Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    29/05/2024, 15:14

General

  • Target

    8aaa8b892b24ec2f7f914fca94a3e72952178ab6e732a8342f18e737060ed1a0.exe

  • Size

    29KB

  • MD5

    4f5d22667d150fcb87a131ecf4f18373

  • SHA1

    ea6b17b4d068f007f17dcc1d2af587a5969ae213

  • SHA256

    8aaa8b892b24ec2f7f914fca94a3e72952178ab6e732a8342f18e737060ed1a0

  • SHA512

    cbce12b897e11aab465fc244a7442f89ea5eac1a0e3bea595eae4951a454a51e065063a68771ee96588ed0b9674777f25776221bed1829075540541a9e28f6e1

  • SSDEEP

    384:NbbfY3kjoTR1V1Gt5M0zhIV/DZ3KZp7JcTO4yf9Knuf2MqlUV2V9wVfUnfRqOzG4:pVjK7V16GVRu1yK9fMnJG2V9dHS8

Score
6/10

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1184
      • C:\Users\Admin\AppData\Local\Temp\8aaa8b892b24ec2f7f914fca94a3e72952178ab6e732a8342f18e737060ed1a0.exe
        "C:\Users\Admin\AppData\Local\Temp\8aaa8b892b24ec2f7f914fca94a3e72952178ab6e732a8342f18e737060ed1a0.exe"
        2⤵
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2240
        • C:\Windows\SysWOW64\net.exe
          net stop "Kingsoft AntiVirus Service"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1432
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
            4⤵
              PID:1732

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

        Filesize

        254KB

        MD5

        d86e00fdec23784005bc452f437fedb8

        SHA1

        5c8d5c4952600659f2177262c2b0554e5dcebd64

        SHA256

        aa56ba1e1b10017ed23bccf1d5ba69dede6dc8dfa40ea585bce45dfd8ae3f0c3

        SHA512

        648667cbdbf62b8ca75fc0091f9313a0a0d76bb2b2f3c1db4464bb8f3299562bcd247a7443dc55af7a05090a6e3acc98d8af10fd33ffad543f841152a1ccef77

      • C:\Program Files\7-Zip\7zFM.exe

        Filesize

        959KB

        MD5

        e725f7863f34c3cb4588ec4a6f5116c5

        SHA1

        986374c0d52122834050f341b01024e6fa3f5e2e

        SHA256

        7ade5b08a155aa077a3cedba8be99251c39efe22007d5ae75529726237da0aec

        SHA512

        9ebcfc5e62cd84d0852ee0733299d5aed0141ccaf20f40762df0626c4d3cf7c42e3eb64054ad0c05a5dddf8562421bb690515df574bb5624da130d4e105496b5

      • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

        Filesize

        474KB

        MD5

        999390d1a073d9d30149bfd4832f8783

        SHA1

        23e02a9b82087dc821baf05fe75ce2b81c62d05e

        SHA256

        4c78f9b1285631d761c8005fefa2a29d047f08edd4a8c39c402e351002fc7cb5

        SHA512

        22fe988e5b37e9a1a385bb972f53316141faa3266347e1d2142fe96725d40ee761c8fec13a4c20ada087607e1dc0f4375c329fe03b8c07af6c957a65eb5121bf

      • F:\$RECYCLE.BIN\S-1-5-21-2737914667-933161113-3798636211-1000\_desktop.ini

        Filesize

        9B

        MD5

        4b2b75605a65a6762ec4715de0a70902

        SHA1

        3b85993ef06d2d814abc405188fdd19a1bffea0c

        SHA256

        77072cc5a7b394508cf5d819ff8cf4385a9b3cb15d8715a59845ccfa235ea34e

        SHA512

        888361e75afd4308bdad817af543704a42ffdf2d798acef619459e9978ac68f1cf4d468c6e0b146ab738b0109fdf331c4380471aa83f637b0f6ab06164840c65

      • memory/1184-5-0x0000000002DC0000-0x0000000002DC1000-memory.dmp

        Filesize

        4KB

      • memory/2240-66-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/2240-0-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/2240-72-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/2240-20-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/2240-776-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/2240-1849-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/2240-14-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/2240-2934-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/2240-3309-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/2240-7-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB