Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    11/08/2024, 19:56

General

  • Target

    13c4be2974cf679b448ffe6f17816cd0492680b5bab758118069aed4d10eb39d.exe

  • Size

    1.1MB

  • MD5

    1ec3aacd70ffb14f3431a57abacb988b

  • SHA1

    63df42986534930ba0c24c539caa0c5be4d39f4a

  • SHA256

    13c4be2974cf679b448ffe6f17816cd0492680b5bab758118069aed4d10eb39d

  • SHA512

    633c9ecc1d5213b1e01249a67cca3e530db44b21147a47ba87d8bc7985265b28778f5426d11e105fb0a1dbef94bd386fa2f71a6f669ae51cf92d979d08ddc7ce

  • SSDEEP

    24576:Wf9AiKGpEoQpkN2C4McuKo0GTNJpyT5RGeQa0s:W+GtCi27mVHyT+a0s

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1196
      • C:\Users\Admin\AppData\Local\Temp\13c4be2974cf679b448ffe6f17816cd0492680b5bab758118069aed4d10eb39d.exe
        "C:\Users\Admin\AppData\Local\Temp\13c4be2974cf679b448ffe6f17816cd0492680b5bab758118069aed4d10eb39d.exe"
        2⤵
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2056
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c C:\Users\Admin\AppData\Local\Temp\$$aA14E.bat
          3⤵
          • Deletes itself
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2052
          • C:\Users\Admin\AppData\Local\Temp\13c4be2974cf679b448ffe6f17816cd0492680b5bab758118069aed4d10eb39d.exe
            "C:\Users\Admin\AppData\Local\Temp\13c4be2974cf679b448ffe6f17816cd0492680b5bab758118069aed4d10eb39d.exe"
            4⤵
            • Executes dropped EXE
            PID:2864
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1760
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2904
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2824

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

      Filesize

      254KB

      MD5

      0e96df2b803787ad87d98fb164a286f5

      SHA1

      0790c9a340015c2e2ebbd5459c90b82cf6ae5f3a

      SHA256

      8951711f84a55417c6e4f31b004f415a75abe8b26696751f840fcc8e928b9a8e

      SHA512

      5fcc84cd18c7f9927e200ba37cc5ecf8d877736c3b14bc95d23aa734e9257db9b40a154cedcc56f1f3222f8153f93ca45ee2307315cfe3a14430a6c77d06501e

    • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

      Filesize

      474KB

      MD5

      2d816096dcd7a9b38e9b445b75c019a1

      SHA1

      e3c192f07e460078a7b2db4aeb94d4c53700bd75

      SHA256

      43b6be2e758c7e161993e451ce005a00345b4f3ba8b3c069d55ce93ac7e19758

      SHA512

      6af3ed08658c195072f549af50b96cd05e8070bf468add1884caba811145e88e28ff016298ea52078d7d31bded223c12bf6ca294219610ba2a5036dd442d356c

    • C:\Users\Admin\AppData\Local\Temp\$$aA14E.bat

      Filesize

      722B

      MD5

      b711b4fa62645564a7f63fc7d096f49c

      SHA1

      5a1e7b89b48034efaaef345f448b980c6c9f6bba

      SHA256

      69c35c28f8ce0709b33b6c58b6e21a4533a0b2d17a652268ae80c6a402e1283e

      SHA512

      fe05c542575fff2fce9a1d1419110d5691c04576a0854f412d838e953675bae18d95f18412fd8295480a3593fbf4f2766a79471cd2b9faa39ba8cf9956f4b111

    • C:\Users\Admin\AppData\Local\Temp\13c4be2974cf679b448ffe6f17816cd0492680b5bab758118069aed4d10eb39d.exe.exe

      Filesize

      1.1MB

      MD5

      09239e688ff75cd636ac932100b243f9

      SHA1

      2a7964c81b9a34bb77c4e3676e7d31b7d2668297

      SHA256

      a36ef4c18a08ee8d8c0d10d96ab37a0c3ce22a8f328733af8c0451579e4edcb1

      SHA512

      686708321d8756ddcfa2d1585ca7261be0ece33bd9d134888cdb4655b8484c727b34b4ac7f12d919184e85ab65088bc565549c262289cb64f9aeca0508290825

    • C:\Windows\rundl132.exe

      Filesize

      29KB

      MD5

      44e459665555aa71b27739a4c8e0ce2e

      SHA1

      a356a45529a77684280cab95f9658263facadedc

      SHA256

      791918b0fdd6d93878a051a648a2d60d04f2e12fb5428d138dcc2b63fbf94c13

      SHA512

      ede586c602defafd40a4507989f664d3345a5b0b2172251e10f84d87e44ee56b9546e04c7f7aeb621d72be7714de56f01ca06c0cf266938165d3408cc92969b7

    • F:\$RECYCLE.BIN\S-1-5-21-3450744190-3404161390-554719085-1000\_desktop.ini

      Filesize

      9B

      MD5

      79a2fb76ad00a8ac07f11b6a179f5297

      SHA1

      72b4f589fd7945d8c80b370d1d3a1f2467f3eb81

      SHA256

      2f723e98c3a3556269a4d81d4a27d6a0ab13a84c5ba737493c07354a2608684f

      SHA512

      3a21c2e60e8e035fb90d428e86bb927077d8354a16f1abc291ccba4a4d7fee4f51cf781fa9202e5602a88ca70a6ba264ac49762100be5f6e09a2ec930e098168

    • memory/1196-29-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

      Filesize

      4KB

    • memory/1760-96-0x0000000000400000-0x0000000000436000-memory.dmp

      Filesize

      216KB

    • memory/1760-31-0x0000000000400000-0x0000000000436000-memory.dmp

      Filesize

      216KB

    • memory/1760-38-0x0000000000400000-0x0000000000436000-memory.dmp

      Filesize

      216KB

    • memory/1760-44-0x0000000000400000-0x0000000000436000-memory.dmp

      Filesize

      216KB

    • memory/1760-90-0x0000000000400000-0x0000000000436000-memory.dmp

      Filesize

      216KB

    • memory/1760-814-0x0000000000400000-0x0000000000436000-memory.dmp

      Filesize

      216KB

    • memory/1760-1873-0x0000000000400000-0x0000000000436000-memory.dmp

      Filesize

      216KB

    • memory/1760-2872-0x0000000000400000-0x0000000000436000-memory.dmp

      Filesize

      216KB

    • memory/1760-3333-0x0000000000400000-0x0000000000436000-memory.dmp

      Filesize

      216KB

    • memory/1760-18-0x0000000000400000-0x0000000000436000-memory.dmp

      Filesize

      216KB

    • memory/2056-0-0x0000000000400000-0x0000000000436000-memory.dmp

      Filesize

      216KB

    • memory/2056-16-0x0000000000400000-0x0000000000436000-memory.dmp

      Filesize

      216KB