Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    23/04/2024, 00:14

General

  • Target

    b32e65411ba5e9940590c8a97914eaab5648fa7642f13c6f642e0b083f57e864.exe

  • Size

    49KB

  • MD5

    5233018ae9929103e578e6abbe0baee6

  • SHA1

    588aec4baaf13e11293f172a15bc49f8a957c461

  • SHA256

    b32e65411ba5e9940590c8a97914eaab5648fa7642f13c6f642e0b083f57e864

  • SHA512

    1be91ee1775dd674a8c3295c87f10b46d28893219d2e68363b91ee9af486a912b376cdc2ab66d042011e324aaf6cfcdaf9324284f2d5cacb673e361aa8bb3abe

  • SSDEEP

    768:pr16GVRu1yK9fMnJG2V9dHS8bnV9P85GB2FlFfNDG7qHUf2h:pB3SHuJV9NHV9kFfO2Uf

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1256
      • C:\Users\Admin\AppData\Local\Temp\b32e65411ba5e9940590c8a97914eaab5648fa7642f13c6f642e0b083f57e864.exe
        "C:\Users\Admin\AppData\Local\Temp\b32e65411ba5e9940590c8a97914eaab5648fa7642f13c6f642e0b083f57e864.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:1720
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c C:\Users\Admin\AppData\Local\Temp\$$a1758.bat
          3⤵
          • Deletes itself
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:2064
          • C:\Users\Admin\AppData\Local\Temp\b32e65411ba5e9940590c8a97914eaab5648fa7642f13c6f642e0b083f57e864.exe
            "C:\Users\Admin\AppData\Local\Temp\b32e65411ba5e9940590c8a97914eaab5648fa7642f13c6f642e0b083f57e864.exe"
            4⤵
            • Executes dropped EXE
            PID:2572
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2004
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1732
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
                PID:2660

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

        Filesize

        254KB

        MD5

        31b58266e648b3ce129dbb398da4eb8d

        SHA1

        3fef7bf9dc3e9a9cbeb336f961122328e98728b0

        SHA256

        f7ff76094663c11af4a4849043227d365924ab84b94b2bbcb533a87f20ccff58

        SHA512

        f9dd0e0cebdeb060f238d071672c2f6aa808eaebce5c8ff016c90ca6d74b35467e86596e7fba8d2b2b37b8f90a650cad74530e024d1b6ff717a308393ab1e334

      • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

        Filesize

        474KB

        MD5

        6eabc463f8025a7e6e65f38cba22f126

        SHA1

        3e430ee5ec01c5509ed750b88d3473e7990dfe95

        SHA256

        cc8da3ecd355b519d81415d279ed037c725ba221bf323d250aa92ee2b2b88ca7

        SHA512

        c8fde7026ac8633403bbefee4b044457184388fb7343d8c46f5f7f272724227976bf485ea91da49e2a85dd0cfb73f260ac705d8007333dd3e5539fe5ed67e3ab

      • C:\Users\Admin\AppData\Local\Temp\$$a1758.bat

        Filesize

        722B

        MD5

        422863654a9f636d5aea2b42952176ac

        SHA1

        0c3d8ea293ec3bc4ff0afa52dbc414cefce662ee

        SHA256

        c46be7d66b1e85404b9cf6e698174e578265906f6adc2212fd478bce9cd0cf19

        SHA512

        b7ed503f983afa48d51034939889769b959a9ea0b79d42c5af6adde3f302dc11b47150d93c29fddff2f0840640cbfea9b7f12c67c2e93d757f2475239ef943e7

      • C:\Users\Admin\AppData\Local\Temp\b32e65411ba5e9940590c8a97914eaab5648fa7642f13c6f642e0b083f57e864.exe.exe

        Filesize

        20KB

        MD5

        041c541459d66173349737675707f8e8

        SHA1

        675368be6d2585d97c58d904981037a4dd255af7

        SHA256

        3e7712361e0ae26920b3b6caa299ef06a62fcc86301ec97c44df4981b3f2a446

        SHA512

        c876e48e386602fd7f7353a7e0d7126ff2b890ebce04ffe751cf898509198ae8264c448b02894309d24e4f1e5315aae2a08402583cab838439af501bcad5aead

      • C:\Windows\Logo1_.exe

        Filesize

        29KB

        MD5

        bc2a08f1fe0430eb261fa12807b391db

        SHA1

        cfc8edda8d2a0eb6677468da30013b8c54a7a37c

        SHA256

        7e2c164ef33df9f9c8d4493d7ba3ddffeb8d6a9a6363a76334472f52feb3f5bc

        SHA512

        36419d572cc6e7f08c401dde59233bb4d50939c1471147572f11f1a4896eeb5a89228a945eb43d94fe0a6c44775a16c3b2f1c49691275d814f86105a1a346a49

      • F:\$RECYCLE.BIN\S-1-5-21-2248906074-2862704502-246302768-1000\_desktop.ini

        Filesize

        9B

        MD5

        5e45e0c42537212b4bfef35112ec91ba

        SHA1

        10c59c091fd35facc82bbc96938f118ce5a60546

        SHA256

        9f6b7a83161db36757e96dc40936aec1e5a9a41f9fca089f9cf5a4d695dd5ed5

        SHA512

        ee964e08687daa53fdc8e063402791acb104bd59f5d0f8a6d11d3e889db476315641c38032ade4177cd794b060f9fc4e6fd161989e452aae828c875c747e4bfb

      • memory/1256-28-0x0000000002510000-0x0000000002511000-memory.dmp

        Filesize

        4KB

      • memory/1720-38-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/1720-0-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/1720-15-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/2004-30-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/2004-37-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/2004-44-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/2004-90-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/2004-96-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/2004-913-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/2004-1849-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/2004-3072-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/2004-3309-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/2004-20-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB