Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/05/2024, 18:14

General

  • Target

    eb5864695d1454702d0bd1c69607bf5ce80fb8650e02350c1cef8dcea1565389.exe

  • Size

    711KB

  • MD5

    a4c9273285b71241d7773f5dcb5974b6

  • SHA1

    c0be46e8031968a721d9c0e46a50ec806d7cbeae

  • SHA256

    eb5864695d1454702d0bd1c69607bf5ce80fb8650e02350c1cef8dcea1565389

  • SHA512

    060aa3e936c36f1bb99e86c8f7e307b20c872a8e9b6e40db7e7bc5d9a255f01fab4bbadb49a8cb407a742dc992213553dbc36e27afbabe16a490a6360b8a6ab8

  • SSDEEP

    12288:4pKfC6Aj+TN5uixZN+8rKhUdTC/wE1ZD0Ca5ZIXV:4pGLOS2opPIXV

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3544
      • C:\Users\Admin\AppData\Local\Temp\eb5864695d1454702d0bd1c69607bf5ce80fb8650e02350c1cef8dcea1565389.exe
        "C:\Users\Admin\AppData\Local\Temp\eb5864695d1454702d0bd1c69607bf5ce80fb8650e02350c1cef8dcea1565389.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:4316
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3642.bat
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4588
          • C:\Users\Admin\AppData\Local\Temp\eb5864695d1454702d0bd1c69607bf5ce80fb8650e02350c1cef8dcea1565389.exe
            "C:\Users\Admin\AppData\Local\Temp\eb5864695d1454702d0bd1c69607bf5ce80fb8650e02350c1cef8dcea1565389.exe"
            4⤵
            • Executes dropped EXE
            PID:3788
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1176
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:4644
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
                PID:5012

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe

        Filesize

        244KB

        MD5

        47d135643eeed54ad85cec260cc76e45

        SHA1

        08e793953a682b5d67b27d2cd70ce358ac20fa0c

        SHA256

        4bed0b6ecc60a752c99ed16d02594d77270dfb4f5acbbb4bb275298aa19860b9

        SHA512

        69e31809429dac87cd58d75135d590a02b3dc2f11c3d02b8dedef0d5ce6d8ab292080f574667db20a938181d4113e10c193220c2db3a42fdc5e04783380a1bba

      • C:\Program Files\7-Zip\7z.exe

        Filesize

        571KB

        MD5

        3cd8ae6e0f7cc54f470add96dba2c0e2

        SHA1

        04a92c6de96a1138d2c36a144a8d75a8679e70d2

        SHA256

        4f44c07cdece9db55b5a3fddb2132442b888aa3db737dd1cb61de567929320ef

        SHA512

        2fa5949a6fec179932c20474bd8215c8caa1800efd397775e0b57c892deb987acabad528a2b83b1dbdc9daac04ed9fba4366b7207211e2badcdf33370120e329

      • C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe

        Filesize

        637KB

        MD5

        9cba1e86016b20490fff38fb45ff4963

        SHA1

        378720d36869d50d06e9ffeef87488fbc2a8c8f7

        SHA256

        a22e6d0f5c7d44fefc2204e0f7c7b048e1684f6cf249ba98c006bbf791c22d19

        SHA512

        2f3737d29ea3925d10ea5c717786425f6434be732974586328f03691a35cd1539828e3301685749e5c4135b8094f15b87fb9659915de63678a25749e2f8f5765

      • C:\Users\Admin\AppData\Local\Temp\$$a3642.bat

        Filesize

        722B

        MD5

        01ba877da1b8cd912f5b0a39ba6087fa

        SHA1

        4022768b6fddf2e47d4f8f257729e716977b8dfb

        SHA256

        9e75fd3ba27989c1084ed647fbc9ae1efc657cc24005cac26fd74d72bc6a4956

        SHA512

        78ca779af41f03ec724eed47e9e2a7bd6aac9efb98adff7a4b2a5a3dc45051b9457cbcd822aad290c47e34f62bf1a82a9fdcf95c45b75d6456ff18e8ba491f30

      • C:\Users\Admin\AppData\Local\Temp\eb5864695d1454702d0bd1c69607bf5ce80fb8650e02350c1cef8dcea1565389.exe.exe

        Filesize

        684KB

        MD5

        50f289df0c19484e970849aac4e6f977

        SHA1

        3dc77c8830836ab844975eb002149b66da2e10be

        SHA256

        b9b179b305c5268ad428b6ae59de10b4fe99cf0199bbc89b7017181905e97305

        SHA512

        877d852ea1062b90e2fd2f3c4dc7d05d9697e9a9b2929c830a770b62741f6a11e06de73275eb871113f11143faf1cb40d99f7c247862ffb778d26833ed5d7e38

      • C:\Windows\Logo1_.exe

        Filesize

        27KB

        MD5

        0d2afc52185c36893aa016ece9778d83

        SHA1

        4ceaeffd92c7f5abac141778640daa10bfe6c37d

        SHA256

        b73d7ec870f452f48c61bbd2e314df032cc8265e34f4f6b61d27ab8aef9097fa

        SHA512

        964b28cd5568a2c31a183e73d17c1ce39e35715442e1c6e63b1d9da54f087e176657eb7866d7f61fcf0b4a600c02bcd928d45667a6a4c64701e116ad59d5bbd3

      • F:\$RECYCLE.BIN\S-1-5-21-17203666-93769886-2545153620-1000\_desktop.ini

        Filesize

        8B

        MD5

        35a8ee2041a708d5071bff39818311c3

        SHA1

        31114ee16a39b8ada4130a94c1c36ed74a563d2a

        SHA256

        b2405b086204a9155a2dabf58717e53695089ece5d0af208cb960473ba350f8b

        SHA512

        f17fa8c794a47b0134ac4d8e83010e8dce1a0f2ab74a400c571d6470737e386f4eb1351be6c5b153dc063c49d333b69ddf67871d2e0ffb3c02d243be0015f1f0

      • memory/1176-27-0x0000000000400000-0x0000000000435000-memory.dmp

        Filesize

        212KB

      • memory/1176-33-0x0000000000400000-0x0000000000435000-memory.dmp

        Filesize

        212KB

      • memory/1176-37-0x0000000000400000-0x0000000000435000-memory.dmp

        Filesize

        212KB

      • memory/1176-20-0x0000000000400000-0x0000000000435000-memory.dmp

        Filesize

        212KB

      • memory/1176-1237-0x0000000000400000-0x0000000000435000-memory.dmp

        Filesize

        212KB

      • memory/1176-11-0x0000000000400000-0x0000000000435000-memory.dmp

        Filesize

        212KB

      • memory/1176-4801-0x0000000000400000-0x0000000000435000-memory.dmp

        Filesize

        212KB

      • memory/1176-5264-0x0000000000400000-0x0000000000435000-memory.dmp

        Filesize

        212KB

      • memory/4316-0-0x0000000000400000-0x0000000000435000-memory.dmp

        Filesize

        212KB

      • memory/4316-9-0x0000000000400000-0x0000000000435000-memory.dmp

        Filesize

        212KB