Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    13/05/2024, 20:15

General

  • Target

    109da4ab2ac58cae981ee416663d723dd0ce0b44bac2f48d101082388ba4c9cc.exe

  • Size

    573KB

  • MD5

    4c40da2c299470aff4edf636d594d13b

  • SHA1

    6491a499509372897548f7e1e5d58f60b481570a

  • SHA256

    109da4ab2ac58cae981ee416663d723dd0ce0b44bac2f48d101082388ba4c9cc

  • SHA512

    c409c8c2d1741ff3c2419e589d3c9bcdb776d5a5ac174516e7b9a40e9f707ad48ca0036e255e2499845b163575dc838d17614b5341d1b15b29f4a7b887e58af0

  • SSDEEP

    6144:MtuJpE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4t0BHQQG:s7a3iwbihym2g7XO3LWUQfh4Co

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1180
      • C:\Users\Admin\AppData\Local\Temp\109da4ab2ac58cae981ee416663d723dd0ce0b44bac2f48d101082388ba4c9cc.exe
        "C:\Users\Admin\AppData\Local\Temp\109da4ab2ac58cae981ee416663d723dd0ce0b44bac2f48d101082388ba4c9cc.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:1944
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c C:\Users\Admin\AppData\Local\Temp\$$a274F.bat
          3⤵
          • Deletes itself
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:2700
          • C:\Users\Admin\AppData\Local\Temp\109da4ab2ac58cae981ee416663d723dd0ce0b44bac2f48d101082388ba4c9cc.exe
            "C:\Users\Admin\AppData\Local\Temp\109da4ab2ac58cae981ee416663d723dd0ce0b44bac2f48d101082388ba4c9cc.exe"
            4⤵
            • Executes dropped EXE
            PID:2636
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2804
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2728
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
                PID:1240

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

        Filesize

        254KB

        MD5

        f134d58f0c72c193a05ff5819d09f8d6

        SHA1

        85c6d5b8cb938c5b8b7437693a4f6e97caa94fdf

        SHA256

        0b329835e955ce06b673448b91b9bea022bc741cd855123dd5f8988d4385b031

        SHA512

        27c84f45bacb5c95ca340b6a8da7a81ece4cdb3adf2c3f85726f79c7a35cf7b6eb37c6703b6c275d5861ea0585c43c2bbc95f5331aec240ee234fceb72ed33c6

      • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

        Filesize

        474KB

        MD5

        39d0021b923509b5e31096b0f119bada

        SHA1

        5cdb5aacdc36fc52472de30f738c1770c0be28fa

        SHA256

        6245380525c0df016952045413482bc868b12263353c73d1834e268a634fbd1c

        SHA512

        eb9a24f56f778ab8738acef21ec58815e108f2bfe69d4dfb28c1628a67e0037bcc557591fcdf754815351a8da77fd0315a1271ac1a5ac6d9b3e6c3822519c1cf

      • C:\Users\Admin\AppData\Local\Temp\$$a274F.bat

        Filesize

        722B

        MD5

        6d6fabf62b030b0af44bec7b898b2c3e

        SHA1

        f274769364050270a5b2f0c7100a44eeaa5002bc

        SHA256

        e48de6a090bb8c54a82afa7c470e5abe305292f17e937bcad2d676f140656cd7

        SHA512

        6fe38b0641668511b5881ba70f6be8931a00427690c36360263f786170cb6cec5bd3f182d962fb922cc65986105deb2198d8ed700988d891b8ab02654209aec6

      • C:\Users\Admin\AppData\Local\Temp\109da4ab2ac58cae981ee416663d723dd0ce0b44bac2f48d101082388ba4c9cc.exe.exe

        Filesize

        544KB

        MD5

        9a1dd1d96481d61934dcc2d568971d06

        SHA1

        f136ef9bf8bd2fc753292fb5b7cf173a22675fb3

        SHA256

        8cebb25e240db3b6986fcaed6bc0b900fa09dad763a56fb71273529266c5c525

        SHA512

        7ac1581f8a29e778ba1a1220670796c47fa5b838417f8f635e2cb1998a01515cff3ee57045dacb78a8ec70d43754b970743aba600379fe6d9481958d32d8a5aa

      • C:\Windows\Logo1_.exe

        Filesize

        29KB

        MD5

        af29fb6a5adf025d9127df13f942d7d2

        SHA1

        72d13969443440eb123cfb43f924c4959eae7638

        SHA256

        d83088ef692a221a033bfb31d7178f7f04182df4480ac946b53807fda9cdd040

        SHA512

        10c6c2a56386b35f52e8b220def9cace7a57a70672a97aeb3c95df14d832416d6057fabccd86c4f473e354a87e378ff0ac3cf0e503ee3db9f909897ef7776079

      • F:\$RECYCLE.BIN\S-1-5-21-2737914667-933161113-3798636211-1000\_desktop.ini

        Filesize

        9B

        MD5

        392ab9dcf5a9daf53626ea1f2e61d0b9

        SHA1

        0a2cdc7f8f9edf33f9fde3f8b90e0020190c8fb7

        SHA256

        9bbc94aad502d7d7a7f502ddb9cbd93b1c89eff13e445971c94ac09215ada67d

        SHA512

        5d1fea63a7793a65dc63c32cfe3ab2e1af941ded8e760f08fbe991e5b30433f86f920d717235a635020740c8f6f7996b4b8e8147e331b29141fcbb7bdc68144d

      • memory/1180-30-0x00000000025F0000-0x00000000025F1000-memory.dmp

        Filesize

        4KB

      • memory/1944-17-0x0000000000220000-0x0000000000256000-memory.dmp

        Filesize

        216KB

      • memory/1944-16-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/1944-0-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/2804-32-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/2804-45-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/2804-91-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/2804-97-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/2804-442-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/2804-1874-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/2804-39-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/2804-3334-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/2804-19-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB