Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    11/06/2024, 07:32 UTC

General

  • Target

    b6abe44b3cd916dd12a2da83e56b8b37612f67f86a6e65a54b823cb9cce656a9.exe

  • Size

    940KB

  • MD5

    76c4f4ba195592194f32f2503479cf55

  • SHA1

    f9e7c610214f948893db8411bb291e3f0bff5198

  • SHA256

    b6abe44b3cd916dd12a2da83e56b8b37612f67f86a6e65a54b823cb9cce656a9

  • SHA512

    042c8034e5bdf4bdee2f3a0172a1d1281260a241304216ff19e36c00e58d1212c68a2cea610cae41a150d814798e12a86cef03e23d71984b7e13adb60878ef53

  • SSDEEP

    6144:3VfjmNjJQu49F5tc5Y8HWJffsLr+kHqwLOyfld9lYBT15sS9oQHfSgtoqbc/XFBH:l7+FCjcdHEffoqKFBS+QXtzcHLPh2eJ

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 5 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Executes dropped EXE
    PID:1260
    • C:\Users\Admin\AppData\Local\Temp\b6abe44b3cd916dd12a2da83e56b8b37612f67f86a6e65a54b823cb9cce656a9.exe
      "C:\Users\Admin\AppData\Local\Temp\b6abe44b3cd916dd12a2da83e56b8b37612f67f86a6e65a54b823cb9cce656a9.exe"
      2⤵
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:2392
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c C:\Users\Admin\AppData\Local\Temp\$$aED0.bat
        3⤵
        • Deletes itself
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2708
        • C:\Users\Admin\AppData\Local\Temp\b6abe44b3cd916dd12a2da83e56b8b37612f67f86a6e65a54b823cb9cce656a9.exe
          "C:\Users\Admin\AppData\Local\Temp\b6abe44b3cd916dd12a2da83e56b8b37612f67f86a6e65a54b823cb9cce656a9.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious behavior: GetForegroundWindowSpam
          PID:2784
      • C:\Windows\Logo1_.exe
        C:\Windows\Logo1_.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2932
        • C:\Windows\SysWOW64\net.exe
          net stop "Kingsoft AntiVirus Service"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2156
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
            5⤵
              PID:2660

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

      Filesize

      251KB

      MD5

      bcb9e88e90555be4406d1f1990dae6e5

      SHA1

      e73a89da48a32a78ec3637bc4192d9c2a34e86a7

      SHA256

      48f8e46b1ccbb647b81d781442c7f17b3bd9db20d9455812174437bcb80c4d7b

      SHA512

      3d8af1e295260a9fb048a3f140625959f6985ad31aa59873d54ba5e253d918876b7ab36caefc7365ac359883c97784fd168725cb7c7bc9ec792d396e6e90acda

    • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

      Filesize

      471KB

      MD5

      4cfdb20b04aa239d6f9e83084d5d0a77

      SHA1

      f22863e04cc1fd4435f785993ede165bd8245ac6

      SHA256

      30ed17ca6ae530e8bf002bcef6048f94dba4b3b10252308147031f5c86ace1b9

      SHA512

      35b4c2f68a7caa45f2bb14b168947e06831f358e191478a6659b49f30ca6f538dc910fe6067448d5d8af4cb8558825d70f94d4bd67709aee414b2be37d49be86

    • C:\Users\Admin\AppData\Local\Temp\$$aED0.bat

      Filesize

      721B

      MD5

      26797a915f21a1ce99c0e61e4752b539

      SHA1

      38f7f1ab0aae3beb3f8d4f001868786da9404378

      SHA256

      5b289a7cc0f9c5b84e9adeaa900cec55b8a46a3ed33403c394eff522a9511455

      SHA512

      2b2f671960af12a8a035bc22b4891d7c541aa5fdb7a21e2e56187bd275c0aeb3d196597d4ccd2b124ddeeb4a210841de5f1ce87721cb1316c4929982fe8cd618

    • C:\Users\Admin\AppData\Local\Temp\b6abe44b3cd916dd12a2da83e56b8b37612f67f86a6e65a54b823cb9cce656a9.exe.exe

      Filesize

      913KB

      MD5

      e90140ff5f5ff7521ea52f94bec29f8c

      SHA1

      a3aaf4d6705984d2f0b97d277766ebc82a26011f

      SHA256

      0e25afc6f2c17e08afc91f7717b3669cb4de6f77dd62b78674b09e0d59e4aa3c

      SHA512

      f644e4c22be81aeddf380ec8b550c3774a6c8678b9ad4cb210235ae440bd9f1e16df84832babac21672b69a57ebd779bbfb562dd6158f91cc48367ef3e383a3e

    • C:\Windows\Logo1_.exe

      Filesize

      26KB

      MD5

      db1b9d89625483c2be503d426ab3dca2

      SHA1

      3f3b288bbbae204ca0d1298361d287a52050d1fa

      SHA256

      6d78e466f96a382cabdc9473590510a217411e74807d803b1ac6b53870298101

      SHA512

      c118d5f1ab8a5e08b9af12a612ce64a43b709237f7c2c8d94bf8f7b7f1e591070385a1352421f5fa89926268e6b372040a968a6b9ebaacc949efce9232d514d9

    • F:\$RECYCLE.BIN\S-1-5-21-3627615824-4061627003-3019543961-1000\_desktop.ini

      Filesize

      9B

      MD5

      3b22ce0fee2d1aaf2c66dcd142740e29

      SHA1

      94d542b4bb9854a9419753c38e6ffe747653d91c

      SHA256

      8284772f28954a109c16f1583e6e34e29f06673b34e04f268bda961b57ba9f79

      SHA512

      efd4900a49624170e51ea401f0845634f49484a49335845258dc3d41a12e2022bf413a6751fcbcfd1ec68cde506f3363beae57f20e8eaca8b214d28baa138c5b

    • memory/1260-32-0x0000000002600000-0x0000000002601000-memory.dmp

      Filesize

      4KB

    • memory/2392-12-0x0000000000540000-0x0000000000574000-memory.dmp

      Filesize

      208KB

    • memory/2392-18-0x0000000000540000-0x0000000000574000-memory.dmp

      Filesize

      208KB

    • memory/2392-17-0x0000000000400000-0x0000000000434000-memory.dmp

      Filesize

      208KB

    • memory/2392-0-0x0000000000400000-0x0000000000434000-memory.dmp

      Filesize

      208KB

    • memory/2932-99-0x0000000000400000-0x0000000000434000-memory.dmp

      Filesize

      208KB

    • memory/2932-47-0x0000000000400000-0x0000000000434000-memory.dmp

      Filesize

      208KB

    • memory/2932-93-0x0000000000400000-0x0000000000434000-memory.dmp

      Filesize

      208KB

    • memory/2932-20-0x0000000000400000-0x0000000000434000-memory.dmp

      Filesize

      208KB

    • memory/2932-524-0x0000000000400000-0x0000000000434000-memory.dmp

      Filesize

      208KB

    • memory/2932-1852-0x0000000000400000-0x0000000000434000-memory.dmp

      Filesize

      208KB

    • memory/2932-2203-0x0000000000400000-0x0000000000434000-memory.dmp

      Filesize

      208KB

    • memory/2932-41-0x0000000000400000-0x0000000000434000-memory.dmp

      Filesize

      208KB

    • memory/2932-3312-0x0000000000400000-0x0000000000434000-memory.dmp

      Filesize

      208KB

    • memory/2932-34-0x0000000000400000-0x0000000000434000-memory.dmp

      Filesize

      208KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.