Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/07/2024, 14:21

General

  • Target

    a9690d282fa4128d217afa3f114eefdc04caf3ee8b5ab66641473fee6362fdf4.exe

  • Size

    87KB

  • MD5

    87c6053235fc9e8545d4bef7f94feda4

  • SHA1

    12962584a5fd22e2d81af1cde8176f3844f8013f

  • SHA256

    a9690d282fa4128d217afa3f114eefdc04caf3ee8b5ab66641473fee6362fdf4

  • SHA512

    c747564f3f805e93260c198f37b656444a7e7c716d283d4a8f479fc43319102a64c146911099b305df42fd217ed60ddf2b19023cf17f27dfba3de0c22a4b4beb

  • SSDEEP

    1536:eFcx1ae9n40g9i/qo6SKH/RbUi+QLcnC/ZMaRiIu/r:eFfZQioJKmnCRMaRiTT

Score
7/10

Malware Config

Signatures

  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3556
      • C:\Users\Admin\AppData\Local\Temp\a9690d282fa4128d217afa3f114eefdc04caf3ee8b5ab66641473fee6362fdf4.exe
        "C:\Users\Admin\AppData\Local\Temp\a9690d282fa4128d217afa3f114eefdc04caf3ee8b5ab66641473fee6362fdf4.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1212
        • C:\Windows\SysWOW64\net.exe
          net stop "Kingsoft AntiVirus Service"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4260
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
            4⤵
              PID:916
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8637.bat
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:4816
            • C:\Users\Admin\AppData\Local\Temp\a9690d282fa4128d217afa3f114eefdc04caf3ee8b5ab66641473fee6362fdf4.exe
              "C:\Users\Admin\AppData\Local\Temp\a9690d282fa4128d217afa3f114eefdc04caf3ee8b5ab66641473fee6362fdf4.exe"
              4⤵
              • Executes dropped EXE
              PID:3624
          • C:\Windows\Logo1_.exe
            C:\Windows\Logo1_.exe
            3⤵
            • Drops startup file
            • Executes dropped EXE
            • Enumerates connected drives
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2144
            • C:\Windows\SysWOW64\net.exe
              net stop "Kingsoft AntiVirus Service"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:4616
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                5⤵
                  PID:1872
              • C:\Windows\SysWOW64\net.exe
                net stop "Kingsoft AntiVirus Service"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:4908
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                  5⤵
                    PID:4080

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe

            Filesize

            251KB

            MD5

            e3b8ef4f691ddcc7936415e89be83583

            SHA1

            87ef1e48cb29be9f8bc8d8a7d37e58f7b78e0d6d

            SHA256

            52044f9468d832bf9a0d32672e67cefbf8b7f5f6e13468090ed447868e5d4b02

            SHA512

            e1b2b2f4d55cf6ebffe7dd862508436e7a2feb6ba8dc73960bb83905f33002409730b9f77de382589f5805c81075254c26d3e0887e91d1b0e48ddb319d8fff2e

          • C:\Program Files\7-Zip\7z.exe

            Filesize

            577KB

            MD5

            7658c9c47ef2805682a3b682465720db

            SHA1

            f12ac645874395e5aa0b0140faecef4119554c3b

            SHA256

            a7463ce4b4a0cb0128fef035b8069caa9d8530a3d797b6615f80acc87888de28

            SHA512

            458b86000db315100ce26668cf8b70ad38f543751fa8a7d666fc9c611f3d3c42303400f1ed4314986e9ea7eec0c9c70db9d020f06725440df4d52dcb5e4f2b40

          • C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe

            Filesize

            643KB

            MD5

            c08994604c02bf7431e4c46295a779d5

            SHA1

            7f526582e292083589253bbc8b2cd093b2229ff2

            SHA256

            218bfecab8804a634b05ebcedc30eab7aa8fa8ed5775495ba9545517c311f00e

            SHA512

            13d9b746d0fe6922ecff9b5bf0ac896a63da11610341d4a7701e2a8d8fc5c0511d7bd9f4f54d3756b770998601b4f7b39b7e5c36d824dd42470fb0b499065c34

          • C:\Users\Admin\AppData\Local\Temp\$$a8637.bat

            Filesize

            722B

            MD5

            e58bdb28cf58acdb73262f89e6230be6

            SHA1

            c3d015616c1c8a2e4f5ecd742d30afa20d90e685

            SHA256

            67f3f0bd3bab0e1bd78c8581ce5d0714e5670c001905dafc40cb2898ea16e7f1

            SHA512

            8e7a532c642bc3fa312b2e07285160978844d75ae9f6d3f62da5e2fa1441c5adac0485047d8c5d126cedab7ca2697bf25385c2b07d8effb77f7e487e1054800e

          • C:\Users\Admin\AppData\Local\Temp\a9690d282fa4128d217afa3f114eefdc04caf3ee8b5ab66641473fee6362fdf4.exe.exe

            Filesize

            53KB

            MD5

            87912631f20ab91421228cd219922519

            SHA1

            71a90e384de55c6f5257466e53f6c0add270a01d

            SHA256

            fcfdb5e2601430a674f599e054f65471e42cb18f8484aa8d8eb38f0c6f4e9c6d

            SHA512

            0843a6a6a1e7e6d394db8d939e5e11ddfbed917e262dcb41fddee490d7e1657d45edd93fa2e734a6d8419b2f935ef53c0185d626a83ef1e7d53db8e261f8fc8a

          • C:\Windows\Logo1_.exe

            Filesize

            33KB

            MD5

            117c9521e5d8959b1861c9511c792fea

            SHA1

            8b69af116f9b988e45371c811cbddbadcc067e44

            SHA256

            ec905c17086effa5331a07e7805a26bbe62d94c5e90f5fa55a45c668061285de

            SHA512

            93b85bf1c95bdb8781ff90f88faa4b8a0945067be93390b87ee7ab5830b17b257422cfcfcd87078c5004510e2b553876070813a55faaa578e0b979576a2c0eeb

          • F:\$RECYCLE.BIN\S-1-5-21-47134698-4092160662-1261813102-1000\_desktop.ini

            Filesize

            9B

            MD5

            5e286801abdc6ca5d3091665a72ecd7c

            SHA1

            87e0b4601ab0b05784a1059a45d72d807b0e2cbb

            SHA256

            131ccc46b756e5373dc2f2d37625bfb980a48f2f2287585da364166cf2e709b5

            SHA512

            51506d6adb68cca9e21fcddfe9672b91352cdb4f3c5b8c2da40219c73d2e7724776cd8701ff68449720c0aa398fe4f7665dabae2bd5147d42c5b6882c99f0bf1

          • memory/1212-10-0x0000000000400000-0x000000000043D000-memory.dmp

            Filesize

            244KB

          • memory/1212-0-0x0000000000400000-0x000000000043D000-memory.dmp

            Filesize

            244KB

          • memory/2144-18-0x0000000000400000-0x000000000043D000-memory.dmp

            Filesize

            244KB

          • memory/2144-3016-0x0000000000400000-0x000000000043D000-memory.dmp

            Filesize

            244KB

          • memory/2144-11-0x0000000000400000-0x000000000043D000-memory.dmp

            Filesize

            244KB

          • memory/2144-8859-0x0000000000400000-0x000000000043D000-memory.dmp

            Filesize

            244KB