Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    05/06/2024, 14:29

General

  • Target

    0651eb83a85b3585562268b7f7f1c9a90a8205c01b83f4ce0fa95204100ce48b.exe

  • Size

    573KB

  • MD5

    0fa358463d01292dc0c29cd2cb4d6ae9

  • SHA1

    be8615293359814fefcdb50f4938d963c52daef7

  • SHA256

    0651eb83a85b3585562268b7f7f1c9a90a8205c01b83f4ce0fa95204100ce48b

  • SHA512

    2cbb5396bef624a3dfe784ecae721567146ad8c27a536dc4039d69176a73c48b6f67a9efe5dc92ad7ac0e9ccfce6e23c935d0900d4c3859a5c9dd2a5420d0c12

  • SSDEEP

    6144:suJpE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4t0BHQQfu:47a3iwbihym2g7XO3LWUQfh4Co

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1192
      • C:\Users\Admin\AppData\Local\Temp\0651eb83a85b3585562268b7f7f1c9a90a8205c01b83f4ce0fa95204100ce48b.exe
        "C:\Users\Admin\AppData\Local\Temp\0651eb83a85b3585562268b7f7f1c9a90a8205c01b83f4ce0fa95204100ce48b.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:1484
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c C:\Users\Admin\AppData\Local\Temp\$$a21E2.bat
          3⤵
          • Deletes itself
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:1356
          • C:\Users\Admin\AppData\Local\Temp\0651eb83a85b3585562268b7f7f1c9a90a8205c01b83f4ce0fa95204100ce48b.exe
            "C:\Users\Admin\AppData\Local\Temp\0651eb83a85b3585562268b7f7f1c9a90a8205c01b83f4ce0fa95204100ce48b.exe"
            4⤵
            • Executes dropped EXE
            PID:2676
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2904
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2600
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
                PID:2256

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

        Filesize

        254KB

        MD5

        d53dfe8ee60a8ec53507b414770b008c

        SHA1

        3428891b51a84cc48294c7c504ff73815eb09ae6

        SHA256

        8b03c2b78678dc4c33f2301edcc9de1128c5cf44a1b532fcb5316c773914007f

        SHA512

        6a5e60f2952a04b6b209cc75ca997f3655cd8cf2a7aea2bc7799eb59e49e638abd7631a6cf3c1455933e961bb6ec1ff3561c6c14027ff4481054243e09af1ab7

      • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

        Filesize

        474KB

        MD5

        1ca79e3c2539763b0aaac5de49795afe

        SHA1

        2d240aef9a2cce22578f42ebecd3058e37a404a8

        SHA256

        e3e49eceb810b34fc826d70c6556d927a363f29c90b347ee4cfd61d7ba3ff2d9

        SHA512

        4e24d3ebcefa6545d85517bbc5bff3285f85a5967da1642a6e4e53bc2c41efc8b9092a3bbb56c1670b215d623ff5c320bcb06f654ac97482a5dff0da208349e6

      • C:\Users\Admin\AppData\Local\Temp\$$a21E2.bat

        Filesize

        722B

        MD5

        10071bdb2ca6daa15c15fef375f61638

        SHA1

        be87d165daefe605a5107e48ae37b5430026484a

        SHA256

        560fdc5e0ffdac079102c57da66b3f876e4a808b5290054916fc815bd4246039

        SHA512

        bf08472de09a5de2e524acd0097b09a97e395c728195a1380e3c1170858286ce8fc7104575710c73da8a5874e19c914f10084c347de44dd2f002dd3642b35a77

      • C:\Users\Admin\AppData\Local\Temp\0651eb83a85b3585562268b7f7f1c9a90a8205c01b83f4ce0fa95204100ce48b.exe.exe

        Filesize

        544KB

        MD5

        9a1dd1d96481d61934dcc2d568971d06

        SHA1

        f136ef9bf8bd2fc753292fb5b7cf173a22675fb3

        SHA256

        8cebb25e240db3b6986fcaed6bc0b900fa09dad763a56fb71273529266c5c525

        SHA512

        7ac1581f8a29e778ba1a1220670796c47fa5b838417f8f635e2cb1998a01515cff3ee57045dacb78a8ec70d43754b970743aba600379fe6d9481958d32d8a5aa

      • C:\Windows\Logo1_.exe

        Filesize

        29KB

        MD5

        c3a6498aeafb967730b138db7706cfbd

        SHA1

        82c69ca3f3eaf8bb5fa8288db2b88bc735f18017

        SHA256

        9a8bea687af727ad62d8e900f8fa2c686600ddaaa69c8ff9f431a93e1aaae472

        SHA512

        0a06043720af675a122478c9c71dbb78730821361f7b88ac44a05471a870bfef32e6a8bbead08a4d35be897a031dca9bd46966ea9f7727ceb88d1fa6e1cb43a2

      • F:\$RECYCLE.BIN\S-1-5-21-2737914667-933161113-3798636211-1000\_desktop.ini

        Filesize

        8B

        MD5

        fa8bf97ffdb152205be1f3a9bd9faec3

        SHA1

        88a5a98b6074543e357ec7ad221eaee5e30ec82a

        SHA256

        08a129c008511d5fc4ee1e2ad0fad3d0b033407f74285a18c6fe956d5dc2c9cb

        SHA512

        ea0a63f52af441964e4a2cddede537d87f1ad78241c883cf40334801056879bb1639ae75b2d9e3cceb90471837263760fc7d6c6708819c7a73fec703ba098443

      • memory/1192-28-0x0000000002F00000-0x0000000002F01000-memory.dmp

        Filesize

        4KB

      • memory/1484-16-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/1484-0-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/2904-17-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/2904-43-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/2904-89-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/2904-95-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/2904-537-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/2904-1873-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/2904-2170-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/2904-37-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/2904-3333-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/2904-30-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB