Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    01/06/2024, 01:35

General

  • Target

    eec3f6d7d66da25a403c600293d487970708157dd208f6e77508e4eda74db94b.exe

  • Size

    68KB

  • MD5

    6a5ba4066e40dd9bf9772295c5f2c6ba

  • SHA1

    d71fa514a359f5ac2bf7a6f245cfd81d92d472d6

  • SHA256

    eec3f6d7d66da25a403c600293d487970708157dd208f6e77508e4eda74db94b

  • SHA512

    9e5626387138cc68ffef1e206486bb234001d6c73395c0303e294a06792c682244787996a29e44f861d08ff9250852b60a549893bccfdfd009c19e78adca89ee

  • SSDEEP

    1536:JLz3SHmLKarIpYeEToa9D4ZQKbgZi1dst7x9PxQ:VkF3pdlZQKbgZi1St7xQ

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1136
      • C:\Users\Admin\AppData\Local\Temp\eec3f6d7d66da25a403c600293d487970708157dd208f6e77508e4eda74db94b.exe
        "C:\Users\Admin\AppData\Local\Temp\eec3f6d7d66da25a403c600293d487970708157dd208f6e77508e4eda74db94b.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:1924
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c C:\Users\Admin\AppData\Local\Temp\$$aFBA.bat
          3⤵
          • Deletes itself
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:2984
          • C:\Users\Admin\AppData\Local\Temp\eec3f6d7d66da25a403c600293d487970708157dd208f6e77508e4eda74db94b.exe
            "C:\Users\Admin\AppData\Local\Temp\eec3f6d7d66da25a403c600293d487970708157dd208f6e77508e4eda74db94b.exe"
            4⤵
            • Executes dropped EXE
            PID:1944
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2592
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2604
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
                PID:2724

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

        Filesize

        252KB

        MD5

        e51b1ea24d8739a33beec03e98ea799d

        SHA1

        359852502dbf1c0e6a5b42f9bd279e3a164c5059

        SHA256

        bfee2fff789c9b51161e79e8d91a226773e5dfb5deb5f8bd2eb94d6cae2d9a61

        SHA512

        04659e8f2d599e4bc36589034ca1b8639e831f2a440ff2dc3c109b73a4d5372b34a43e1a09985623e4f7fac6fd3a4fd1255b591e88cadf234cc20c18c198c10a

      • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

        Filesize

        472KB

        MD5

        88eb1bca8c399bc3f46e99cdde2f047e

        SHA1

        55fafbceb011e1af2edced978686a90971bd95f2

        SHA256

        42fd78c05bc240d4ded16ac974f17c336f6ae3a1814d548021c48a942cc30428

        SHA512

        149d4de0c024e25a13a7bb17471e6f48391d4f26b1c8388672320eed1c255f84219ad7b72bbebc531ae558d5192dd4bb6d0dddd6c65a45300c8e8348a4fb3728

      • C:\Users\Admin\AppData\Local\Temp\$$aFBA.bat

        Filesize

        721B

        MD5

        0b2d719749f4116ad3b16da56ce8151a

        SHA1

        c56fbc598aeb41838de90b5ef15400de15358450

        SHA256

        861db32baf179949ebc4ac60848a9d18afcdee6ae13274ad4bfbea78490d6482

        SHA512

        20ec6d20571e0592f5dd87b1ce7dcd09d0e6996211eaab9dc662e6bdb76ee4259835881ddfed44ad4f79a6c60aabee681bcce21ad546dddc32728ecca9e68c02

      • C:\Users\Admin\AppData\Local\Temp\eec3f6d7d66da25a403c600293d487970708157dd208f6e77508e4eda74db94b.exe.exe

        Filesize

        41KB

        MD5

        977e405c109268909fd24a94cc23d4f0

        SHA1

        af5d032c2b6caa2164cf298e95b09060665c4188

        SHA256

        cd24c61fe7dc3896c6c928c92a2adc58fab0a3ff61ef7ddcac1ba794182ab12f

        SHA512

        12b4b59c1a8e65e72aa07ee4b6b6cd9fdedead01d5ce8e30f16ca26b5d733655e23a71c1d273a950a5b1a6cce810b696612de4a1148ac5f468ddf05d4549eed5

      • C:\Windows\Logo1_.exe

        Filesize

        27KB

        MD5

        e64ef364d16ee5080d92a0ce29745a57

        SHA1

        7cad20f8448225d876c51f447fce237435653013

        SHA256

        5bf21661082873e033505e0da51c119acaba12a6d18df121d44e6665a5a065bc

        SHA512

        f483b17532fb65a90952fc4a14492ee29109c1a69b34cfdbde19059438d14d3e42ce7e893f0c4fd794979a5055cc48613cf64486f8e27103b469100f8d1b1ff3

      • F:\$RECYCLE.BIN\S-1-5-21-2737914667-933161113-3798636211-1000\_desktop.ini

        Filesize

        8B

        MD5

        02e4d47cbb9cf2affe1a6d96af753a42

        SHA1

        fe76259bc3376a8aa287867933c6bfd7fdae1944

        SHA256

        8079d35a07b892f00cdffeed754377382353a6e5870c06c02dc8dbaf809d291a

        SHA512

        cc47f23bb8b014458285ee912566350c0d09c49d9e40666790694b4d4d7961abbf7adcf9d54e78571a3b97d27a05c58f3db3fdaaa3f4221130a248ed780a1746

      • memory/1136-29-0x00000000024E0000-0x00000000024E1000-memory.dmp

        Filesize

        4KB

      • memory/1924-17-0x0000000000400000-0x0000000000435000-memory.dmp

        Filesize

        212KB

      • memory/1924-0-0x0000000000400000-0x0000000000435000-memory.dmp

        Filesize

        212KB

      • memory/2592-31-0x0000000000400000-0x0000000000435000-memory.dmp

        Filesize

        212KB

      • memory/2592-38-0x0000000000400000-0x0000000000435000-memory.dmp

        Filesize

        212KB

      • memory/2592-44-0x0000000000400000-0x0000000000435000-memory.dmp

        Filesize

        212KB

      • memory/2592-90-0x0000000000400000-0x0000000000435000-memory.dmp

        Filesize

        212KB

      • memory/2592-96-0x0000000000400000-0x0000000000435000-memory.dmp

        Filesize

        212KB

      • memory/2592-663-0x0000000000400000-0x0000000000435000-memory.dmp

        Filesize

        212KB

      • memory/2592-1873-0x0000000000400000-0x0000000000435000-memory.dmp

        Filesize

        212KB

      • memory/2592-2458-0x0000000000400000-0x0000000000435000-memory.dmp

        Filesize

        212KB

      • memory/2592-3333-0x0000000000400000-0x0000000000435000-memory.dmp

        Filesize

        212KB

      • memory/2592-19-0x0000000000400000-0x0000000000435000-memory.dmp

        Filesize

        212KB