Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
12/03/2024, 18:07
General
-
Target
d2d723a89afee709e86eef8a140625b84ca7926c7a49826c75cd4963d821df03.exe
-
Size
340KB
-
MD5
758b274ef374e88dde853065014f595b
-
SHA1
9ef6a663d02365ce550fb8fce254e0d3d5acb71b
-
SHA256
d2d723a89afee709e86eef8a140625b84ca7926c7a49826c75cd4963d821df03
-
SHA512
a9ec5ec1950f380eb4a4240035280d90b76f042836cbcb45c4839b667edb00d7a5daea6f4bcb3321162e66cdf1c87f2d459a7e4acb15fe29e79d29cc8bcb2c6e
-
SSDEEP
3072:xftffjmNOCSjGoLpWM6VbBVjxyZ2wuhttQyrftffjmNOCSjGoLpWM6VbBVjxyZ2N:5VfjmNAXq1V599VfjmNAXq1V59a0Jal
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs
-
Drops file in Drivers directory 2 IoCs
-
Executes dropped EXE 6 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 11 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 50 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\d2d723a89afee709e86eef8a140625b84ca7926c7a49826c75cd4963d821df03.exe"C:\Users\Admin\AppData\Local\Temp\d2d723a89afee709e86eef8a140625b84ca7926c7a49826c75cd4963d821df03.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4EEB.bat3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d2d723a89afee709e86eef8a140625b84ca7926c7a49826c75cd4963d821df03.exe"C:\Users\Admin\AppData\Local\Temp\d2d723a89afee709e86eef8a140625b84ca7926c7a49826c75cd4963d821df03.exe"4⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a545A.bat5⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d2d723a89afee709e86eef8a140625b84ca7926c7a49826c75cd4963d821df03.exe"C:\Users\Admin\AppData\Local\Temp\d2d723a89afee709e86eef8a140625b84ca7926c7a49826c75cd4963d821df03.exe"6⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a54B7.bat7⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d2d723a89afee709e86eef8a140625b84ca7926c7a49826c75cd4963d821df03.exe"C:\Users\Admin\AppData\Local\Temp\d2d723a89afee709e86eef8a140625b84ca7926c7a49826c75cd4963d821df03.exe"8⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"9⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a595B.bat9⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d2d723a89afee709e86eef8a140625b84ca7926c7a49826c75cd4963d821df03.exe"C:\Users\Admin\AppData\Local\Temp\d2d723a89afee709e86eef8a140625b84ca7926c7a49826c75cd4963d821df03.exe"10⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\startup.bat"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\startup.bat"11⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
-
-
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
-
-
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD5587a94faadffb3e35b9c22cd224cccb8
SHA146b314a568e1d480d115d2a24d57bcc78524f93a
SHA2561a81c27481f6f3380f6928259edffa8e9c18db92c2f574655553ab490d05a9cc
SHA512b1635bb433d7ef8adff5b2c53a2e51ab105f542e0767f579c7849e901748d74898742f2d0223954ce101603aa617282ebf87932d472ac475f2f21a1135a2c4ca
-
Filesize
1KB
MD51683584d825fbddaf1a885e37dd1ac1e
SHA126000eb7eec4a7cf5306867fafdfcc2688b411e7
SHA2563cc6c935e7880976fc2173e65693453e418b300a75579bfcd8e09f757e25c4a8
SHA512da4a697dd7a84fed3299d0adb1cf74ff0791bc71c7c92f54fa5ab91248758fe5b163457c2779f790694712e2c49ad6efaf27c4db091a70cba96aa93b51657820
-
Filesize
481KB
MD51db5b390daa2d070657fbdb4f5d2cc55
SHA177e633e49df484b827080753514cc376749b0ceb
SHA256d5fbaf5c0d8e313d4dad23b28cac4256c5dbed6ab3b0d797e2971f30c5e095ad
SHA51268aa0152f5aae79a146c1813915fd16ec5454b285bd1781370923f97d6c147d53684192f7f4161e5c1a340959ec432ecaac127b0abe7d08f70c387e08ee4f617
-
Filesize
722B
MD51150d7e97e9f1c6e0d7171243f5bc882
SHA1d48652a56ef85b22170fca289f7b54035f013d09
SHA256fb4201fd1c60441d00eda6abf44554587f8b95ec45ea9c65c9ad55e4cfa93dd5
SHA512a8ceb9daa2b40c7ba84dd076eb28d43c1606b17707cf3a3837b8aab9b7bd8f666fc01e084c04b1e2b5f23c08f3ce33670ead8f1986f0ef05363cd612d711d883
-
Filesize
722B
MD5023a59b0fde18b0d73b4cb9e60c55d28
SHA18ef702ea0813743d83b8350dd50d81c5033b1a11
SHA2569242c69ea24298c226708e60903961a715b94cd0e382618130505eed14f77272
SHA5129048255eec9bbd15accf4a26b15ab6307a10a89a6f27afa701da78209e755058d4d11c6d5ba2e3cf6cac1ce7873e8e13b53448b5a756d7ccd7428b719c5f218a
-
Filesize
722B
MD5db5bd9d3c5468658607e24aebece9d69
SHA1c10d156f6a84e03f3ac6941a3c23bb0af904f478
SHA256894f0955d79542e6e40d9a0832afeb8a6bf1f327c278e2a495cae9183858c946
SHA5129aa3b4e7bcb4d24ceba2c0b41a6ddc38eec6241e761294d3873d2f6f83396ebc0daae110064f38ee6f7eda37cabb519df52d3cb22887b9f3b1c04e9bdc3e223c
-
Filesize
722B
MD5506e4fc3b83d6bb0414682705c1b03f6
SHA1416a6a09b8c80c2a0181e42c48916c2ec9bd69c0
SHA25645ec385521a29e2cce3e220b7503315b03ecb4bcdf6430b9cadcfdb1ae886c00
SHA5126d7e67f3abef1b4bf5031d34ca274fb44033748bc0a4c999d41b6bd1cac9dd18d998ef1a13b60230af644e8bcca7d92ff94dc49aefd97b62a780651cfa8f0d59
-
Filesize
220KB
MD51bc4ecc0423d2bac2486d6e88d637589
SHA1ca7fad601acf04bec1fe46be02690c575f840513
SHA256804178b82ada2733358985d9f469cd047df364edb63ea313d00f8bcd86e8721b
SHA512df92a239d75fb4bed65593c3e947bac24edfb5ac94e383cff802a5a690c14c6f2f3babf1a2103efcbde22088c8fc13e3eaf67499b5286c12a784e75209319d38
-
Filesize
313KB
MD5b464d0150ec177b7b8c6cca974dc8f94
SHA1621716cd9503afea0e3e34741e5c0ad1dccfea38
SHA2564bc55ad96505ddb421679d1867c91c44e5547b0f688824adf94d1b92caba5b0d
SHA512f2f79fbdc58c016779d2330fcc7ab923c169239ebd58b8a4fbf7f917f021b6bf715a24043b94b13f408119d3638602ee4889edcaae6bb94f5eaa3e687faa2a66
-
Filesize
194KB
MD569c3a9d6ac33a93f2002ee38c2a46434
SHA1aa1e3497f5151fb76811665750956d4aaea7c3c8
SHA2564ca1a8c14d03e78442789e84bf33091e3c74a84cf5bd6af84b1732eacf2a2dd9
SHA51232f16e695ab7fd57e60a47d0d5976da19e944107001d41a37ef5f9a42029ec5b212c82ce763811629144c0545dcf31f8a3a7d46f1c021a7fa8b1099e2e58e5cd
-
Filesize
101KB
MD5de817f8996a5f524523514779f909a76
SHA14674880202435822341ba492843c2dcb126d5e50
SHA256a21a9356c7a473988efbb5e8785047cb0fa93ac5ad093d429ef119fbb33edf6d
SHA5128c02e93b54baee8b7bea96a80cd209f38aef6ff38b06d65d1ce04a709ebfec7b26126874aba611e893f87ae2ed719ebef05aad5f1077e68bbabe39a3048929aa
-
Filesize
26KB
MD55ebae18d758a2785c25800cf9f602426
SHA1729c110aa5f4a19f6e932b399adb68373f788870
SHA2563c8634b7cfad1704299882ee1d8cc86fdec88831103959d2589b2a62e33deb63
SHA5120b5196e7c7d10a5f3bd504e649fd16a714948339e9401efa562492a852e9f46502688c52c03c64155652aacbce0229cd6a2babcff7863ee30103f8ece9ba9f9a
-
Filesize
842B
MD56f4adf207ef402d9ef40c6aa52ffd245
SHA14b05b495619c643f02e278dede8f5b1392555a57
SHA256d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
SHA512a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
-
Filesize
93KB
MD5ee708472eb382dddfd8001ae980d7709
SHA120ac19a71e2ce5d5b222abd839212765dce86b81
SHA2566e8abcda1d86afdd7475e56054fb1d7e55f176debee67da7b62e37b120435617
SHA512a76f9694cedcec781158c256c845aecc85b9414987f466b3838f3f4631b13cb1dacdd2b70dbf6f5f33a895b194704fe3997d5d1e3787666f3670ca980c549310
-
Filesize
9B
MD5ac7ef6d7fcd23c228941057dc1a38427
SHA1aec0bc6ea51cea8edb23dd9ea7be81f113f42493
SHA256fd687092833ff2ed530a5ba6d4cebe3c1e5f6c318da1610320743cc7e073a740
SHA5126cf8518e3448d5f19775ac462fab31aac662f0386ed2aeae85b2b5591ee3092f25527beb74592f1c1e4a20f6488277b429c9f46e783937c4bb9f7439ffb6c4f3
-
Filesize
208KB
-
Filesize
208KB
-
Filesize
208KB
-
Filesize
208KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
188KB
-
Filesize
208KB
-
Filesize
208KB
-
Filesize
208KB
-
Filesize
208KB
-
Filesize
208KB
-
Filesize
208KB
-
Filesize
208KB
-
Filesize
208KB
-
Filesize
208KB
-
Filesize
188KB
-
Filesize
188KB