Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    52s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/06/2024, 10:38

General

  • Target

    ac912296175fb6c348fbeff7431934aa203f9e26ed0ce173f99936e7ec52eaa9.exe

  • Size

    713KB

  • MD5

    0a03306a319e23ac41497c15246f39bd

  • SHA1

    1b9e969bf0ef9b0ccfceddc55e586054c6c0ca1c

  • SHA256

    ac912296175fb6c348fbeff7431934aa203f9e26ed0ce173f99936e7ec52eaa9

  • SHA512

    f1ba471873b4c00679b070b0306ead80f532d79a2777de8b47df8173c68a9a762e7d11c2204c5f595a1784cf4b39ef6024fafa243930f5fefcb12729175a8172

  • SSDEEP

    12288:2fC6Aj+TN5uixZN+8rKhUdTC/wE1ZD0Ca5ZIXV:KLOS2opPIXV

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3516
      • C:\Users\Admin\AppData\Local\Temp\ac912296175fb6c348fbeff7431934aa203f9e26ed0ce173f99936e7ec52eaa9.exe
        "C:\Users\Admin\AppData\Local\Temp\ac912296175fb6c348fbeff7431934aa203f9e26ed0ce173f99936e7ec52eaa9.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:4980
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a45D3.bat
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1116
          • C:\Users\Admin\AppData\Local\Temp\ac912296175fb6c348fbeff7431934aa203f9e26ed0ce173f99936e7ec52eaa9.exe
            "C:\Users\Admin\AppData\Local\Temp\ac912296175fb6c348fbeff7431934aa203f9e26ed0ce173f99936e7ec52eaa9.exe"
            4⤵
            • Executes dropped EXE
            PID:1748
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4940
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:4368
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
                PID:2136

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

        Filesize

        254KB

        MD5

        e07b271414d7901d4be3fef46b6234ad

        SHA1

        383c79a26054fb1d00f931222e5f7fd7cdc2987b

        SHA256

        84bb3d64de9f9a1c3b1c2359204a1986fdbe17ef226274213bb17fbf0ca2198c

        SHA512

        d989a243a0c6e0f1fa1e562f49be1263fd2d7962f289d4a0108f046ef6f2cd87b262a4b2fbd4a94be3f9e39ac656b402f8d8aa40600db3ee02b24cf0d78e08e3

      • C:\Program Files\7-Zip\7z.exe

        Filesize

        573KB

        MD5

        fda9cf0deaa988a13d5239d75a110fd5

        SHA1

        715372cc22bace53b39552cff722617f6892fa0b

        SHA256

        7cb5cd1f8beb0a6071c16cce4465094cde5672a667c66f817dd97e41ba9c9f5c

        SHA512

        4beda5b1e5f03b55dfb39a543755dd55956de24bd0fb7861576709b8a7aadd5bf52639fcb15b63ed542775ab3c2809a06dfe496c8fe8a4e738e38a46ccb1528d

      • C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe

        Filesize

        639KB

        MD5

        c8d281da4c32df16eef470c27c8cb459

        SHA1

        00efc9f6844bfaa37c264b6452c6a7356638ab10

        SHA256

        058c81e5a07f2c6c33cf28dff71d07ad8f179046108d945159957e891bfd9c62

        SHA512

        e3c79e19f620068f668d4ebaa5097f1a95a30dabb8dce75f3787171dddbea9f684fc7ce8d1011a398f38084d7af96dd1ff9a02d25906aab9b13861b8363d24bb

      • C:\Users\Admin\AppData\Local\Temp\$$a45D3.bat

        Filesize

        722B

        MD5

        db7b65be32c98605142122454ac5250f

        SHA1

        f74a16146edde2b716ff138d66908a4627caac6a

        SHA256

        0817f20fadc7f200e494a3396802f063671756265a0d20e621107a2a4af71811

        SHA512

        0ab9c24c63a31ea749ded98710955ab7c1cdd883b3620b36ddc9f52dd21749972e513174fa2e25b220f41ba3e4629f404d029f54473a2a89e4f561d5fcfed1c2

      • C:\Users\Admin\AppData\Local\Temp\ac912296175fb6c348fbeff7431934aa203f9e26ed0ce173f99936e7ec52eaa9.exe.exe

        Filesize

        684KB

        MD5

        50f289df0c19484e970849aac4e6f977

        SHA1

        3dc77c8830836ab844975eb002149b66da2e10be

        SHA256

        b9b179b305c5268ad428b6ae59de10b4fe99cf0199bbc89b7017181905e97305

        SHA512

        877d852ea1062b90e2fd2f3c4dc7d05d9697e9a9b2929c830a770b62741f6a11e06de73275eb871113f11143faf1cb40d99f7c247862ffb778d26833ed5d7e38

      • C:\Windows\rundl132.exe

        Filesize

        29KB

        MD5

        9c93f08705742f729989246ec26c3dfa

        SHA1

        0b2a8d41f9b2e452aeae1f720f31814d667462ec

        SHA256

        f27ccbe73d56d0126cac6349b6ae5143af964c093c94570890cd38a01f200679

        SHA512

        f5dcb1ba3ea6191dd910fe0f781992d9344b42e2ea8034ab5775489a43971c613c995869f649d5de35656ec4b8e397de51e9e9eb0070ab8705ff14b46877ee2e

      • F:\$RECYCLE.BIN\S-1-5-21-4124900551-4068476067-3491212533-1000\_desktop.ini

        Filesize

        9B

        MD5

        3b22ce0fee2d1aaf2c66dcd142740e29

        SHA1

        94d542b4bb9854a9419753c38e6ffe747653d91c

        SHA256

        8284772f28954a109c16f1583e6e34e29f06673b34e04f268bda961b57ba9f79

        SHA512

        efd4900a49624170e51ea401f0845634f49484a49335845258dc3d41a12e2022bf413a6751fcbcfd1ec68cde506f3363beae57f20e8eaca8b214d28baa138c5b

      • memory/4940-27-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/4940-33-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/4940-37-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/4940-20-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/4940-1231-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/4940-13-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/4940-4797-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/4940-5236-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/4980-0-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB

      • memory/4980-12-0x0000000000400000-0x0000000000436000-memory.dmp

        Filesize

        216KB