Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/06/2024, 08:51

General

  • Target

    35792883a3ebdab8569b1b51276e8b85d150613a851d0d5bb3cbc8d4b4ecc20e.exe

  • Size

    384KB

  • MD5

    ff106ac5c416d17141a11f322d0cf49a

  • SHA1

    141992e18745abcae416e9ce3e99acb6663126ec

  • SHA256

    35792883a3ebdab8569b1b51276e8b85d150613a851d0d5bb3cbc8d4b4ecc20e

  • SHA512

    c523e4c9d04e58d8edddc44584360110ce2ae79987a130015cd3a1585ced6884ab2c33c3fd1c9fbd1a8147abdff8ae09f506f2e32e67ce573786641a2678028e

  • SSDEEP

    3072:xAyLd0K/JdOj7Yhy2j14ml3I2LDZm1bRxH2gVMnayzmXtMqRnf1UEDiMvTCfrqUQ:XLZ/Jduwy4ScLZIxH2gGanTf1n

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\35792883a3ebdab8569b1b51276e8b85d150613a851d0d5bb3cbc8d4b4ecc20e.exe
    "C:\Users\Admin\AppData\Local\Temp\35792883a3ebdab8569b1b51276e8b85d150613a851d0d5bb3cbc8d4b4ecc20e.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:4176
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4834.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3952
      • C:\Users\Admin\AppData\Local\Temp\35792883a3ebdab8569b1b51276e8b85d150613a851d0d5bb3cbc8d4b4ecc20e.exe
        "C:\Users\Admin\AppData\Local\Temp\35792883a3ebdab8569b1b51276e8b85d150613a851d0d5bb3cbc8d4b4ecc20e.exe"
        3⤵
        • Executes dropped EXE
        PID:4264
    • C:\Windows\Logo1_.exe
      C:\Windows\Logo1_.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4908
      • C:\Windows\SysWOW64\net.exe
        net stop "Kingsoft AntiVirus Service"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:324
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
          4⤵
            PID:4516

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\7-Zip\7zG.exe

      Filesize

      750KB

      MD5

      c8684bbb2310ff4cf1c272f1995c71f3

      SHA1

      3a55943a3def1512b041484e9dda83dc2a782e3d

      SHA256

      bc4f6dca71769ff208a33b80e32625ea4ce7ea85c00d45f3dd4641f0edeb1986

      SHA512

      48f3c3231f879d212832682866a529b4bf69bddb14ecc95c80d77a6fadee0badbc9c2e16be4e3b4a4f36362202ada7448d9d98be803116091807d04b5b6aee18

    • C:\Users\Admin\AppData\Local\Temp\$$a4834.bat

      Filesize

      722B

      MD5

      ea078db0027b92628fc97033fd376daa

      SHA1

      dd44ba592d1575a8f4b8f91c943d79d40c8db559

      SHA256

      dd755702fda4fa32088fa828d619505c25174ae88d56dbc4d9e8800174e10df3

      SHA512

      ae11be830813b10ce7b48ad93f0f86efefd7909cd5e461bce9c4d021645b8c2c595247554fc9a22a22151c5678963c55ef9ecfb09d7812b9e1b4a35aadcebb7f

    • C:\Users\Admin\AppData\Local\Temp\35792883a3ebdab8569b1b51276e8b85d150613a851d0d5bb3cbc8d4b4ecc20e.exe

      Filesize

      318KB

      MD5

      dca5924a3197b5b6925ca549033ff0b7

      SHA1

      c10dfc045a860d4da749b60c06535f3270d74222

      SHA256

      a2206ce83f0270a4b93fc3ac0dd704355c5bd18535b3b642d64bd6f54f08df55

      SHA512

      7a7fb359add41605b93c992edadd68a5f33dc7b675e64cff38d234e8b060a0406dbcd7cf7226cbdd6233f560e6e56ec9b47386be1ad9b2232bcff09ae34d7455

    • C:\Windows\Logo1_.exe

      Filesize

      66KB

      MD5

      9e55800e061b59df24521a41562b45e8

      SHA1

      66b0c3b70118debcbaa22fe6fb26e7b0f04d0110

      SHA256

      05e7905abaaab25a826c585f6682248ce8f02f5a572c869e248b3604daf7fc6b

      SHA512

      535b6f620688da3b27679453f04b7a5a57c924258cb382ae60838f1653f83214e0fcbb8c053632055068f747ae78c7a4b9aeb91ec2c37247b6a5d96424c25f65

    • memory/4176-5-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/4264-12-0x000001F5ED840000-0x000001F5ED892000-memory.dmp

      Filesize

      328KB

    • memory/4264-11-0x00007FFA19513000-0x00007FFA19515000-memory.dmp

      Filesize

      8KB

    • memory/4908-15-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/4908-18-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/4908-20-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/4908-16-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/4908-144-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/4908-152-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/4908-210-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/4908-222-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB