Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/04/2024, 13:41

General

  • Target

    552b314058f6d5e749ef545a70e29b8ef1064c9ed279c013ada72065f374f804.exe

  • Size

    1.2MB

  • MD5

    59549e03343a0e7bae882650147b1fc0

  • SHA1

    e03f597de54ad7866f79ece41e264b6a6ad2b923

  • SHA256

    552b314058f6d5e749ef545a70e29b8ef1064c9ed279c013ada72065f374f804

  • SHA512

    c54a1c114044ef8b94943a636d43afc1580595943c31527f5331b763f6785c0376926015e9f9c972efa437cfd582ecc75c147c0339e8e6c03f548abc97add385

  • SSDEEP

    24576:q7pQ+wJjp6usvOfswwEp1Uk7tGt2TpPjMOHdHWOy+8svvPJwx3:q7pQNJj8u8bwb1Uftq1AwcO2svmJ

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 5 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3448
      • C:\Users\Admin\AppData\Local\Temp\552b314058f6d5e749ef545a70e29b8ef1064c9ed279c013ada72065f374f804.exe
        "C:\Users\Admin\AppData\Local\Temp\552b314058f6d5e749ef545a70e29b8ef1064c9ed279c013ada72065f374f804.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:4928
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2FE9.bat
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2192
          • C:\Users\Admin\AppData\Local\Temp\552b314058f6d5e749ef545a70e29b8ef1064c9ed279c013ada72065f374f804.exe
            "C:\Users\Admin\AppData\Local\Temp\552b314058f6d5e749ef545a70e29b8ef1064c9ed279c013ada72065f374f804.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:5096
            • \??\c:\a5674c8ec8f67a03d403a9219250\update\update.exe
              c:\a5674c8ec8f67a03d403a9219250\update\update.exe
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in Windows directory
              PID:4784
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4228
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:3136
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
                PID:2400

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

        Filesize

        251KB

        MD5

        2e5fdaca779aed13d2e12d75790d0061

        SHA1

        c16ffd8e12c5b1b0155bb3850446c02ba1fc7da9

        SHA256

        a09916031169ddff5e3ea3b3ef3bf2c5c5e5416c57e39a1c6d70b4255fcf0386

        SHA512

        cfbd0b2f09c0169c53dcf2717f1ca007771ae19de67fc6b44359bdd251a1cf7ca300984399e55d7697fc10bb06228ee665a596c9a822f81c470d0ec63cd7b1fc

      • C:\Program Files\7-Zip\7z.exe

        Filesize

        570KB

        MD5

        439191ad767c82f2d567a934b3c0132c

        SHA1

        c2ece19c453a7dfc23c7ee3cb7ba8c24d2d0d9fe

        SHA256

        9d36e4673e0898ffad936c3eb1395ebe3594b35169ce27cf28feb6cb9f667ff0

        SHA512

        cb423c0732d37dd223cdfd2cbe4b934dd8fa96f41323ceaa9602741464cf9e87eb2d042a0c00c37470bd6694260cb8a032bf408f5ddb1268bdcf73880c5d47d6

      • C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe

        Filesize

        636KB

        MD5

        53ee62011469b286a2a1b5658c86b9bf

        SHA1

        9bdac0b23b0a965947c780c6a6b48fc7122f9ade

        SHA256

        7125735e4e8595f1c17ff3235bc65dacabc2ec874b29ac7ba8eddd80ad10b3c0

        SHA512

        c9c24e578da0a38048e71548fac66465bcb624e971f745bba559e8c49fd621752e718d4c983a90a97277407bb23348ca109436e1eeebef030c3b599c712ff236

      • C:\Users\Admin\AppData\Local\Temp\$$a2FE9.bat

        Filesize

        722B

        MD5

        b260cc497b8e02a10bc9e52f9c47416d

        SHA1

        f12f2de69702cf9de58af6466bfb3f6adb06c651

        SHA256

        6a7063aeed20693ded3575d6529642ae32b41e0ace42b552e79faaa1ea34d9f7

        SHA512

        ed1427c5d98121054e372d55b94dfb6644f00d582392108791c69a52fdd885602da6e29d3487fa89a3cef0f1b0772e0189e9c9aca5fac7ca14b02d5ca80822d5

      • C:\Users\Admin\AppData\Local\Temp\552b314058f6d5e749ef545a70e29b8ef1064c9ed279c013ada72065f374f804.exe.exe

        Filesize

        1.2MB

        MD5

        53f5ccbe5fe06c3b40cc9e34ac909df7

        SHA1

        53c18652ac2f8a51303deb48a1b7abbdb1db427f

        SHA256

        196868b09d87ae04e4ab42b4a3e0abbb160500e8ff13deb38e2956ee854868b1

        SHA512

        e3f8a50cec53e150fbe62dcaace343336e2cc0d97cd52a2eafe050bf5d02fd8ec6dad2f913f84dc3d6cb3dbcb8074070e3c1fd29ccdb0a40f53158237e056ab9

      • C:\Windows\rundl132.exe

        Filesize

        26KB

        MD5

        7f1a318b813b5ff794963da6ce837e93

        SHA1

        4e384f63d235b29d7e0f6c044fd0b2615d1c03dd

        SHA256

        b8dd7154aaba311f2b245ca4803e25f240186ccafe75347c2175b7ab17c38833

        SHA512

        9e5f7fe580629e1ca373abc27a7f3023f14d477c3947ef11c880de284ad3e681fe077a12f537d6e22bb14f322db4e2e90ca8f2078cd03f7e1c9ec1c280c36cc7

      • C:\a5674c8ec8f67a03d403a9219250\update\update.exe

        Filesize

        724KB

        MD5

        d2c47c22a213aa04336f9ed8a5444865

        SHA1

        d345140eb433a8c5df491741211c4df35d7404f8

        SHA256

        6b9ce67765c4948b34e648b483a049abd36f3f64646f6b599cdbaed79274e813

        SHA512

        b5dfa51810fb4867d8bde33d46b1ccb6ff591bfb302b824b74470caf13279f3149a9428f402f622f3c342a5bb5dbff3a285cdda10999295e7a186caaf9338453

      • F:\$RECYCLE.BIN\S-1-5-21-355664440-2199602304-1223909400-1000\_desktop.ini

        Filesize

        9B

        MD5

        72b7e38c6ba037d117f32b55c07b1a9c

        SHA1

        35e2435e512e17ca2be885e17d75913f06b90361

        SHA256

        e9719e3c653627668046bac84b77097bfb0cd018d68465c17130ed31d6d6eca6

        SHA512

        2bebd814b81ad2dc547802d42891d833caaad81d004758ec4373f9c7af2971eb822f0a559d2d5d4fca499912fea95e25bab22e92cb0c149d6a4c692eee6ee46a

      • \??\c:\a5674c8ec8f67a03d403a9219250\update\UPDSPAPI.dll

        Filesize

        370KB

        MD5

        8bd49e73d58ca387b7b5e9d4fd0fe0cf

        SHA1

        4f02de05b58f3c6601e4a84dd755c9c59cf3736c

        SHA256

        56e9579a2dc53fecfb54adac7d92a935e196e7e6c8b5cd812b9412303e1fccdd

        SHA512

        1a8c93fffccb946bb4a9db78782af819b565c9db5f3668cda90b1c5e4a142d9fe5c3ae30446b910d152fcc7a60e7bde9529cf434c827d4fdc4a9d44bbfe0b47b

      • \??\c:\a5674c8ec8f67a03d403a9219250\update\updatebr.inf

        Filesize

        226B

        MD5

        7ac542f123f07b5c120378c525396ab5

        SHA1

        023fbb67777e33ed7ca2fdd48c55c1fb03cf723a

        SHA256

        60836a0db93476ea393983dbdbbb139c496360ef391d53e9fd81f3fc277b9c02

        SHA512

        30cbe7a9c9ac40d28a30082ac508b4dc946cbdbb378b4b3584111367281d7b497edd2746faf70217ec0e7e31f468c77f6f1644d5909a33c8fc94132ca4f7be00

      • memory/4228-57-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/4228-64-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/4228-71-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/4228-74-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/4228-1264-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/4228-4830-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/4228-8-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/4228-5269-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/4784-40-0x00000000005E0000-0x000000000063E000-memory.dmp

        Filesize

        376KB

      • memory/4928-0-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/4928-12-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB