Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    199s
  • max time network
    213s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/04/2024, 00:47

General

  • Target

    998dbf404219d64228ef17e7ea8d0f3c91fc1ea5adef267f4f4ae9ac2c670085.exe

  • Size

    2.6MB

  • MD5

    468f2a8822e72abbd40916941c5b8503

  • SHA1

    9800a6ef9a5d92fb495f4612c3dcc37378347b68

  • SHA256

    998dbf404219d64228ef17e7ea8d0f3c91fc1ea5adef267f4f4ae9ac2c670085

  • SHA512

    666fb147d0726e561c094261068263d90f5f866cbe4b9932361a55da7aacfb9a33a9402a6741aa542a19d0bddbdd676d6d8e12d1f4a35e99ba1be1c60812d402

  • SSDEEP

    49152:/7M8jxPN5HmPJhtG6ToOK0+Hy5zlBiB55oTZeyiLmSW6Ir42/rTmJ7kgHgOK:AYPB0Z5zlBiH5oIyiLmHw2OhkgQ

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 21 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3360
      • C:\Users\Admin\AppData\Local\Temp\998dbf404219d64228ef17e7ea8d0f3c91fc1ea5adef267f4f4ae9ac2c670085.exe
        "C:\Users\Admin\AppData\Local\Temp\998dbf404219d64228ef17e7ea8d0f3c91fc1ea5adef267f4f4ae9ac2c670085.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:560
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFBD0.bat
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3312
          • C:\Users\Admin\AppData\Local\Temp\998dbf404219d64228ef17e7ea8d0f3c91fc1ea5adef267f4f4ae9ac2c670085.exe
            "C:\Users\Admin\AppData\Local\Temp\998dbf404219d64228ef17e7ea8d0f3c91fc1ea5adef267f4f4ae9ac2c670085.exe"
            4⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4948
            • C:\Program Files (x86)\Internet Explorer\iexplore.exe
              "C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://se.360.cn/
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:3928
              • C:\Program Files\Internet Explorer\IEXPLORE.EXE
                "C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://se.360.cn/
                6⤵
                • Modifies Internet Explorer settings
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:2628
                • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2628 CREDAT:17410 /prefetch:2
                  7⤵
                    PID:2204
          • C:\Windows\Logo1_.exe
            C:\Windows\Logo1_.exe
            3⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:116
            • C:\Windows\SysWOW64\net.exe
              net stop "Kingsoft AntiVirus Service"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:712
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                5⤵
                  PID:5020

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files\7-Zip\7z.exe

          Filesize

          570KB

          MD5

          abc39bb762c9fdd1df9c48340d1239ca

          SHA1

          af372f979fc9ca1c41de73510dfa05f3cd89f887

          SHA256

          1b722ae85b8c09e3a993db4b39131a4c4aba3bf86549b48e94f3f4e1f5d6c506

          SHA512

          3eff4ded8371184869f407a347765d0574281634f33ae99b96bc28c405fafe2f721c9969eba56a22815a4fce7a4fc478b32b1f16ce4be99e10d6d548f3a552e0

        • C:\Users\Admin\AppData\Local\Temp\$$aFBD0.bat

          Filesize

          722B

          MD5

          ef40df2b192d8f9db0c581c09c53ab56

          SHA1

          f038797ddf3e99ad084f2b1ac59dbe53a5d524ed

          SHA256

          283ae244e5117ccff75ed6bf26e51175b560a97c53d7d6c6a90fd702450e4bc8

          SHA512

          5b3389e48994650fcc3a03e30159d6bdcfcfcb97bbee069067841187150ae57af57717f0d3e0389f6b75b747aae9b63cbf9827afb2c2ad1d038d05742ba440e6

        • C:\Users\Admin\AppData\Local\Temp\998dbf404219d64228ef17e7ea8d0f3c91fc1ea5adef267f4f4ae9ac2c670085.exe.exe

          Filesize

          2.6MB

          MD5

          78e059cdb97de787e780109e42edc055

          SHA1

          43e35ab547d9ef8cb978cbc5bfbef89b4f6aea53

          SHA256

          61b7d31fa80f3c9fd584c454c9c70e6ce1f101864abcd3fd1cdb22d8b344dbd4

          SHA512

          426cd43d00ce9d6c850b57159c4934ed88731ce3ad56107be65d95d200c9616517967b3c7b7c2cf1b42eda4e58b6a28383cfce52a11258422eb093ee489e69ab

        • C:\Windows\Logo1_.exe

          Filesize

          26KB

          MD5

          6ff88aed67261a9080c1e62fd8bd0504

          SHA1

          14aed18f7ccd0e479389f111b63e79f2578001b1

          SHA256

          ee50a980fa1e7b2d29fc3adfa8acdeeda2cfd4937f4efe6346bfd9d0dac37a45

          SHA512

          4eac127c6e81a6c5c91b5276cd4a059c1fc3d78f8b5911d1c4b8fb77cb355d61f32b22c8230d55c6ac61f7ef52062dffe76f9b98dd0d18331e26a8c7eb070172

        • F:\$RECYCLE.BIN\S-1-5-21-1230272463-3683322193-511842230-1000\_desktop.ini

          Filesize

          9B

          MD5

          72b7e38c6ba037d117f32b55c07b1a9c

          SHA1

          35e2435e512e17ca2be885e17d75913f06b90361

          SHA256

          e9719e3c653627668046bac84b77097bfb0cd018d68465c17130ed31d6d6eca6

          SHA512

          2bebd814b81ad2dc547802d42891d833caaad81d004758ec4373f9c7af2971eb822f0a559d2d5d4fca499912fea95e25bab22e92cb0c149d6a4c692eee6ee46a

        • memory/116-14-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/116-20-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/116-28-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/116-30-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/116-35-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/116-38-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/116-57-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/116-63-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/116-92-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/116-194-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/560-0-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/560-9-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB