Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    102s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/05/2024, 15:18

General

  • Target

    fc0f1cd2bd9ca1d71948e411a8d33fc4a8134a2678aee2a98a7a0d21b5335a22.exe

  • Size

    82KB

  • MD5

    5e2b7d26b895f73f6e4c81b7efa94704

  • SHA1

    15c5ff67521ef57790f04f05069008d34edce72b

  • SHA256

    fc0f1cd2bd9ca1d71948e411a8d33fc4a8134a2678aee2a98a7a0d21b5335a22

  • SHA512

    b51b39f7cf1b45c95a690d7f62ef489987f4a0f0564818f88e1aa30da0f320faabb11e66952e1aec51ba5267c18c7c27dabd6a38da1079905ad59383f797ff23

  • SSDEEP

    1536:PqsaYzMXqtGNttyUn01Q78a4Re2zHxvuS6YGJYjilZrPMC5V:PqsaY46tGNttyJQ7KRv6Y0ZIC5V

Score
8/10

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3416
      • C:\Users\Admin\AppData\Local\Temp\fc0f1cd2bd9ca1d71948e411a8d33fc4a8134a2678aee2a98a7a0d21b5335a22.exe
        "C:\Users\Admin\AppData\Local\Temp\fc0f1cd2bd9ca1d71948e411a8d33fc4a8134a2678aee2a98a7a0d21b5335a22.exe"
        2⤵
        • Drops file in Drivers directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1920
        • C:\Windows\SysWOW64\net.exe
          net stop "Kingsoft AntiVirus Service"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4636
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
            4⤵
              PID:5008
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a44C9.bat
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1840
            • C:\Users\Admin\AppData\Local\Temp\fc0f1cd2bd9ca1d71948e411a8d33fc4a8134a2678aee2a98a7a0d21b5335a22.exe
              "C:\Users\Admin\AppData\Local\Temp\fc0f1cd2bd9ca1d71948e411a8d33fc4a8134a2678aee2a98a7a0d21b5335a22.exe"
              4⤵
              • Executes dropped EXE
              PID:3356
          • C:\Windows\Logo1_.exe
            C:\Windows\Logo1_.exe
            3⤵
            • Drops file in Drivers directory
            • Drops startup file
            • Executes dropped EXE
            • Enumerates connected drives
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1764
            • C:\Windows\SysWOW64\net.exe
              net stop "Kingsoft AntiVirus Service"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:2716
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                5⤵
                  PID:3848
              • C:\Windows\SysWOW64\net.exe
                net stop "Kingsoft AntiVirus Service"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:3068
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                  5⤵
                    PID:3644

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe

            Filesize

            251KB

            MD5

            27df0d40429e33df59e61fced7de1435

            SHA1

            e9b8fcd2042eda40526474ee7b207adf5bf903a8

            SHA256

            9e252c3d026541314681db1a8038865cda886902eb57a149b5613dc252ddcac7

            SHA512

            7965301ca8af9e640822a96c77c8a909c56119d319522e0a6cda00d7c4e6c5375b67fe6f6715924b998d74d080b6242343e43fb39642c1f285462a764312832d

          • C:\Program Files\RestartResolve.exe

            Filesize

            638KB

            MD5

            5f8bddf5453c0d62a634f32aed960399

            SHA1

            85df628debada7dfbe21d3148d9eb442c823cbb5

            SHA256

            777f94b77a1cb34b3fb0fa4aa9feddcbcce3969c4c61d3dcccdee0dfe3614bc8

            SHA512

            ccc61ea9ba2e460d3c4691619bbeae68b51ae940c76a01e23a8b96b79c3bee68dce81c0d3620a31fcf884d57d9ba498f4f59cbeb3f4c077628c2cecc63610ec1

          • C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe

            Filesize

            643KB

            MD5

            635e9422a0a86f5c7ac989802b0ac448

            SHA1

            3ea9cc1462b063639526a8d278b571f38b846d1d

            SHA256

            a97d8545a6204abf1a179f2098ca8780e92f4448c7a03e62f6c32e8e5e5cb17f

            SHA512

            857c6d683fe1f7a6757420c84efc4f7f48f58e586e601c969ce27e4ded8cad6ca774ef367a1a1e075081c4e2d41f8cdda558fddf5622e062975cfeff5a929133

          • C:\Users\Admin\AppData\Local\Temp\$$a44C9.bat

            Filesize

            722B

            MD5

            c16627ce9289d0be8239e2ce080a9c74

            SHA1

            10280d2b7512aa4a216507cc5537866e5d537353

            SHA256

            45b6c0643fa9c309f138b2b239c6047903525c374c94a07184ae6f08a1f830d5

            SHA512

            66973a58fba44bb39e3eb409da51f883abdded8459e9f536fcce636046be3baa1ecbec845ce43101c46f24315e46e72ed8e732ef4ea930e2b281346f578d3950

          • C:\Users\Admin\AppData\Local\Temp\fc0f1cd2bd9ca1d71948e411a8d33fc4a8134a2678aee2a98a7a0d21b5335a22.exe.exe

            Filesize

            48KB

            MD5

            422a02111fabd3e229ffd105d6054f56

            SHA1

            7930d07dbc89c1113eec7cbd492daf3a025939b2

            SHA256

            2d6bd317e34216f318ce9fb34fbc24e6260b1472930a8c0f126792f8ff821a9e

            SHA512

            a46b5f8b6cb3cf2cb9714a0708ff63dfe4b543ab4a651f2b8ab93ce54ae77e8c7f6d67a8d9d4481957ada966f778ac6d1cceb24b1d8bbad2a6bca77b0bc9ea59

          • C:\Windows\Logo1_.exe

            Filesize

            33KB

            MD5

            548b59c56dea702c153092f3c9befd52

            SHA1

            77d37ef5a746ee53d8b7c3ae82c4d2eca3e05d08

            SHA256

            e67be4ca1372399b73443f6f60c634806266796a0c84a22a55fa0080eca30b3f

            SHA512

            0ada1c693a1a40ff9d5407b633a4571268830bfd7edfa7bea370c96675a73269c4861c1c19a7ed478b42e95a91bceb386ce90bd7601cee4ca1076976d00e2e7c

          • C:\Windows\system32\drivers\etc\hosts

            Filesize

            842B

            MD5

            6f4adf207ef402d9ef40c6aa52ffd245

            SHA1

            4b05b495619c643f02e278dede8f5b1392555a57

            SHA256

            d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e

            SHA512

            a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47

          • F:\$RECYCLE.BIN\S-1-5-21-2818691465-3043947619-2475182763-1000\_desktop.ini

            Filesize

            8B

            MD5

            1b16d2dbd4281ce4e4e5729c608dcb0b

            SHA1

            851e624080ba5598edb808d4b30fe2d74999ce18

            SHA256

            c9e46fb51d0588ca1e48ca66731e11992770b9b74a982f9bdbb6ce5b5b75d549

            SHA512

            cd1c4cf7c7871cb48ce735226b25f689b340037e6c992441e566161de7fca7410762d1a0c2670ee4b6546f7ee854d3219e0e2315c3e0387d9bbe3f08076b5a59

          • memory/1764-20-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

          • memory/1764-12-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

          • memory/1764-5185-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

          • memory/1764-8735-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

          • memory/1920-0-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

          • memory/1920-10-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB