Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/05/2024, 23:24

General

  • Target

    88aed89c6ab9c640c79069ff683d3f80bfd9e464c61dd045c524ea643226feb4.exe

  • Size

    3.8MB

  • MD5

    1850c1568c050d43c151f33e21bd9845

  • SHA1

    fe38252bc5e059b57cb86cba13a51fe63dbbe44c

  • SHA256

    88aed89c6ab9c640c79069ff683d3f80bfd9e464c61dd045c524ea643226feb4

  • SHA512

    ac4e5c8889e89fad5336cdd964397d7dbd04725926376a70549cfdd10ae825024222fd9fa679c9b95b54ddf6f8c180e04c40679ed4f504180f8c20d48470124e

  • SSDEEP

    98304:S98oB054pnlAlOeOONTw43gi67Q5iryIRl0xlvJOtBaqf:S98356CXT870oHzKAaqf

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

Processes

  • C:\Users\Admin\AppData\Local\Temp\88aed89c6ab9c640c79069ff683d3f80bfd9e464c61dd045c524ea643226feb4.exe
    "C:\Users\Admin\AppData\Local\Temp\88aed89c6ab9c640c79069ff683d3f80bfd9e464c61dd045c524ea643226feb4.exe"
    1⤵
    • Loads dropped DLL
    • Writes to the Master Boot Record (MBR)
    PID:4964
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4264 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:3484

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\LDSGameMaster\Store\360Base.dll

      Filesize

      862KB

      MD5

      ab00bed7cb2b7a8290e247fc34aaa5ff

      SHA1

      d6014e2920d9b587a8e12ae1ba0f1e1fc9edffa8

      SHA256

      ceffaedc050688e8dcc11ec30b703c63fefbfcf479558604fdb0ea42bcb497c0

      SHA512

      fbe3bf5e142d689bb15d05503fcf5c807aad5bcb99a02dc99590589ee66f7942a0d8365d470041972212dbdf9c232ab4bbab25e79d7bcd43f001a95d9012cca6

    • C:\Users\Admin\AppData\Local\Temp\{4D137226-ECDF-4d9d-8850-9997FF8D83D9}.tmp\7z.dll

      Filesize

      1.0MB

      MD5

      b902e3ce824b63d3220bff0150097f83

      SHA1

      efb511c687b1376b683cac4dfe26e044535aa8d3

      SHA256

      bc19ccc142de96f79288a7edd5468b5e9a96a35a64c888a6e9a9733933c4ae51

      SHA512

      ace3714e3d5c1409636478564c4ea1828c97cbeacea0e1ab95ec353e898bafcef0c682c780cbfa49589a480d36f0962c805508f4df1b430efb5955c9290b9656

    • C:\Users\Admin\AppData\Local\Temp\{A0B8C305-1D23-4bc9-8429-AF822BACE323}.tmp\360NetUL.dll

      Filesize

      234KB

      MD5

      cd03029957ebc78c0ca7a6c02a9ca846

      SHA1

      0044114b8073781479044f0294701be9611be2ac

      SHA256

      139fdd92e6ddf1aac0761a68502b374daa32e82039621018511dc491ed9b4048

      SHA512

      14c641cb9536def0ddc1969d50b97b83a23017c97373e3ad74d3fbf9825ac81f3fdf8169281c8ad4cebd45d9c9ae05f752d553ba4653e620889b274479cb7c32

    • C:\Users\Admin\AppData\Local\Temp\{A0B8C305-1D23-4bc9-8429-AF822BACE323}.tmp\NetBridge.dll

      Filesize

      238KB

      MD5

      8786d469338c30e0ba9fedfc62bd5197

      SHA1

      5fb12028ceae9772f938e1b98b699f0e02e32718

      SHA256

      beeaf8b72f7008e9adabacfcd85e32a50747a0dfb5c86802aeb973bd1f5c3d2f

      SHA512

      5db1e5b78e62cda81a63e8e712e720f87a7c7a539237a55a9098c076f9fb4e0b5adb83383c23657b4ccc90c117e55e3946a399cdf3d15cb94444b203d9d6c45c

    • C:\Users\Admin\AppData\Local\Temp\{A0B8C305-1D23-4bc9-8429-AF822BACE323}.tmp\Utils\LDSBasic.dll

      Filesize

      2.0MB

      MD5

      cc7b7a2d031fbef005b82bc5221e6046

      SHA1

      61b9cf646825c37e5262ab5b2ecc755d72770393

      SHA256

      28f4e42556497b05a017309c69c7e62683a043ab1c452170056a1b5f77175633

      SHA512

      ec67289b40e88acb946c18890e40e53322b386ce17c351c5fbbebccae84b6d16c2df79ebe79a143d1276101151544aa24a65bdd3101cfd096390034aa70d3e29