bd6ad432374c98f3fc2f2919d9353e4bccf510b20e0cbbf8a0fdf77ccdeff786df0305f83f22865794cc675537e51de5a1478fc8431999566701c0

      • memory/4820-99-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/4820-106-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/4820-113-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/4820-117-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/4820-121-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/4820-12-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/4820-412-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/4820-1245-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/4820-4798-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/5092-0-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/5092-8-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB