Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    10/06/2024, 08:51

General

  • Target

    35792883a3ebdab8569b1b51276e8b85d150613a851d0d5bb3cbc8d4b4ecc20e.exe

  • Size

    384KB

  • MD5

    ff106ac5c416d17141a11f322d0cf49a

  • SHA1

    141992e18745abcae416e9ce3e99acb6663126ec

  • SHA256

    35792883a3ebdab8569b1b51276e8b85d150613a851d0d5bb3cbc8d4b4ecc20e

  • SHA512

    c523e4c9d04e58d8edddc44584360110ce2ae79987a130015cd3a1585ced6884ab2c33c3fd1c9fbd1a8147abdff8ae09f506f2e32e67ce573786641a2678028e

  • SSDEEP

    3072:xAyLd0K/JdOj7Yhy2j14ml3I2LDZm1bRxH2gVMnayzmXtMqRnf1UEDiMvTCfrqUQ:XLZ/Jduwy4ScLZIxH2gGanTf1n

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\35792883a3ebdab8569b1b51276e8b85d150613a851d0d5bb3cbc8d4b4ecc20e.exe
    "C:\Users\Admin\AppData\Local\Temp\35792883a3ebdab8569b1b51276e8b85d150613a851d0d5bb3cbc8d4b4ecc20e.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:2180
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\$$a2E70.bat
      2⤵
      • Deletes itself
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1216
      • C:\Users\Admin\AppData\Local\Temp\35792883a3ebdab8569b1b51276e8b85d150613a851d0d5bb3cbc8d4b4ecc20e.exe
        "C:\Users\Admin\AppData\Local\Temp\35792883a3ebdab8569b1b51276e8b85d150613a851d0d5bb3cbc8d4b4ecc20e.exe"
        3⤵
        • Executes dropped EXE
        PID:2804
    • C:\Windows\Logo1_.exe
      C:\Windows\Logo1_.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2540
      • C:\Windows\SysWOW64\net.exe
        net stop "Kingsoft AntiVirus Service"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2676
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
          4⤵
            PID:2704

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\$$a2E70.bat

      Filesize

      722B

      MD5

      92c9f1ee3e22d83ea786ecd999ea0c0e

      SHA1

      9f0788deb9bceaa353333d4f8f683428691d32de

      SHA256

      69a54c0ef424596175e61f9b8f491619b2adf8f0483fecd310da9998db71e242

      SHA512

      5be4741162dfd0a8d1e14e79ac4750303614a5ee7fed811a73534bef7b248f7cf36b05fdd6e89dd7cd923a7a14c95a24fecd5c72dcc93729c5f2c9b4acd94f97

    • C:\Users\Admin\AppData\Local\Temp\35792883a3ebdab8569b1b51276e8b85d150613a851d0d5bb3cbc8d4b4ecc20e.exe.exe

      Filesize

      318KB

      MD5

      dca5924a3197b5b6925ca549033ff0b7

      SHA1

      c10dfc045a860d4da749b60c06535f3270d74222

      SHA256

      a2206ce83f0270a4b93fc3ac0dd704355c5bd18535b3b642d64bd6f54f08df55

      SHA512

      7a7fb359add41605b93c992edadd68a5f33dc7b675e64cff38d234e8b060a0406dbcd7cf7226cbdd6233f560e6e56ec9b47386be1ad9b2232bcff09ae34d7455

    • C:\Windows\Logo1_.exe

      Filesize

      66KB

      MD5

      9e55800e061b59df24521a41562b45e8

      SHA1

      66b0c3b70118debcbaa22fe6fb26e7b0f04d0110

      SHA256

      05e7905abaaab25a826c585f6682248ce8f02f5a572c869e248b3604daf7fc6b

      SHA512

      535b6f620688da3b27679453f04b7a5a57c924258cb382ae60838f1653f83214e0fcbb8c053632055068f747ae78c7a4b9aeb91ec2c37247b6a5d96424c25f65

    • memory/2180-13-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/2540-23-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/2540-24-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/2540-26-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/2540-32-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/2540-34-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/2540-164-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/2540-240-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/2804-21-0x000000013FF70000-0x000000013FFC2000-memory.dmp

      Filesize

      328KB

    • memory/2804-20-0x000007FEF5C23000-0x000007FEF5C24000-memory.dmp

      Filesize

      4KB