Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    24/04/2024, 18:18

General

  • Target

    4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe

  • Size

    169KB

  • MD5

    d87d6facaf717caddf9e05d153ba3c92

  • SHA1

    52a6c747fd184bb09b2a76e534555173d3127ce9

  • SHA256

    4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8

  • SHA512

    e5bcd1335967f0f6d2454c24619d1c8119a17b584340829925cc2ea5f239c1c0b8741729b422e23fa1ab49e4952911ab56786f7743a41d063f3d063ec7edc6ed

  • SSDEEP

    3072:8GYe+azbRPrlr9RXFcQekqnwLD9m0WjfuRRfEdj4E3f90bC:td+azbRZvSQek9if1Vv+W

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 43 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1360
      • C:\Users\Admin\AppData\Local\Temp\4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe
        "C:\Users\Admin\AppData\Local\Temp\4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:624
        • C:\Windows\SysWOW64\net.exe
          net stop "Kingsoft AntiVirus Service"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2992
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
            4⤵
              PID:1196
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c C:\Users\Admin\AppData\Local\Temp\$$a149A.bat
            3⤵
            • Deletes itself
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:1696
            • C:\Users\Admin\AppData\Local\Temp\4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe
              "C:\Users\Admin\AppData\Local\Temp\4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe"
              4⤵
              • Executes dropped EXE
              PID:2844
          • C:\Windows\Logo1_.exe
            C:\Windows\Logo1_.exe
            3⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:544
            • C:\Windows\SysWOW64\net.exe
              net stop "Kingsoft AntiVirus Service"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:2592
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                5⤵
                  PID:2676
              • C:\Windows\SysWOW64\net.exe
                net stop "Kingsoft AntiVirus Service"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:2072
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                  5⤵
                    PID:2788

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

            Filesize

            264KB

            MD5

            ab6e14fd3b3b82a74d70dd03d0a8e116

            SHA1

            e8263c09ed7968ab04e1459ad46041ccdd9ff5e9

            SHA256

            03dda7016a22dd98411b67875e2fe461c960b068fbcb019579d8392530b41571

            SHA512

            851e9288ba102d5eabd34d887b70a883307bce31ccb4c7eeaf2b3010cb6bb9435a9c0261bfdafb4a0bf4046b6bc7928cbfb62599269a9c197ec2f83efaf258e8

          • C:\Users\Admin\AppData\Local\Temp\$$a149A.bat

            Filesize

            722B

            MD5

            ac752ac08790c9821335493d402cec69

            SHA1

            1b2396d690dd2bf5ac7d43b7e8704b0ce0515029

            SHA256

            7bff3378f5e233141d230ce8a60ec8e4b67cde54b107299b1c547916ac3ea034

            SHA512

            7e0976b69beacca5559eb8004e7189879ca5f8e310d2730f4cdeaa01fbb2ef9127f61b1d7e1490db9a04178abf04bcb7e4847792679970c477f977ce92688ec9

          • C:\Users\Admin\AppData\Local\Temp\4a1525c6c0c41e79f0ad44ff4d54e4dd2408358c99d77ac80d53d5134c2384a8.exe.exe

            Filesize

            129KB

            MD5

            11111df26aba5a177fbd3ff2821a9e5d

            SHA1

            dba82329673e02dd99adbeb2d20538d10b6f484a

            SHA256

            25e0e882cca2fc89942924ae208abf9059fe3f8bd87a16f788f8aad1f61521df

            SHA512

            4d814017ce21b06208b5cd6814d40e801283a41216ea27986a88af50d2d61d23e9c54c0aafe6a8c509a94d156c59fb3dc8f46b902bcbc5acd185a712d31b2034

          • C:\Windows\Logo1_.exe

            Filesize

            39KB

            MD5

            bc43e3c481e7fbe3ee697f9017cf4c1b

            SHA1

            6a76534a3a4bd72437b06bdccf1475846d7a308d

            SHA256

            c33f277a3cea2a938fc05fda7bf9b9a0ae89474eaacf6b0b6223e07eb4ec3b6a

            SHA512

            e5c2f3485b7573a6638f6d5ea2907371efc68b35655739e8e0c8f841de9c2d302b246eacb9627912cee5dd7ab0a9f7f652e73eb7d1925ddde20bb92e29310ce1

          • F:\$RECYCLE.BIN\S-1-5-21-3627615824-4061627003-3019543961-1000\_desktop.ini

            Filesize

            9B

            MD5

            f29b71f66ac42a28a8d1e12a13d61861

            SHA1

            bd61fbc8b6eed4cae3fa29d7b950784258be10cd

            SHA256

            9a5e4ff44f8f5bb21798074ea03e493911b59680e37191522562dece826da1cf

            SHA512

            90c31cda60a9a63e3fa78e99f1104d1a9c9f811e11b62f75063b6007ae284c8c233b5d1235defab7ae0deec3b7892c85af9319219405c44d16fa29a3215f50e0

          • memory/544-31-0x0000000000400000-0x000000000043D000-memory.dmp

            Filesize

            244KB

          • memory/544-19-0x0000000000400000-0x000000000043D000-memory.dmp

            Filesize

            244KB

          • memory/544-3318-0x0000000000400000-0x000000000043D000-memory.dmp

            Filesize

            244KB

          • memory/544-4123-0x0000000000400000-0x000000000043D000-memory.dmp

            Filesize

            244KB

          • memory/624-16-0x0000000000400000-0x000000000043D000-memory.dmp

            Filesize

            244KB

          • memory/624-17-0x0000000000280000-0x00000000002BD000-memory.dmp

            Filesize

            244KB

          • memory/624-0-0x0000000000400000-0x000000000043D000-memory.dmp

            Filesize

            244KB

          • memory/1360-27-0x00000000025A0000-0x00000000025A1000-memory.dmp

            Filesize

            4KB