Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    10/06/2024, 14:32

General

  • Target

    2eede65324b2e8a57b63f82ae8cc812497596ccdf5da71e82a72228f74d542ba.exe

  • Size

    258KB

  • MD5

    5bccfa5d3d7bcee768187346a73608d1

  • SHA1

    4ea22c666a8ffe6e0f03607e45a85deba5484cb1

  • SHA256

    2eede65324b2e8a57b63f82ae8cc812497596ccdf5da71e82a72228f74d542ba

  • SHA512

    28be9c9b18f9db60abb7b13ba92152278e650e59e76843bb4143f3375f23ac5e08cf45a209a13c4ca916e27555a45836ddd066544f9e9d6e4d8c49a4eac7e7e4

  • SSDEEP

    6144:S+aezDQZbO5JCSZT0wwla4G13CmdxLzI9LTB5xnmT:S+aRbuJcfcXbz0Tfxo

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 43 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Executes dropped EXE
    PID:1224
    • C:\Users\Admin\AppData\Local\Temp\2eede65324b2e8a57b63f82ae8cc812497596ccdf5da71e82a72228f74d542ba.exe
      "C:\Users\Admin\AppData\Local\Temp\2eede65324b2e8a57b63f82ae8cc812497596ccdf5da71e82a72228f74d542ba.exe"
      2⤵
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1896
      • C:\Windows\SysWOW64\net.exe
        net stop "Kingsoft AntiVirus Service"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1240
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
          4⤵
            PID:2092
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c C:\Users\Admin\AppData\Local\Temp\$$a35DF.bat
          3⤵
          • Deletes itself
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:2704
          • C:\Users\Admin\AppData\Local\Temp\2eede65324b2e8a57b63f82ae8cc812497596ccdf5da71e82a72228f74d542ba.exe
            "C:\Users\Admin\AppData\Local\Temp\2eede65324b2e8a57b63f82ae8cc812497596ccdf5da71e82a72228f74d542ba.exe"
            4⤵
            • Executes dropped EXE
            PID:2616
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2324
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2816
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
                PID:2620
            • C:\Windows\SysWOW64\net.exe
              net stop "Kingsoft AntiVirus Service"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:2848
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                5⤵
                  PID:2676

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

          Filesize

          484KB

          MD5

          7b714d463f7db900d5b6e757778a8ab8

          SHA1

          2cfc0e9f54236af8e10b0bfa551d87a20982b733

          SHA256

          c995370836939a29853611830ca08d437286d4f45603edce88f36aa1f99a0d97

          SHA512

          e8fe8823b5b7f282c24c964cbf4f248b7562259a13410bf95997288727f9bfc6ea51c4aa40182b649a2235bafc02062e0c57f4f62876b5174395071a8d68f9bb

        • C:\Users\Admin\AppData\Local\Temp\$$a35DF.bat

          Filesize

          722B

          MD5

          21b31a5ffe114abc5801a4a99698d4ce

          SHA1

          70d23caaffac81b02b5dde0c8c5f1f361a5a619d

          SHA256

          a7194ace2e0a5c7da00f9dd40d462e5fb125487032aa7039c0d49ceaacea3938

          SHA512

          729404ada4d6436307e4892b20efb3e5f02801e76360f23550fea6a6b74da6cb925e8c2a45dfe221c383ce9159cf1f8b42806aa0f88d8de139b95ba8af597c78

        • C:\Windows\Logo1_.exe

          Filesize

          39KB

          MD5

          3119e880ce5d6d029185f7ed591e11d0

          SHA1

          3ab197daedf94e992062faa4eda18905b87c75bb

          SHA256

          b1eada5fd013195853bb65ee2b9fa55eb97840d20077d7a2fd43167800608eda

          SHA512

          18cafd3a73312811037cb0e44a578670498b09350d72febd262d62528094b9ba738357ef861bb9cb7704097b9c930b9aa38ee5823520e22cf71d4ebb453bf4d7

        • F:\$RECYCLE.BIN\S-1-5-21-3691908287-3775019229-3534252667-1000\_desktop.ini

          Filesize

          9B

          MD5

          60b1ffe4d5892b7ae054738eec1fd425

          SHA1

          80d4e944617f4132b1c6917345b158f3693f35c8

          SHA256

          5e9944cc48c7ec641cf7b1b0125f47f26102c371a973612f0583f604bc3900d4

          SHA512

          7f5c200924dbb5531df997e6a35cb94f36b54f5651284b0d6404f0576301125ef72b410a170fca889d46c033063663cfc7791f9e4c3c30695af069053eee66cc

        • \Users\Admin\AppData\Local\Temp\2eede65324b2e8a57b63f82ae8cc812497596ccdf5da71e82a72228f74d542ba.exe

          Filesize

          218KB

          MD5

          5f1707646575d375c50155832477a437

          SHA1

          9bcba378189c2f1cb00f82c0539e0e9b8ff0b6c1

          SHA256

          75d348a3330bc527b2b2ff8a0789f711bd51461126f8df0c0aa1647e9d976809

          SHA512

          2f55dd13abfeb5af133ac5afb43c90fd10618e8fb241f50529241cff7987fff382cf151146855c37ad8ae0401b34f6d9aa32cbec03cdd67a224dfe247bad6c99

        • memory/1224-30-0x00000000025D0000-0x00000000025D1000-memory.dmp

          Filesize

          4KB

        • memory/1896-19-0x0000000000400000-0x000000000043D000-memory.dmp

          Filesize

          244KB

        • memory/1896-17-0x00000000003C0000-0x00000000003FD000-memory.dmp

          Filesize

          244KB

        • memory/1896-18-0x00000000003C0000-0x00000000003FD000-memory.dmp

          Filesize

          244KB

        • memory/1896-0-0x0000000000400000-0x000000000043D000-memory.dmp

          Filesize

          244KB

        • memory/2324-34-0x0000000000400000-0x000000000043D000-memory.dmp

          Filesize

          244KB

        • memory/2324-20-0x0000000000400000-0x000000000043D000-memory.dmp

          Filesize

          244KB

        • memory/2324-3349-0x0000000000400000-0x000000000043D000-memory.dmp

          Filesize

          244KB

        • memory/2324-4176-0x0000000000400000-0x000000000043D000-memory.dmp

          Filesize

          244KB