Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    09/06/2024, 23:46

General

  • Target

    1580642643f7916c398f0d18777f19668f6d89cedea30af018438506cfcbd475.exe

  • Size

    115KB

  • MD5

    6b303388c32d448722310a1540de801c

  • SHA1

    bcc7a993254b392d3aef34cec71f615f7de428b9

  • SHA256

    1580642643f7916c398f0d18777f19668f6d89cedea30af018438506cfcbd475

  • SHA512

    2b80868e0a27c75ecde6404e8f048560435424eddd745baf1f33240abd596ebe730408f478f3cb03674893cbcf0ee636ad7b0d78b4a9cd539f09d218fe1c2aa8

  • SSDEEP

    1536:xjMqxL2Q3qOLjp01Y06JdOGZqlSmQBQ0H855ZXcWn/qsL1jTWBrt:xAyLd0K/JdOj0HmXcWn/qajKv

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1580642643f7916c398f0d18777f19668f6d89cedea30af018438506cfcbd475.exe
    "C:\Users\Admin\AppData\Local\Temp\1580642643f7916c398f0d18777f19668f6d89cedea30af018438506cfcbd475.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:2860
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\$$a9195.bat
      2⤵
      • Deletes itself
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2680
      • C:\Users\Admin\AppData\Local\Temp\1580642643f7916c398f0d18777f19668f6d89cedea30af018438506cfcbd475.exe
        "C:\Users\Admin\AppData\Local\Temp\1580642643f7916c398f0d18777f19668f6d89cedea30af018438506cfcbd475.exe"
        3⤵
        • Executes dropped EXE
        PID:2516
    • C:\Windows\Logo1_.exe
      C:\Windows\Logo1_.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2864
      • C:\Windows\SysWOW64\net.exe
        net stop "Kingsoft AntiVirus Service"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2996
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
          4⤵
            PID:2644

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\$$a9195.bat

      Filesize

      722B

      MD5

      e63593ff4196c7f3d4b4b3f3dbc8b491

      SHA1

      a8df72508f468a3c0a38b13aaa3bd221bc0cc717

      SHA256

      3ddec8de4cd13c3c6831ad731e9c372d735d8aa4061593fb4c542538e14c9c59

      SHA512

      aa2a94928100f66555a6a650d9a84d9fe600a9c24a67dbbe7f40bc9895e532395441b016729d90ab126a50a59c5ba9640ef0cae3a2f1739bee3796832a86bdef

    • C:\Users\Admin\AppData\Local\Temp\1580642643f7916c398f0d18777f19668f6d89cedea30af018438506cfcbd475.exe.exe

      Filesize

      49KB

      MD5

      33957dfa6df9e91ddbe5cdae1be4cece

      SHA1

      9047a25d9f5934c01100c18773c0b6362c1bad3f

      SHA256

      b72162e82cad37b09057721f9334a96e8efb9f3290619a83c66e69020591397d

      SHA512

      5bc056aac04c87a2973b34b8defe3747b947b6de35939b10c3dd19d32c8b15575d0d089050b2105672befbb92a9a775c4389972d794a8270b4c1c1801fe542ca

    • C:\Windows\Logo1_.exe

      Filesize

      66KB

      MD5

      9e55800e061b59df24521a41562b45e8

      SHA1

      66b0c3b70118debcbaa22fe6fb26e7b0f04d0110

      SHA256

      05e7905abaaab25a826c585f6682248ce8f02f5a572c869e248b3604daf7fc6b

      SHA512

      535b6f620688da3b27679453f04b7a5a57c924258cb382ae60838f1653f83214e0fcbb8c053632055068f747ae78c7a4b9aeb91ec2c37247b6a5d96424c25f65

    • memory/2516-20-0x0000000000B90000-0x0000000000BA3000-memory.dmp

      Filesize

      76KB

    • memory/2860-13-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/2864-23-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/2864-22-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/2864-25-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/2864-28-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/2864-32-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/2864-33-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/2864-164-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/2864-240-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB