Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/06/2024, 22:32

General

  • Target

    37149157a50d5cf19a0772e3630ad85f77164193b2e8d0fd6eeeb8bd3bbf7a8e.exe

  • Size

    101KB

  • MD5

    99c3a63d1ecdd268ecded4677e785f8d

  • SHA1

    fb9083c78e20b7cbced36047a33cabd4ecd04bfa

  • SHA256

    37149157a50d5cf19a0772e3630ad85f77164193b2e8d0fd6eeeb8bd3bbf7a8e

  • SHA512

    eb3a82d70eb616abbc87fac3fc0afc15f08342462cd4deb0313f326a0cf46581e04aca109de41a664543439d91960ceeb6071112a9a59e0f3a0f3af1cab53a64

  • SSDEEP

    1536:tfgLdQAQfcfymNa2Go0VeoE4p9nV5Icq+cRXZ2N4xHuF8sQWNe5lb1PW:tftffjmNfGvE4pL4zv2NL6sRe5lxe

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3156
      • C:\Users\Admin\AppData\Local\Temp\37149157a50d5cf19a0772e3630ad85f77164193b2e8d0fd6eeeb8bd3bbf7a8e.exe
        "C:\Users\Admin\AppData\Local\Temp\37149157a50d5cf19a0772e3630ad85f77164193b2e8d0fd6eeeb8bd3bbf7a8e.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:3852
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3894.bat
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4560
          • C:\Users\Admin\AppData\Local\Temp\37149157a50d5cf19a0772e3630ad85f77164193b2e8d0fd6eeeb8bd3bbf7a8e.exe
            "C:\Users\Admin\AppData\Local\Temp\37149157a50d5cf19a0772e3630ad85f77164193b2e8d0fd6eeeb8bd3bbf7a8e.exe"
            4⤵
            • Executes dropped EXE
            PID:4352
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4824
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2796
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
                PID:5004

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

        Filesize

        251KB

        MD5

        fa03025a5356ec12c1be2bf6f554120d

        SHA1

        2bcdaa6bbce818a1d260c4293a07b5076a104e56

        SHA256

        8906bb45077aeebb6eaca93bccaa133623f3b5e9dcc0b50dc4c6edcc3ea1571a

        SHA512

        c78ac5d658231ba4dfb54941dfd3fb6e0752d6ec6215743679d1274bd16f5e283dca110f63db3955c23091d2de3f75c2fc5b6630e0be36ea37a16eb81b8716b0

      • C:\Program Files\7-Zip\7z.exe

        Filesize

        570KB

        MD5

        cdd1e1f44869a40a61f093b2806f23d3

        SHA1

        9856dd59b196a7d2100abee9edbd10c85423783f

        SHA256

        0f71dbf0dc35e50d076d2989bb16406ee436bbb1a8cdb051df58bd515fd230fa

        SHA512

        efaad454eef1d53e3ec8c885914fceebd30503c4791dbe32f0aa64f97ada2c207fab228d6e20142ba793cc76bcfc7ed591fc2c25c03872a2798550e07510fb40

      • C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe

        Filesize

        636KB

        MD5

        2500f702e2b9632127c14e4eaae5d424

        SHA1

        8726fef12958265214eeb58001c995629834b13a

        SHA256

        82e5b0001f025ca3b8409c98e4fb06c119c68de1e4ef60a156360cb4ef61d19c

        SHA512

        f420c62fa1f6897f51dd7a0f0e910fb54ad14d51973a2d4840eeea0448c860bf83493fb1c07be65f731efc39e19f8a99886c8cfd058cee482fe52d255a33a55c

      • C:\Users\Admin\AppData\Local\Temp\$$a3894.bat

        Filesize

        722B

        MD5

        d64726b56ec3ef8400d52c2dae57c28b

        SHA1

        3a833cbbf729865bdabcc8074a013ad1540befbd

        SHA256

        bc5d5a4ca8c6ede9463e337933ecde58457706efd5a75eff0d7a6c07d8782073

        SHA512

        6201ba4990f7ce87e3640b1c89ba30f193881e5b39fa1880b415a4149b0437d0fc61a488cf0ee7f12fd60d9da22e379012cdad0cbc43aadfa3207df1490a4e76

      • C:\Users\Admin\AppData\Local\Temp\37149157a50d5cf19a0772e3630ad85f77164193b2e8d0fd6eeeb8bd3bbf7a8e.exe.exe

        Filesize

        75KB

        MD5

        a7851a05e83f42f741a804320c485083

        SHA1

        b76d2e6eb6d2bf289a5118c908578906851460d0

        SHA256

        3600ff58fdb37f53562e626fd74d6f4d8d39925d711a96f221bb4aca7992926a

        SHA512

        eadbfbee79aa0f34b35e0a9c9d717b3c8ac18729df8e52332b696352a2a41d0da37119ab1cb81a10bb7854b930e6479686f8fa8b5a447d48213e3c1c9304ce7b

      • C:\Windows\Logo1_.exe

        Filesize

        26KB

        MD5

        4298e0c223e6572693e5a6b29279c1da

        SHA1

        5bd4c027c9433de22fec622bb7b13b863cee8de4

        SHA256

        bfe4186213f6d4cc116612e337bbe7a4c713d4cd02155dd649b31bf93476bd43

        SHA512

        d5df016ba3a3bcee7370ddd2aca1518fdde68dd681a17c45c8f7cf25a780be5903d49cf03410accfd8d176ce1653d9a49eb0544f5d0d1d091aa2d99fc8186ec1

      • F:\$RECYCLE.BIN\S-1-5-21-540404634-651139247-2967210625-1000\_desktop.ini

        Filesize

        8B

        MD5

        a6f28952c332969f9e6d9f7d1a449737

        SHA1

        31c0826adb63cc03162fb9e88781f4b50da8f11b

        SHA256

        d9d875805581110dafdfb2ceb34c5e60f50fe720963f9813c287e4845248d208

        SHA512

        8187572ee8fbb9a42af34a3444be3a4309c5a798e7b1f27fce5b28b7168b72d015b1c10e611ccd3a9361af2aaeab831d2734017f77adff341c3fdb876c296eac

      • memory/3852-10-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/3852-0-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/4824-27-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/4824-37-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/4824-33-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/4824-173-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/4824-1232-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/4824-20-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/4824-4797-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/4824-13-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/4824-5236-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB