Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    97s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/05/2024, 15:14

General

  • Target

    8aaa8b892b24ec2f7f914fca94a3e72952178ab6e732a8342f18e737060ed1a0.exe

  • Size

    29KB

  • MD5

    4f5d22667d150fcb87a131ecf4f18373

  • SHA1

    ea6b17b4d068f007f17dcc1d2af587a5969ae213

  • SHA256

    8aaa8b892b24ec2f7f914fca94a3e72952178ab6e732a8342f18e737060ed1a0

  • SHA512

    cbce12b897e11aab465fc244a7442f89ea5eac1a0e3bea595eae4951a454a51e065063a68771ee96588ed0b9674777f25776221bed1829075540541a9e28f6e1

  • SSDEEP

    384:NbbfY3kjoTR1V1Gt5M0zhIV/DZ3KZp7JcTO4yf9Knuf2MqlUV2V9wVfUnfRqOzG4:pVjK7V16GVRu1yK9fMnJG2V9dHS8

Score
6/10

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3452
      • C:\Users\Admin\AppData\Local\Temp\8aaa8b892b24ec2f7f914fca94a3e72952178ab6e732a8342f18e737060ed1a0.exe
        "C:\Users\Admin\AppData\Local\Temp\8aaa8b892b24ec2f7f914fca94a3e72952178ab6e732a8342f18e737060ed1a0.exe"
        2⤵
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1472
        • C:\Windows\SysWOW64\net.exe
          net stop "Kingsoft AntiVirus Service"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2804
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
            4⤵
              PID:2660

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

        Filesize

        254KB

        MD5

        d86e00fdec23784005bc452f437fedb8

        SHA1

        5c8d5c4952600659f2177262c2b0554e5dcebd64

        SHA256

        aa56ba1e1b10017ed23bccf1d5ba69dede6dc8dfa40ea585bce45dfd8ae3f0c3

        SHA512

        648667cbdbf62b8ca75fc0091f9313a0a0d76bb2b2f3c1db4464bb8f3299562bcd247a7443dc55af7a05090a6e3acc98d8af10fd33ffad543f841152a1ccef77

      • C:\Program Files\7-Zip\7zG.exe

        Filesize

        713KB

        MD5

        137dbc03d26ff317da5b903922cd14ba

        SHA1

        953da8f440f9658d5bab99d21445cdcb93da77fb

        SHA256

        aeea98e498eb922d5f8d599a8551362a2235fa13e9c8736ef2135522eeee13d4

        SHA512

        7bf5ba297f8694eb957115b4b385b1aa3761f9a180dc2e63d48479cc790ddc83ce6aafce370bec95f8ae821e6cabb7c36e1fdaeeab03b9cea0e7ae36232fc08b

      • C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe

        Filesize

        639KB

        MD5

        a3605b51d03ea8bc68b35024e3706893

        SHA1

        6c38dddfa42e9a668cdc457a931799ed35e2db9b

        SHA256

        351fb1ee45499709bec5874e2bedd85b14730aad55d91a1f31a28a23c83ae903

        SHA512

        4d7e3f4704132ef680054c46f06879f8028e103b36a6c9d640ea155b8ee660402efd31469cc3857b1fc10f904ac9e41d2e85f88c18ad5d5c841d30b93de30533

      • F:\$RECYCLE.BIN\S-1-5-21-3571316656-3665257725-2415531812-1000\_desktop.ini

        Filesize

        9B

        MD5

        4b2b75605a65a6762ec4715de0a70902

        SHA1

        3b85993ef06d2d814abc405188fdd19a1bffea0c

        SHA256

        77072cc5a7b394508cf5d819ff8cf4385a9b3cb15d8715a59845ccfa235ea34e

        SHA512

        888361e75afd4308bdad817af543704a42ffdf2d798acef619459e9978ac68f1cf4d468c6e0b146ab738b0109fdf331c4380471aa83f637b0f6ab06164840c65

      • memory/1472-12-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/1472-18-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/1472-22-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/1472-0-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/1472-1137-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/1472-1218-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/1472-5-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/1472-4796-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/1472-5235-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB