Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    102s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/05/2024, 14:32

General

  • Target

    06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe

  • Size

    33KB

  • MD5

    0323b99a69386f583bbf4aae937b7b9b

  • SHA1

    c4c2024f4b57285e959f6709d007b9fbac8ab7c4

  • SHA256

    06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1

  • SHA512

    6055a4c8e534622d2257ec2d56c5e751b996c97347296479c2e9590a169bb5c019f03fd34757ba248fa4f337b6484c57b2ddcb08b9f49c996446ef797aef3c4e

  • SSDEEP

    768:O+bjjpQFJFKZj1PVs9Ag1vzbrqaMKJcrsu:O+becx1aeg1v2axu

Score
7/10

Malware Config

Signatures

  • Drops startup file 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 60 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3436
      • C:\Users\Admin\AppData\Local\Temp\06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe
        "C:\Users\Admin\AppData\Local\Temp\06b195b9184ba7b73594976c2580f69fd7761a18904e9006dd76a950a6215ee1.exe"
        2⤵
        • Drops startup file
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4132
        • C:\Windows\SysWOW64\net.exe
          net stop "Kingsoft AntiVirus Service"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1560
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
            4⤵
              PID:3980
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:3136
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              4⤵
                PID:1820

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files\dotnet\dotnet.exe

          Filesize

          177KB

          MD5

          f2751b0158447769335cebe34c2d82d9

          SHA1

          9d413b52a50071f39ef72635f1365fd237d44d84

          SHA256

          7525f335f9b13f85df57c421fca09cd644fdbba67a79916e784417f30de15f5c

          SHA512

          b0c3b79073ff4f5ef88c48b026ad396f476daf5d51291ce9932bf7005cec3d2d52d38f9b17f956ee42a731f964b3bd400549a8be2b1760bec82e61c0a6b5aa0b

        • C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe

          Filesize

          643KB

          MD5

          b489893e2a89eb1682d618b8824fb7c3

          SHA1

          8f929e84ce714a7247920ec3902292e977ebb26d

          SHA256

          720afba2de160448f339c299f4607089254ec8f82168694d7808273128822e81

          SHA512

          a6f03b3cd792ad476e69854adc6280898882379bba50bab0af36d718d5b6806b585f172024f99a4f282785b9759ad3383643c9283daaa5947b79e8102d2c90c1

        • F:\$RECYCLE.BIN\S-1-5-21-3558294865-3673844354-2255444939-1000\_desktop.ini

          Filesize

          9B

          MD5

          588b2065b2adfd8dfd688104d02aad5a

          SHA1

          263f0ca294d728a13f51220aea8123aa257cc6e2

          SHA256

          f9ab49edf14c6bda17287f7caa63d3b3bb20a65215f1462cf05577a5c1c472e6

          SHA512

          99106035ac4547c81fd737f5f79ddd32ea10fde9e3ea97102472c871aa9f94ee3f68823bcc4bb308e92265a9c3cacd4b1f5c9f52f8d3e630cdf6bdcd3c737e2d

        • memory/4132-0-0x0000000000400000-0x000000000043D000-memory.dmp

          Filesize

          244KB

        • memory/4132-3-0x0000000000400000-0x000000000043D000-memory.dmp

          Filesize

          244KB

        • memory/4132-5161-0x0000000000400000-0x000000000043D000-memory.dmp

          Filesize

          244KB

        • memory/4132-8618-0x0000000000400000-0x000000000043D000-memory.dmp

          Filesize

          244KB