Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/07/2024, 14:19

General

  • Target

    91e37b9d2ad38ef66529c774646eac48801bb739a69aa8238c61b4e12b314d97.exe

  • Size

    306KB

  • MD5

    f1ac8a74c71a08a9df397de15e157e4a

  • SHA1

    971cd2ac5eae7ccd641dcebea30db2c9ef34f60d

  • SHA256

    91e37b9d2ad38ef66529c774646eac48801bb739a69aa8238c61b4e12b314d97

  • SHA512

    5b511dcd7774161f18d6f0c4a50dac3e1db452d449a7d0e22f8c6b791ea5fadb29a66f75684de48a967273691c9739edecb4d7022a5e5dcedba5666b948bf453

  • SSDEEP

    3072:eFfZQioJK/KOwVm0SWmuKEUyHKpwhSjQaJ90IkGR68obMs7mTjNeYYfQ3LOot9Ge:mEObiZKDAX0jH0o2zq9DmQ3LOotL4gr

Score
7/10

Malware Config

Signatures

  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3508
      • C:\Users\Admin\AppData\Local\Temp\91e37b9d2ad38ef66529c774646eac48801bb739a69aa8238c61b4e12b314d97.exe
        "C:\Users\Admin\AppData\Local\Temp\91e37b9d2ad38ef66529c774646eac48801bb739a69aa8238c61b4e12b314d97.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:324
        • C:\Windows\SysWOW64\net.exe
          net stop "Kingsoft AntiVirus Service"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3992
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
            4⤵
              PID:1836
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA057.bat
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:552
            • C:\Users\Admin\AppData\Local\Temp\91e37b9d2ad38ef66529c774646eac48801bb739a69aa8238c61b4e12b314d97.exe
              "C:\Users\Admin\AppData\Local\Temp\91e37b9d2ad38ef66529c774646eac48801bb739a69aa8238c61b4e12b314d97.exe"
              4⤵
              • Executes dropped EXE
              PID:2396
          • C:\Windows\Logo1_.exe
            C:\Windows\Logo1_.exe
            3⤵
            • Drops startup file
            • Executes dropped EXE
            • Enumerates connected drives
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2304
            • C:\Windows\SysWOW64\net.exe
              net stop "Kingsoft AntiVirus Service"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:2552
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                5⤵
                  PID:3128
              • C:\Windows\SysWOW64\net.exe
                net stop "Kingsoft AntiVirus Service"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:4324
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                  5⤵
                    PID:4824

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe

            Filesize

            251KB

            MD5

            e3b8ef4f691ddcc7936415e89be83583

            SHA1

            87ef1e48cb29be9f8bc8d8a7d37e58f7b78e0d6d

            SHA256

            52044f9468d832bf9a0d32672e67cefbf8b7f5f6e13468090ed447868e5d4b02

            SHA512

            e1b2b2f4d55cf6ebffe7dd862508436e7a2feb6ba8dc73960bb83905f33002409730b9f77de382589f5805c81075254c26d3e0887e91d1b0e48ddb319d8fff2e

          • C:\Program Files\7-Zip\7z.exe

            Filesize

            577KB

            MD5

            7658c9c47ef2805682a3b682465720db

            SHA1

            f12ac645874395e5aa0b0140faecef4119554c3b

            SHA256

            a7463ce4b4a0cb0128fef035b8069caa9d8530a3d797b6615f80acc87888de28

            SHA512

            458b86000db315100ce26668cf8b70ad38f543751fa8a7d666fc9c611f3d3c42303400f1ed4314986e9ea7eec0c9c70db9d020f06725440df4d52dcb5e4f2b40

          • C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe

            Filesize

            643KB

            MD5

            c08994604c02bf7431e4c46295a779d5

            SHA1

            7f526582e292083589253bbc8b2cd093b2229ff2

            SHA256

            218bfecab8804a634b05ebcedc30eab7aa8fa8ed5775495ba9545517c311f00e

            SHA512

            13d9b746d0fe6922ecff9b5bf0ac896a63da11610341d4a7701e2a8d8fc5c0511d7bd9f4f54d3756b770998601b4f7b39b7e5c36d824dd42470fb0b499065c34

          • C:\Users\Admin\AppData\Local\Temp\$$aA057.bat

            Filesize

            722B

            MD5

            f34f712914673eb9215b55c8664084f7

            SHA1

            74e931f20dc7c135518ec3ce688d9c55482dddbe

            SHA256

            a3779f818b82e4f73acdad2939b49b16964e7a3421b6a21448c1044165de2c64

            SHA512

            f48d63e99abec8cec77d5f75c2de7cd23d33d1acb4e5de54aaee3b0ed8327feea537b41bcee6840297ad5434306aa24577b1def506aa235d3402511d277f1473

          • C:\Users\Admin\AppData\Local\Temp\91e37b9d2ad38ef66529c774646eac48801bb739a69aa8238c61b4e12b314d97.exe.exe

            Filesize

            273KB

            MD5

            55e392d1bd55a1292b6ce766225416e5

            SHA1

            06d8134a3002e6974407fb5da0a59ab43415a52a

            SHA256

            db42cb95904cfc6891df2aa736506fb34a26cf9a26e88ab0ef262e0459344a3e

            SHA512

            0c55062cf8debbdf1a7a4f41527e43cd124fb7777e9b930de9cc900abf9c27a1956a536200e23dddc9a4068ac5bc9a8052299a4f2cf010cffd205a32d99581a2

          • C:\Windows\Logo1_.exe

            Filesize

            33KB

            MD5

            117c9521e5d8959b1861c9511c792fea

            SHA1

            8b69af116f9b988e45371c811cbddbadcc067e44

            SHA256

            ec905c17086effa5331a07e7805a26bbe62d94c5e90f5fa55a45c668061285de

            SHA512

            93b85bf1c95bdb8781ff90f88faa4b8a0945067be93390b87ee7ab5830b17b257422cfcfcd87078c5004510e2b553876070813a55faaa578e0b979576a2c0eeb

          • F:\$RECYCLE.BIN\S-1-5-21-3419463127-3903270268-2580331543-1000\_desktop.ini

            Filesize

            9B

            MD5

            5e286801abdc6ca5d3091665a72ecd7c

            SHA1

            87e0b4601ab0b05784a1059a45d72d807b0e2cbb

            SHA256

            131ccc46b756e5373dc2f2d37625bfb980a48f2f2287585da364166cf2e709b5

            SHA512

            51506d6adb68cca9e21fcddfe9672b91352cdb4f3c5b8c2da40219c73d2e7724776cd8701ff68449720c0aa398fe4f7665dabae2bd5147d42c5b6882c99f0bf1

          • memory/324-10-0x0000000000400000-0x000000000043D000-memory.dmp

            Filesize

            244KB

          • memory/324-0-0x0000000000400000-0x000000000043D000-memory.dmp

            Filesize

            244KB

          • memory/2304-11-0x0000000000400000-0x000000000043D000-memory.dmp

            Filesize

            244KB

          • memory/2304-5148-0x0000000000400000-0x000000000043D000-memory.dmp

            Filesize

            244KB

          • memory/2304-18-0x0000000000400000-0x000000000043D000-memory.dmp

            Filesize

            244KB

          • memory/2304-8714-0x0000000000400000-0x000000000043D000-memory.dmp

            Filesize

            244KB