Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    153s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/05/2024, 06:15

General

  • Target

    0443b28d1096b9ee3e03aa78d74e531cfffc9842770127532dd8d1b4678b8b9d.exe

  • Size

    926KB

  • MD5

    1a3a325061c8d7bc7efc9e3709c0120d

  • SHA1

    e9f0edf40d6ce7705c713e82e637816afcf46dce

  • SHA256

    0443b28d1096b9ee3e03aa78d74e531cfffc9842770127532dd8d1b4678b8b9d

  • SHA512

    5ed1f79609a72d970f273292c096f8c18c9051b228412b091caa5675f981256512bbc4138393c44716bf5dc575bbbfce4c6dec89ebddcb3a44945bde72724c9b

  • SSDEEP

    12288:U7+lIzIM4/h0cRjG/kvMTheu8WDY3HlHgUoSPL/W/ZlW+V1jrpduBgVXceR5+n1p:U7sX/h0cEnh8WD8lHvWjW+DXp6rwPu9Z

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3332
      • C:\Users\Admin\AppData\Local\Temp\0443b28d1096b9ee3e03aa78d74e531cfffc9842770127532dd8d1b4678b8b9d.exe
        "C:\Users\Admin\AppData\Local\Temp\0443b28d1096b9ee3e03aa78d74e531cfffc9842770127532dd8d1b4678b8b9d.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:3016
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2EDB.bat
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2396
          • C:\Users\Admin\AppData\Local\Temp\0443b28d1096b9ee3e03aa78d74e531cfffc9842770127532dd8d1b4678b8b9d.exe
            "C:\Users\Admin\AppData\Local\Temp\0443b28d1096b9ee3e03aa78d74e531cfffc9842770127532dd8d1b4678b8b9d.exe"
            4⤵
            • Executes dropped EXE
            PID:2720
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2248
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1364
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
                PID:1968
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3740 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:8
        1⤵
          PID:4940

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files\7-Zip\7z.exe

          Filesize

          570KB

          MD5

          cdf329dfb35eba6f9f8334708e4862a5

          SHA1

          b737a5ac4e62da9174760c8b8adf782dab5f9cdd

          SHA256

          e5fd326ef628b19f87a5bf51f8bd04aa3583167e022b99e781b07d498077bc1f

          SHA512

          083b3846dfb03bd6a8623c1f5001a184f4987fb66ac2b94bbc51b78f0ceb08146deb1abaabac6f852a92e5f1698f7cb526f5f74b1435fa8e2b90a0a4964d54f4

        • C:\Users\Admin\AppData\Local\Temp\$$a2EDB.bat

          Filesize

          722B

          MD5

          ad05349c77a3c5a3a1be4702e000cb51

          SHA1

          d886dd4eeb1f8ffca840cdbe7f2359b074823372

          SHA256

          b02ccb4b6b5a93d32fa5a1e455cb7881ac1132af31546cb668d3ed088ad7532d

          SHA512

          b52404aa128a747c67421bfe706bdd1ab63ed2a071ef132451644f27ede060a5444605684bfcb5c74995d21ce7b4e48a8184743cc873747f0dc2636dc663133d

        • C:\Users\Admin\AppData\Local\Temp\0443b28d1096b9ee3e03aa78d74e531cfffc9842770127532dd8d1b4678b8b9d.exe.exe

          Filesize

          899KB

          MD5

          2cb5bc00421e0a0193169be2009d0022

          SHA1

          9a2754b0c2906dd64c1b2553246a232dc7c09bc1

          SHA256

          f5591ec5909f8cd792c709a3772bdd4441243e673b703c4395d5755dbb638c76

          SHA512

          35e1b408fe0c2f9b7dfc1e51ec9fe15029e53dd88a714e26c19f46711064e000f9bc44c1aef8adad3d647cd58bd5270202a2efd7f7fe30b6d1e1af028bae1cad

        • C:\Windows\Logo1_.exe

          Filesize

          26KB

          MD5

          eae720ddb96259ba9cc84160c4e6db6b

          SHA1

          6e6aa6b84edda1752d2720be3269e5df9a7dbc91

          SHA256

          1e3b3150146e34c2742aa0816cab9a3720ecb9f8e6ad85db6db8624ca6a57760

          SHA512

          a386e5ebbe057131bfcbafcd14f2efe8cb486238394819e681feb1dc7fb5695df660cb2e6dc1ce3a944b1eabc365d91994ed1f137bde0a41d8a4c882428e7610

        • F:\$RECYCLE.BIN\S-1-5-21-3808065738-1666277613-1125846146-1000\_desktop.ini

          Filesize

          8B

          MD5

          d970a2bfcaa076939c06270d1a48dec8

          SHA1

          7a558f4d64c3e98bcfd2af83f28e6fbd207a39e1

          SHA256

          bdc6872f9a0a011a670907f0fedad9b88e283c5af545cf9f6bd73c3709967d44

          SHA512

          ea4c16930628455852ce343f8ae248b6df869b8da10b10928ebb802129f73d9761971811de317c7d3121b815340027782ec15d385d1d2d7df8fd0a46b62974c2

        • memory/2248-39-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/2248-20-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/2248-10-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/2248-25-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/2248-28-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/2248-34-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/2248-43-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/2248-326-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/2248-1017-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/2248-1018-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/3016-13-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/3016-0-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/3016-1-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB