Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/04/2024, 00:14

General

  • Target

    b32e65411ba5e9940590c8a97914eaab5648fa7642f13c6f642e0b083f57e864.exe

  • Size

    49KB

  • MD5

    5233018ae9929103e578e6abbe0baee6

  • SHA1

    588aec4baaf13e11293f172a15bc49f8a957c461

  • SHA256

    b32e65411ba5e9940590c8a97914eaab5648fa7642f13c6f642e0b083f57e864

  • SHA512

    1be91ee1775dd674a8c3295c87f10b46d28893219d2e68363b91ee9af486a912b376cdc2ab66d042011e324aaf6cfcdaf9324284f2d5cacb673e361aa8bb3abe

  • SSDEEP

    768:pr16GVRu1yK9fMnJG2V9dHS8bnV9P85GB2FlFfNDG7qHUf2h:pB3SHuJV9NHV9kFfO2Uf

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3344
      • C:\Users\Admin\AppData\Local\Temp\b32e65411ba5e9940590c8a97914eaab5648fa7642f13c6f642e0b083f57e864.exe
        "C:\Users\Admin\AppData\Local\Temp\b32e65411ba5e9940590c8a97914eaab5648fa7642f13c6f642e0b083f57e864.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:3184
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a368C.bat
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3756
          • C:\Users\Admin\AppData\Local\Temp\b32e65411ba5e9940590c8a97914eaab5648fa7642f13c6f642e0b083f57e864.exe
            "C:\Users\Admin\AppData\Local\Temp\b32e65411ba5e9940590c8a97914eaab5648fa7642f13c6f642e0b083f57e864.exe"
            4⤵
            • Executes dropped EXE
            PID:4384
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1056
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1744
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
                PID:996
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
        1⤵
          PID:4044
        • C:\Windows\System32\svchost.exe
          C:\Windows\System32\svchost.exe -k UnistackSvcGroup
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3868

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

          Filesize

          254KB

          MD5

          31b58266e648b3ce129dbb398da4eb8d

          SHA1

          3fef7bf9dc3e9a9cbeb336f961122328e98728b0

          SHA256

          f7ff76094663c11af4a4849043227d365924ab84b94b2bbcb533a87f20ccff58

          SHA512

          f9dd0e0cebdeb060f238d071672c2f6aa808eaebce5c8ff016c90ca6d74b35467e86596e7fba8d2b2b37b8f90a650cad74530e024d1b6ff717a308393ab1e334

        • C:\Program Files\7-Zip\7z.exe

          Filesize

          573KB

          MD5

          3888ffddbafbbba14619f7feb8539dff

          SHA1

          f51bf92ee7697f5e93dcb946e35962d48482faef

          SHA256

          68266f939fe4989bf6c860d512f01f0610a8d0978379a4e3cee18b309a189bf8

          SHA512

          2bd5374aee1f24205c74ebe97f4dd7a281f67227447a6b84e58e900f3e8dadce0fcb95c47a27648a7630d7eb53e758d6edb590a20fab7667fca442438f1f7271

        • C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe

          Filesize

          639KB

          MD5

          c8d281da4c32df16eef470c27c8cb459

          SHA1

          00efc9f6844bfaa37c264b6452c6a7356638ab10

          SHA256

          058c81e5a07f2c6c33cf28dff71d07ad8f179046108d945159957e891bfd9c62

          SHA512

          e3c79e19f620068f668d4ebaa5097f1a95a30dabb8dce75f3787171dddbea9f684fc7ce8d1011a398f38084d7af96dd1ff9a02d25906aab9b13861b8363d24bb

        • C:\Users\Admin\AppData\Local\Temp\$$a368C.bat

          Filesize

          722B

          MD5

          91858fe5e0a031f68c720aa5276ecc86

          SHA1

          d9581dbd276fe6536788b8ee15fdd6dcf9e9e7fe

          SHA256

          b17bf3b90c2584196655f51292c4d7f353a669f129cb8183850e436bcd5aea32

          SHA512

          617f7b5595fc73101e38db39381c0a00ce86ab1709af670ca363d3604a0c7a50e45e3a78ce8a7a7648d8856f8aeb5c88374e918f315af6798170dac095644356

        • C:\Users\Admin\AppData\Local\Temp\b32e65411ba5e9940590c8a97914eaab5648fa7642f13c6f642e0b083f57e864.exe.exe

          Filesize

          20KB

          MD5

          041c541459d66173349737675707f8e8

          SHA1

          675368be6d2585d97c58d904981037a4dd255af7

          SHA256

          3e7712361e0ae26920b3b6caa299ef06a62fcc86301ec97c44df4981b3f2a446

          SHA512

          c876e48e386602fd7f7353a7e0d7126ff2b890ebce04ffe751cf898509198ae8264c448b02894309d24e4f1e5315aae2a08402583cab838439af501bcad5aead

        • C:\Windows\Logo1_.exe

          Filesize

          29KB

          MD5

          bc2a08f1fe0430eb261fa12807b391db

          SHA1

          cfc8edda8d2a0eb6677468da30013b8c54a7a37c

          SHA256

          7e2c164ef33df9f9c8d4493d7ba3ddffeb8d6a9a6363a76334472f52feb3f5bc

          SHA512

          36419d572cc6e7f08c401dde59233bb4d50939c1471147572f11f1a4896eeb5a89228a945eb43d94fe0a6c44775a16c3b2f1c49691275d814f86105a1a346a49

        • F:\$RECYCLE.BIN\S-1-5-21-2177723727-746291240-1644359950-1000\_desktop.ini

          Filesize

          9B

          MD5

          5e45e0c42537212b4bfef35112ec91ba

          SHA1

          10c59c091fd35facc82bbc96938f118ce5a60546

          SHA256

          9f6b7a83161db36757e96dc40936aec1e5a9a41f9fca089f9cf5a4d695dd5ed5

          SHA512

          ee964e08687daa53fdc8e063402791acb104bd59f5d0f8a6d11d3e889db476315641c38032ade4177cd794b060f9fc4e6fd161989e452aae828c875c747e4bfb

        • memory/1056-36-0x0000000000400000-0x0000000000436000-memory.dmp

          Filesize

          216KB

        • memory/1056-4794-0x0000000000400000-0x0000000000436000-memory.dmp

          Filesize

          216KB

        • memory/1056-32-0x0000000000400000-0x0000000000436000-memory.dmp

          Filesize

          216KB

        • memory/1056-5276-0x0000000000400000-0x0000000000436000-memory.dmp

          Filesize

          216KB

        • memory/1056-19-0x0000000000400000-0x0000000000436000-memory.dmp

          Filesize

          216KB

        • memory/1056-1226-0x0000000000400000-0x0000000000436000-memory.dmp

          Filesize

          216KB

        • memory/1056-9-0x0000000000400000-0x0000000000436000-memory.dmp

          Filesize

          216KB

        • memory/1056-26-0x0000000000400000-0x0000000000436000-memory.dmp

          Filesize

          216KB

        • memory/3184-8-0x0000000000400000-0x0000000000436000-memory.dmp

          Filesize

          216KB

        • memory/3184-0-0x0000000000400000-0x0000000000436000-memory.dmp

          Filesize

          216KB

        • memory/3868-4795-0x000001F416440000-0x000001F416450000-memory.dmp

          Filesize

          64KB

        • memory/3868-4811-0x000001F416540000-0x000001F416550000-memory.dmp

          Filesize

          64KB

        • memory/3868-4827-0x000001F41E840000-0x000001F41E841000-memory.dmp

          Filesize

          4KB

        • memory/3868-4829-0x000001F41E870000-0x000001F41E871000-memory.dmp

          Filesize

          4KB

        • memory/3868-4830-0x000001F41E870000-0x000001F41E871000-memory.dmp

          Filesize

          4KB

        • memory/3868-4831-0x000001F41E980000-0x000001F41E981000-memory.dmp

          Filesize

          4KB