Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/05/2024, 20:15

General

  • Target

    109da4ab2ac58cae981ee416663d723dd0ce0b44bac2f48d101082388ba4c9cc.exe

  • Size

    573KB

  • MD5

    4c40da2c299470aff4edf636d594d13b

  • SHA1

    6491a499509372897548f7e1e5d58f60b481570a

  • SHA256

    109da4ab2ac58cae981ee416663d723dd0ce0b44bac2f48d101082388ba4c9cc

  • SHA512

    c409c8c2d1741ff3c2419e589d3c9bcdb776d5a5ac174516e7b9a40e9f707ad48ca0036e255e2499845b163575dc838d17614b5341d1b15b29f4a7b887e58af0

  • SSDEEP

    6144:MtuJpE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4t0BHQQG:s7a3iwbihym2g7XO3LWUQfh4Co

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3460
      • C:\Users\Admin\AppData\Local\Temp\109da4ab2ac58cae981ee416663d723dd0ce0b44bac2f48d101082388ba4c9cc.exe
        "C:\Users\Admin\AppData\Local\Temp\109da4ab2ac58cae981ee416663d723dd0ce0b44bac2f48d101082388ba4c9cc.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:4856
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF2BC.bat
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4348
          • C:\Users\Admin\AppData\Local\Temp\109da4ab2ac58cae981ee416663d723dd0ce0b44bac2f48d101082388ba4c9cc.exe
            "C:\Users\Admin\AppData\Local\Temp\109da4ab2ac58cae981ee416663d723dd0ce0b44bac2f48d101082388ba4c9cc.exe"
            4⤵
            • Executes dropped EXE
            PID:2600
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:5104
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1084
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
                PID:1880
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3772,i,14486271492189381216,15799931579469722648,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:8
        1⤵
          PID:2916

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

          Filesize

          254KB

          MD5

          f134d58f0c72c193a05ff5819d09f8d6

          SHA1

          85c6d5b8cb938c5b8b7437693a4f6e97caa94fdf

          SHA256

          0b329835e955ce06b673448b91b9bea022bc741cd855123dd5f8988d4385b031

          SHA512

          27c84f45bacb5c95ca340b6a8da7a81ece4cdb3adf2c3f85726f79c7a35cf7b6eb37c6703b6c275d5861ea0585c43c2bbc95f5331aec240ee234fceb72ed33c6

        • C:\Program Files\7-Zip\7z.exe

          Filesize

          573KB

          MD5

          4c40da2c299470aff4edf636d594d13b

          SHA1

          6491a499509372897548f7e1e5d58f60b481570a

          SHA256

          109da4ab2ac58cae981ee416663d723dd0ce0b44bac2f48d101082388ba4c9cc

          SHA512

          c409c8c2d1741ff3c2419e589d3c9bcdb776d5a5ac174516e7b9a40e9f707ad48ca0036e255e2499845b163575dc838d17614b5341d1b15b29f4a7b887e58af0

        • C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe

          Filesize

          639KB

          MD5

          c15cc0560a1f2ab80b80767643b0c1c5

          SHA1

          351e72917155ff3e811334fd55a35be7c7cdf6ea

          SHA256

          c17ea05f90a728f32aa972ff92de25f799ce043ba5a3db5f10b5557f31916858

          SHA512

          11bb18446a38b70dd24c9877ef95d5764d001a8c936cfcb9a5a15275942226cdbb74a1c331d423ccf05b27ea68259e6306dba5ab0ad85b17ec41a15fcdcd4289

        • C:\Users\Admin\AppData\Local\Temp\$$aF2BC.bat

          Filesize

          722B

          MD5

          e7f1b9debfe664cd9c067e9740d12eb1

          SHA1

          e293329e8eb4a5035c2f7cf22d10afd0e4bae7b4

          SHA256

          1fb15c01786ccadc0ef8518b2aad610ce09ad292f389b0fdc73ee90c1fc0aed6

          SHA512

          6e0ff36b8d46514b32350b0810a25f363d28b6b89d14432e890b153fd4f5c52a4b2567b4d65fca0b47db5270b987e67bb8ad70b18eb88b9010eb3f403d8c037d

        • C:\Users\Admin\AppData\Local\Temp\109da4ab2ac58cae981ee416663d723dd0ce0b44bac2f48d101082388ba4c9cc.exe.exe

          Filesize

          544KB

          MD5

          9a1dd1d96481d61934dcc2d568971d06

          SHA1

          f136ef9bf8bd2fc753292fb5b7cf173a22675fb3

          SHA256

          8cebb25e240db3b6986fcaed6bc0b900fa09dad763a56fb71273529266c5c525

          SHA512

          7ac1581f8a29e778ba1a1220670796c47fa5b838417f8f635e2cb1998a01515cff3ee57045dacb78a8ec70d43754b970743aba600379fe6d9481958d32d8a5aa

        • C:\Windows\Logo1_.exe

          Filesize

          29KB

          MD5

          af29fb6a5adf025d9127df13f942d7d2

          SHA1

          72d13969443440eb123cfb43f924c4959eae7638

          SHA256

          d83088ef692a221a033bfb31d7178f7f04182df4480ac946b53807fda9cdd040

          SHA512

          10c6c2a56386b35f52e8b220def9cace7a57a70672a97aeb3c95df14d832416d6057fabccd86c4f473e354a87e378ff0ac3cf0e503ee3db9f909897ef7776079

        • F:\$RECYCLE.BIN\S-1-5-21-1181767204-2009306918-3718769404-1000\_desktop.ini

          Filesize

          9B

          MD5

          392ab9dcf5a9daf53626ea1f2e61d0b9

          SHA1

          0a2cdc7f8f9edf33f9fde3f8b90e0020190c8fb7

          SHA256

          9bbc94aad502d7d7a7f502ddb9cbd93b1c89eff13e445971c94ac09215ada67d

          SHA512

          5d1fea63a7793a65dc63c32cfe3ab2e1af941ded8e760f08fbe991e5b30433f86f920d717235a635020740c8f6f7996b4b8e8147e331b29141fcbb7bdc68144d

        • memory/4856-9-0x0000000000400000-0x0000000000436000-memory.dmp

          Filesize

          216KB

        • memory/4856-0-0x0000000000400000-0x0000000000436000-memory.dmp

          Filesize

          216KB

        • memory/5104-26-0x0000000000400000-0x0000000000436000-memory.dmp

          Filesize

          216KB

        • memory/5104-36-0x0000000000400000-0x0000000000436000-memory.dmp

          Filesize

          216KB

        • memory/5104-32-0x0000000000400000-0x0000000000436000-memory.dmp

          Filesize

          216KB

        • memory/5104-1236-0x0000000000400000-0x0000000000436000-memory.dmp

          Filesize

          216KB

        • memory/5104-19-0x0000000000400000-0x0000000000436000-memory.dmp

          Filesize

          216KB

        • memory/5104-4874-0x0000000000400000-0x0000000000436000-memory.dmp

          Filesize

          216KB

        • memory/5104-12-0x0000000000400000-0x0000000000436000-memory.dmp

          Filesize

          216KB

        • memory/5104-5319-0x0000000000400000-0x0000000000436000-memory.dmp

          Filesize

          216KB