Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    20/04/2024, 05:18

General

  • Target

    6ee1ea407cfbaf4c4dc8e3134d6358fc781b1058552b155da93324ab83a2a143.exe

  • Size

    70KB

  • MD5

    a22f9d5be4e32f732e992ca4203c0dbe

  • SHA1

    571a03af89321b135f0c7e9b8fa0d607a4666db2

  • SHA256

    6ee1ea407cfbaf4c4dc8e3134d6358fc781b1058552b155da93324ab83a2a143

  • SHA512

    44b08cc30be2ee1f69a3bd1e27dbc99a699401b145610171cabb61843e838306145e09f0ec645566d9dc02d79f435e00f3e4fb0323efdfd35663c1497bee68e2

  • SSDEEP

    768:GgT2ljlL5b+nXLpXwnslmxtOsoI8A+D1dykKsWkgkLuFaxGnzuUjfwVi+3NdKAGG:Grj95b+nKbIs78JChsJg6PGKUzYQ5u

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Program crash 1 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 31 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1204
      • C:\Users\Admin\AppData\Local\Temp\6ee1ea407cfbaf4c4dc8e3134d6358fc781b1058552b155da93324ab83a2a143.exe
        "C:\Users\Admin\AppData\Local\Temp\6ee1ea407cfbaf4c4dc8e3134d6358fc781b1058552b155da93324ab83a2a143.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2120
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c C:\Users\Admin\AppData\Local\Temp\$$aF1E.bat
          3⤵
          • Deletes itself
          PID:2204
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2644
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2676
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
                PID:2564
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 580
              4⤵
              • Program crash
              PID:2384

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\$$aF1E.bat

        Filesize

        721B

        MD5

        5aea7255f3f72e3e1c5df4b406a3216d

        SHA1

        0338f243c96b108f38e03777484e7aa0bc97b541

        SHA256

        f40fed393986ed7b3458d2fa71b20ad8df0a56d4fa8200001ef0bdea30ab60e4

        SHA512

        2cba0eeb5c41ca4cdf335dd3fb73ccea8636f42e685f3383f937f651d52d8969c2ea51c2f16f5af5cccb3d1e2538e5d4ac70ec5accfc0930c5c514cdc87fa380

      • C:\Users\Admin\AppData\Local\Temp\6ee1ea407cfbaf4c4dc8e3134d6358fc781b1058552b155da93324ab83a2a143.exe.exe

        Filesize

        26KB

        MD5

        af10e9952143f273218967724d665e15

        SHA1

        281d6ede486e99e893057239a66e004d882280f9

        SHA256

        9dc677eca507d541abd4b78154bf672bfa6561a68eea7f569849860cc5ef2ab7

        SHA512

        53b07097d547f55e2d454324812601ce87d6400b3afe278ddd62c63e2ebe90c750785aa17e45b05f3e4a358c90ab64657fecdce667a4d2c1a07062861976581e

      • C:\Windows\Logo1_.exe

        Filesize

        44KB

        MD5

        9dc9ea2a5ed74b7cccf92b53dd855a28

        SHA1

        9d6026f42e278cc153851b5ec7c61629d8682f46

        SHA256

        69bdd3f404195624d37359b90c4cef8bab73a3e6f875a8d151342626c684db6b

        SHA512

        518f499675639c8767118ea062d8bfa330d42225764fd6cb7492fa9380405bea2dc9d777fdf9a0d2fa848e5eae7253ef8221f7e7b4d33898cd1e441003197a64

      • F:\$RECYCLE.BIN\S-1-5-21-2297530677-1229052932-2803917579-1000\_desktop.ini

        Filesize

        9B

        MD5

        27729a3995958245e2d6799df42e26e7

        SHA1

        dfe386f53277c8387b50122f3fda9bc2467815ba

        SHA256

        9313041e89d4585b2606afa4809b101e7e8a2c944d063a28c796b0c0f070b5f1

        SHA512

        ba9157cea7ca5c01b52e2a4a758f4e12e018990e49f1ece5fa6d83423f37a0a4dd5246d9b01e5e212d5e8c36a66a8d0e2645bc73753671295965a855a5028ec6

      • memory/1204-27-0x0000000002A80000-0x0000000002A81000-memory.dmp

        Filesize

        4KB

      • memory/2120-0-0x0000000000400000-0x000000000044D000-memory.dmp

        Filesize

        308KB

      • memory/2120-20-0x0000000000270000-0x00000000002BD000-memory.dmp

        Filesize

        308KB

      • memory/2120-16-0x0000000000400000-0x000000000044D000-memory.dmp

        Filesize

        308KB

      • memory/2644-21-0x0000000000400000-0x000000000044D000-memory.dmp

        Filesize

        308KB

      • memory/2644-354-0x0000000000400000-0x000000000044D000-memory.dmp

        Filesize

        308KB