Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    18/04/2024, 07:16

General

  • Target

    6194a5dfb2209516a0de7872b2f3eb13212df3cd68943f5b2f6a1ff075547a06.exe

  • Size

    573KB

  • MD5

    13422276d7810956f6445967f57b3d4f

  • SHA1

    ad27cd941dc130c87147544dafb3fb889ce097c8

  • SHA256

    6194a5dfb2209516a0de7872b2f3eb13212df3cd68943f5b2f6a1ff075547a06

  • SHA512

    91b019fa08ae70098b00cb19662c9978be34825760be4f4aae4bf70517cd9e0c146a0870e3577faa85d8efd1290351cd0818e2da1856c3fb860c9415b22293c9

  • SSDEEP

    6144:huJXYE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4t0BHQQG:C7a3iwbihym2g7XO3LWUQfh4Co

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1368
      • C:\Users\Admin\AppData\Local\Temp\6194a5dfb2209516a0de7872b2f3eb13212df3cd68943f5b2f6a1ff075547a06.exe
        "C:\Users\Admin\AppData\Local\Temp\6194a5dfb2209516a0de7872b2f3eb13212df3cd68943f5b2f6a1ff075547a06.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:1848
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c C:\Users\Admin\AppData\Local\Temp\$$a18AF.bat
          3⤵
          • Deletes itself
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:1276
          • C:\Users\Admin\AppData\Local\Temp\6194a5dfb2209516a0de7872b2f3eb13212df3cd68943f5b2f6a1ff075547a06.exe
            "C:\Users\Admin\AppData\Local\Temp\6194a5dfb2209516a0de7872b2f3eb13212df3cd68943f5b2f6a1ff075547a06.exe"
            4⤵
            • Executes dropped EXE
            PID:2640
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1196
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2920
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
                PID:2576

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

        Filesize

        254KB

        MD5

        5427c8355686e9236966d4dcd2119f7d

        SHA1

        441677316f5b657a05982f73fce0c439e7155a44

        SHA256

        678007290f0ed12852fcdeb88dd9cdb7b40913508d8cc9772cfcb40a7e217936

        SHA512

        67cdc1309d3e076088b3d16875b92f2bd0f060576441319e325560eca7d7c5f0afd15165cc76f49887fff67c869c5c835925d81288ad2add23d0d89a5647f97b

      • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

        Filesize

        474KB

        MD5

        45ba25b4e6fe57152a1966bdea786d3c

        SHA1

        b79b3a4f2d3b525688edf4b7818a400822834361

        SHA256

        d309f5130994c60441620daef072bc849b8a4e8af881f25946ecbe8761448834

        SHA512

        8ddb1e63c9454ae572f25d9353cafcffc238d5be3b6ddec87cefcf8280fcbaa3e7c59db2cff67a458c55bb0da9c07cee3c972f7ab18cee8dcbfcf3b5b1a5d699

      • C:\Users\Admin\AppData\Local\Temp\$$a18AF.bat

        Filesize

        722B

        MD5

        5e2d837a3791cbf83f23f696a08c9436

        SHA1

        d0e0765cf442a87a34fce50899d44e25a6f7d3de

        SHA256

        0f005eb7560d89d59cb8d370d9f2eb0694573dbfd3dd080ff8d7804b58eed765

        SHA512

        72a06f353219e280a525e9fb2c486cc766d2637ad435f97834ad13d7e9dd23fc34975674f465c1dd3cd38aae53bb906e99627dbcd4cf5c0795a8884da50440d1

      • C:\Users\Admin\AppData\Local\Temp\6194a5dfb2209516a0de7872b2f3eb13212df3cd68943f5b2f6a1ff075547a06.exe.exe

        Filesize

        544KB

        MD5

        9a1dd1d96481d61934dcc2d568971d06

        SHA1

        f136ef9bf8bd2fc753292fb5b7cf173a22675fb3

        SHA256

        8cebb25e240db3b6986fcaed6bc0b900fa09dad763a56fb71273529266c5c525

        SHA512

        7ac1581f8a29e778ba1a1220670796c47fa5b838417f8f635e2cb1998a01515cff3ee57045dacb78a8ec70d43754b970743aba600379fe6d9481958d32d8a5aa

      • C:\Windows\rundl132.exe

        Filesize

        29KB

        MD5

        243b2978a3e87c6a237767247bbbf6ef

        SHA1

        b592a11def8ab37d926ab4bc5601aaf1fc852c2a

        SHA256

        ea5e030c047d36a2bd930bd50153e3bf228e7644a3e30ce24bc9cb0f92f48a9c

        SHA512

        f8a617e6c1b790984b8df091938966b68916033b596b0fad51e2c19e0f33ccead7fe35032d0b8db2747fa20f065b87b36226c15e7e46eef73686699f142d71f6

      • F:\$RECYCLE.BIN\S-1-5-21-3627615824-4061627003-3019543961-1000\_desktop.ini

        Filesize

        9B

        MD5

        72b7e38c6ba037d117f32b55c07b1a9c

        SHA1

        35e2435e512e17ca2be885e17d75913f06b90361

        SHA256

        e9719e3c653627668046bac84b77097bfb0cd018d68465c17130ed31d6d6eca6

        SHA512

        2bebd814b81ad2dc547802d42891d833caaad81d004758ec4373f9c7af2971eb822f0a559d2d5d4fca499912fea95e25bab22e92cb0c149d6a4c692eee6ee46a

      • memory/1196-38-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/1196-2442-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/1196-31-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/1196-21-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/1196-44-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/1196-90-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/1196-96-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/1196-760-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/1196-1850-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/1196-3310-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/1368-29-0x0000000002E90000-0x0000000002E91000-memory.dmp

        Filesize

        4KB

      • memory/1848-0-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/1848-16-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/1848-12-0x0000000000220000-0x0000000000256000-memory.dmp

        Filesize

        216KB