Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    153s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/04/2024, 05:02

General

  • Target

    612082e89ff3931365f179e90d8ac4ee1cc70e0b0773be5239621f46a9aefff5.exe

  • Size

    99KB

  • MD5

    5d4d3142a3aad5b1f95c4fb8daa20fbf

  • SHA1

    91b52711e120e1ba1789aae6fcb48e837870c4d0

  • SHA256

    612082e89ff3931365f179e90d8ac4ee1cc70e0b0773be5239621f46a9aefff5

  • SHA512

    a12fc823412c876c3e5a777e39207ad2266a7da76e597601f0a268151ebc6ebaa99551301102b42b140644cc72414db7cfa8a9329c220cc3b3b0a40fa3917bad

  • SSDEEP

    1536:zLfgLdQAQfcfymNOeRLagGxBalspwrQozDQ4rRh2G2WW5ntaF6Kkv9+4PIX5XPS7:zLftffjmNVcxBalsWfThs06n+D5Xq

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3336
      • C:\Users\Admin\AppData\Local\Temp\612082e89ff3931365f179e90d8ac4ee1cc70e0b0773be5239621f46a9aefff5.exe
        "C:\Users\Admin\AppData\Local\Temp\612082e89ff3931365f179e90d8ac4ee1cc70e0b0773be5239621f46a9aefff5.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:1184
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF6F3.bat
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4316
          • C:\Users\Admin\AppData\Local\Temp\612082e89ff3931365f179e90d8ac4ee1cc70e0b0773be5239621f46a9aefff5.exe
            "C:\Users\Admin\AppData\Local\Temp\612082e89ff3931365f179e90d8ac4ee1cc70e0b0773be5239621f46a9aefff5.exe"
            4⤵
            • Executes dropped EXE
            PID:4148
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2268
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:3320
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
                PID:4524
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2232 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:8
        1⤵
          PID:3956

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

          Filesize

          251KB

          MD5

          bdd08c2b14bc84bdb0bb437b6dbcf72f

          SHA1

          529a6a7c8beaa8b3074c6377b17bdb17fb848b54

          SHA256

          e5137cfd43e6bbd5e2044cc56e6d08b4441423481a9f5be2efdf8b2d4261047e

          SHA512

          7b2d923586038a4b0a4069d8c0d18b93ec39e363e6428f032df50a5091ec0617e921316bffcb70709d1e16d32b928d9c83cc3d831b57c641fb6497e1ae876fca

        • C:\Program Files\7-Zip\7z.exe

          Filesize

          570KB

          MD5

          d4bbaa83fb9621669e64ab93da4a6301

          SHA1

          da051eb49de23b582f78fc14249a9e17179fffc3

          SHA256

          ee00fd559aebd0ad9a665de2ca9de129d13243e5ecf56724d3b9513cb1d8ae26

          SHA512

          914ea142308fd11434182854baff67bdaf1e2e7fa2635e02066a0f3bf9b9a6048857b5b5f9d8fd479c73bec3d179669fd04b27682e34f701a80b21857457ba0b

        • C:\Users\Admin\AppData\Local\Temp\$$aF6F3.bat

          Filesize

          722B

          MD5

          1e1af02fd634e891f76dad644405dbd5

          SHA1

          6b3088ebd19cd41d4c1c4138cf4abbfa97fac067

          SHA256

          21ab35609f3530e0339e73cd461bd9ef9028508bc9300a384e8775e4f84b193d

          SHA512

          78e6c9ee81d78c2b39addee08f2433e871ee293cdb8d07853ac420d8d98bc6c5a45bbb77672212e39bb087dca22c4a52283bc987ec6d2df67166b118b9dd2a57

        • C:\Users\Admin\AppData\Local\Temp\612082e89ff3931365f179e90d8ac4ee1cc70e0b0773be5239621f46a9aefff5.exe.exe

          Filesize

          73KB

          MD5

          ff4f229bc63a0e9a7583b39663d9c59b

          SHA1

          94f6ad0c737a4d519586bfb9e2838779e32dbd39

          SHA256

          39a3f52f90c4f35121720da8a8e8b5734d5582ca683b6ea67d17527ccf965947

          SHA512

          377e95042ebf2e6ae2790143bfc562670f1fa523aef04e15fb8ff39ddddf2efecec9fbe6dbe7b9c22577cae8dfd5d58be0579ac72e7d39077fe57fc11925ec73

        • C:\Windows\Logo1_.exe

          Filesize

          26KB

          MD5

          512efa11327090c7e4e592a32ad9a28c

          SHA1

          d6821ff811143ff9cb7027ef991e9582f4ffc7d5

          SHA256

          e135aefb131eeff159bb49e808679a6b837a183fae3e5c0b32d6f237ccddc7ef

          SHA512

          074cb80f5835408e074f336ad7fd6ab4cd87e7614d389453c7ab0a753aa9f3aa2e56e9c0f4d50a1070fce1632f55aefc60a45bab97dd2cd480201cd10b81345b

        • F:\$RECYCLE.BIN\S-1-5-21-3808065738-1666277613-1125846146-1000\_desktop.ini

          Filesize

          9B

          MD5

          72b7e38c6ba037d117f32b55c07b1a9c

          SHA1

          35e2435e512e17ca2be885e17d75913f06b90361

          SHA256

          e9719e3c653627668046bac84b77097bfb0cd018d68465c17130ed31d6d6eca6

          SHA512

          2bebd814b81ad2dc547802d42891d833caaad81d004758ec4373f9c7af2971eb822f0a559d2d5d4fca499912fea95e25bab22e92cb0c149d6a4c692eee6ee46a

        • memory/1184-0-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/1184-10-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/2268-37-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/2268-32-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/2268-26-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/2268-42-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/2268-19-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/2268-183-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/2268-1015-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/2268-1182-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/2268-2055-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/2268-8-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB