Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/03/2024, 19:25

General

  • Target

    54e69d7f53d339d57884a05a425f7f972946efea3989b80027012a908c30c7b0.exe

  • Size

    306KB

  • MD5

    4aaabba576b636750de26ebdba21298c

  • SHA1

    2b1a3c426e9c67d4bcefac90c13301d1e9086fab

  • SHA256

    54e69d7f53d339d57884a05a425f7f972946efea3989b80027012a908c30c7b0

  • SHA512

    5f44135df0a215df3c369309a126001773432f7933f2d20d610594b98f71cbc188e823d0b9152f30a6d07ee157fb5ced9d2cb0cbe9c33d0286a2c209b13f390a

  • SSDEEP

    6144:d8VfgPYxJfXaybsYYT6A+TeuL+5/XohWY8v5:d+Y4JPaS2Td+Tez5/Xo65

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3448
      • C:\Users\Admin\AppData\Local\Temp\54e69d7f53d339d57884a05a425f7f972946efea3989b80027012a908c30c7b0.exe
        "C:\Users\Admin\AppData\Local\Temp\54e69d7f53d339d57884a05a425f7f972946efea3989b80027012a908c30c7b0.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:3136
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a615A.bat
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1616
          • C:\Users\Admin\AppData\Local\Temp\54e69d7f53d339d57884a05a425f7f972946efea3989b80027012a908c30c7b0.exe
            "C:\Users\Admin\AppData\Local\Temp\54e69d7f53d339d57884a05a425f7f972946efea3989b80027012a908c30c7b0.exe"
            4⤵
            • Executes dropped EXE
            PID:1284
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1388
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2784
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
                PID:2520

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

        Filesize

        251KB

        MD5

        65b4a0bf5703bbb54c97a3adc1eda035

        SHA1

        2133af6d980782e84a0b2645619e981973bd9167

        SHA256

        4c68edc3a62e2b1b4ef69e977d1749fff63af3b0dbf50d8d6637d9605853bb12

        SHA512

        730daacda7efa72b1394d1eabed5d2a7104f1e5ecd5e0a96bc32a21754c298b0727270e85434dd3f8291e4e5eb55cea3fa820177b873bb02bdf4dfcf30ff779b

      • C:\Program Files\7-Zip\7z.exe

        Filesize

        570KB

        MD5

        a6c6a93200274ed564ed7d80ce5fd22c

        SHA1

        da4efa2457424f8944727a7913912763c8e5ab81

        SHA256

        25da5ff0d3f006965e6d0b3744e12a97618f1e2fb3d82949abd7bd753afa867e

        SHA512

        9aba4d8f2f94bb46b0b0928ad9d45ee9300ce9273d682f6ae33ef52f70d43489997f1bc87ca15453c84a0b04be35ee81544faa4483d878b4edd9d5d22000bd90

      • C:\Users\Admin\AppData\Local\Temp\$$a615A.bat

        Filesize

        722B

        MD5

        6f55eaae21aa381dbf5ee9145d3bcaf5

        SHA1

        cd44eb74d45ea5158dd531fd98ede502663f8d33

        SHA256

        3d3ceb2c2f7cf2f99918c6c4025b1450e22e81d13c3cda209b5e4dab3a0d20f2

        SHA512

        c87d66226c580e7100681fa0052052cfe5235e48ff29405029586f2b51b2ad7ad23bf34039e060fcb30ba2df6dc67188569742d864fc5b9e7c6df885ff022d4a

      • C:\Users\Admin\AppData\Local\Temp\54e69d7f53d339d57884a05a425f7f972946efea3989b80027012a908c30c7b0.exe.exe

        Filesize

        280KB

        MD5

        1b294698fdea69a9957efcd241211cba

        SHA1

        723cbfdb4497def21730ee3cb64c5522d03b555b

        SHA256

        a6231c541aa480ff1a9db9cd40b1366c1a8d53abcaed0ab42bf834e59fe490c8

        SHA512

        9fde02405009a7be99094f66114f4b23fc94dc6023170d6ccd1518cc5e0703c8b7537dda45ecc42afa36b06b8cf368d997ba0964e2b147e9a6695f410647971c

      • C:\Windows\Logo1_.exe

        Filesize

        26KB

        MD5

        ef3256717d6b0edc9776e10d8a519313

        SHA1

        c7629324ead6c72e3aaec3c4715ecafb752e305c

        SHA256

        71fdb7e7308c8cc0b0287ab175de70c1110bc506198983a7ee341951f07328a5

        SHA512

        eeb5fc7cb46ffb4d261da3c1626a83da7a10d8a0b51147e74e594341d5c0b383d5dc2ae43133c28656dfc63f1ea98c513ceaf622c9036a206716509d14748c77

      • F:\$RECYCLE.BIN\S-1-5-21-2727153400-192325109-1870347593-1000\_desktop.ini

        Filesize

        9B

        MD5

        99e7b853191358d26886fb0fbf829151

        SHA1

        e48d4d584139ac8cef25e13fec7558deb3394143

        SHA256

        e361153f54284dcb6dd9194e2517751c54440206148beb878dfd37e380405f4d

        SHA512

        d9de2712f2d0af5774acd4f44b4081f9b0d6e7bcd43518431ec8e53932a9e10bcd3ee93fa8565a79619e0b10b3c7178fdfc5ff11675198a6f035a15f6aa03280

      • memory/1388-32-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/1388-19-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/1388-26-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/1388-37-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/1388-41-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/1388-12-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/1388-383-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/1388-1175-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/1388-4148-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/1388-4741-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/3136-8-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/3136-0-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB