Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    134s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/07/2024, 16:52

General

  • Target

    78ec8a8469dfb480c0a51c3ce2a122342ddf97403007f8e1a9d7b4acedb5849c.exe

  • Size

    512KB

  • MD5

    008b3ec9907d9a77af4184c4bdd21363

  • SHA1

    4eb6cbda2f445ebab6b5e17d24aaf9410f8f0fe2

  • SHA256

    78ec8a8469dfb480c0a51c3ce2a122342ddf97403007f8e1a9d7b4acedb5849c

  • SHA512

    3a1fd9720e2650a0863cfb1be53815224fbae4654469fa13fbd2a7cefa9ae34e9e8527086c0f667a3c711306e48e00f171b965538603454eb8050ebf3170f2b4

  • SSDEEP

    6144:xj9irKZ3HIwK3EsjcNVh4FwGrOg5YnOj/9XTj8Tu6eezwJ:xjErKZ3H1GE86Vh4FwF0O6XcTus

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3464
      • C:\Users\Admin\AppData\Local\Temp\78ec8a8469dfb480c0a51c3ce2a122342ddf97403007f8e1a9d7b4acedb5849c.exe
        "C:\Users\Admin\AppData\Local\Temp\78ec8a8469dfb480c0a51c3ce2a122342ddf97403007f8e1a9d7b4acedb5849c.exe"
        2⤵
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2044
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D8A.bat
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3484
          • C:\Users\Admin\AppData\Local\Temp\78ec8a8469dfb480c0a51c3ce2a122342ddf97403007f8e1a9d7b4acedb5849c.exe
            "C:\Users\Admin\AppData\Local\Temp\78ec8a8469dfb480c0a51c3ce2a122342ddf97403007f8e1a9d7b4acedb5849c.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4852
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4236
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1428
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:1832

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe

      Filesize

      4.9MB

      MD5

      e9551f7f1883304020205736d3824f5c

      SHA1

      2ba67a4a28cfac83f650a3ff3624e8a56d16ff11

      SHA256

      5629e617f8046b02a481e06c057ab05425168d5cc846b7e6d331ddbad9996cb1

      SHA512

      92f0ded4c453a7163a37f88c5cdc289b1c77301f6d33e9027cde56bf28ef692769ca0166aec3ba97d2521acf255de9ad8451286437fe5872f6ac66a9a86c8d89

    • C:\Users\Admin\AppData\Local\Temp\$$a8D8A.bat

      Filesize

      722B

      MD5

      3ffb3441921b8cf6bcbc10a93b4a027b

      SHA1

      2986f1f7c229a686a0c5d7a2ca671f1706ef53d1

      SHA256

      885010d00da892f8bcf5d7a45063d2b9a5314764fee0386a6bf70c5e6bbebf3e

      SHA512

      296b60cd4d1d2919cab89df9e33f53b5633bb1f9cd65137afb78f013c2ced740624815dd38dba28f64f02d6cc56488e0ca06528ffe9967f3317a8e25825cb64b

    • C:\Users\Admin\AppData\Local\Temp\78ec8a8469dfb480c0a51c3ce2a122342ddf97403007f8e1a9d7b4acedb5849c.exe.exe

      Filesize

      468KB

      MD5

      c4ccbfcc0d0a6bb476fb8e8d352b60fa

      SHA1

      681a5f2227fd19e4dbdc61165f1eec37e1cb8abe

      SHA256

      bdcee160a2ee7dcc8309b8db79f5eca7669ace1c06eef7f692a1037bcac1b77a

      SHA512

      8b2685a02eb7670b437e0b3818678a3dd7832026c27520f273dedfdf347a73810d2dafe4863394fd629589ef963c17814c580b65549c0a4594433895be076941

    • C:\Windows\Logo1_.exe

      Filesize

      44KB

      MD5

      a1e83aa49c64944e517bc07a234dab98

      SHA1

      407f1ac960be565208cf819db33efa05f2cb8bed

      SHA256

      bdc5a53d89d55dec88d3b8869e21671b6a219cf99b8ddae8513492f0b8d354c0

      SHA512

      324756cd823e87516dc19831b15b3bda49f0bba854b93fa29b5aca166fae9ba08a6071b05dc03302b8f22382e7967609712a5c7fca8e00eb5afb1f5801c915d4

    • F:\$RECYCLE.BIN\S-1-5-21-1403246978-718555486-3105247137-1000\_desktop.ini

      Filesize

      9B

      MD5

      c20162cff0e529974834e150d7e6691f

      SHA1

      512e9821581354bd8078227ddf386b17e771ff38

      SHA256

      82f2070eb6138ab12ec2a1f0c3ca7b3b97db75cc19a5076ed382b017f309bdd6

      SHA512

      c2c414232ac5fc3d7ff195523c49610795d0ea4d95c69748ef9ddd4a42203ace52a7da8594cb20102743a21b6eb5bd9e7ee5915513a9c11a0db319323538d744

    • memory/2044-0-0x0000000000400000-0x000000000044F000-memory.dmp

      Filesize

      316KB

    • memory/2044-8-0x0000000000400000-0x000000000044F000-memory.dmp

      Filesize

      316KB

    • memory/4236-10-0x0000000000400000-0x000000000044F000-memory.dmp

      Filesize

      316KB

    • memory/4236-5265-0x0000000000400000-0x000000000044F000-memory.dmp

      Filesize

      316KB

    • memory/4236-5267-0x0000000000400000-0x000000000044F000-memory.dmp

      Filesize

      316KB