Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    01/09/2024, 02:17

General

  • Target

    a43aa4c3703fbb1f366be53f0b25457be19d94a20a69a18e6fc8fba76b665c4b.exe

  • Size

    171KB

  • MD5

    791f7273cb34e21ba8b88ea60100e6d6

  • SHA1

    07bee4eda217456e28474042b19a2202ae362ccd

  • SHA256

    a43aa4c3703fbb1f366be53f0b25457be19d94a20a69a18e6fc8fba76b665c4b

  • SHA512

    cad89ca6292ed89a12f73cb2479ef0756fa5130bcaf1d00e4753bdc85d58351c1ad4d4d807e22648682f846222c716df75d266be34c407553e3329f3bd072a3c

  • SSDEEP

    3072:Ate+aezUa6pBiU99djmMGWBgh1002J8emEu3T7TO+9Z9sTOVrZzxVxU:l+aezCpB/YWBW1Wu3rOOuOVr8

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Drops startup file 2 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 43 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    PID:1188
    • C:\Users\Admin\AppData\Local\Temp\a43aa4c3703fbb1f366be53f0b25457be19d94a20a69a18e6fc8fba76b665c4b.exe
      "C:\Users\Admin\AppData\Local\Temp\a43aa4c3703fbb1f366be53f0b25457be19d94a20a69a18e6fc8fba76b665c4b.exe"
      2⤵
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2220
      • C:\Windows\SysWOW64\net.exe
        net stop "Kingsoft AntiVirus Service"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1712
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2584
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c C:\Users\Admin\AppData\Local\Temp\$$aA592.bat
        3⤵
        • Deletes itself
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2752
        • C:\Users\Admin\AppData\Local\Temp\a43aa4c3703fbb1f366be53f0b25457be19d94a20a69a18e6fc8fba76b665c4b.exe
          "C:\Users\Admin\AppData\Local\Temp\a43aa4c3703fbb1f366be53f0b25457be19d94a20a69a18e6fc8fba76b665c4b.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:2792
      • C:\Windows\Logo1_.exe
        C:\Windows\Logo1_.exe
        3⤵
        • Drops startup file
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2180
        • C:\Windows\SysWOW64\net.exe
          net stop "Kingsoft AntiVirus Service"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2928
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2060
        • C:\Windows\SysWOW64\net.exe
          net stop "Kingsoft AntiVirus Service"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2848
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2824

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

    Filesize

    264KB

    MD5

    297174cd7555610558f6b0963d51959d

    SHA1

    cf49c0c794953afb6215b5a40a94eb80883d459a

    SHA256

    1af18f231c1b4ad3eea5f379a16689d9d255bc16c8ccdccef12036c909a604b7

    SHA512

    c01a218df37d548e1adb60a4081442ac65ad81541fb550e81e4f130377d565785792b7735fe5ac480118ea4c5df5340aaa1d8de926245b22e268ca694d14c2e2

  • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

    Filesize

    484KB

    MD5

    e81910ec88765abcb2543d1b8c398902

    SHA1

    decc58517653fd3118508debf5fe5b7ec88f9b67

    SHA256

    4380184488b4e4894847e9a1dc5e4b3fb1dbbb7d4e0de341d411cc822a094d03

    SHA512

    ae444bd9925bd0e29f1e164fc19c11b3845f17c0af56baf05e8b6fcc7ea3b4b6afb151de19e88aaa011c6039ff85080c941549f97bef1144ad78b4611e0df20f

  • C:\Users\Admin\AppData\Local\Temp\$$aA592.bat

    Filesize

    722B

    MD5

    a56e3e7a747e6709da67d4ff15555a8c

    SHA1

    0c4a4211eb487efd015882b3cd67380b019c4a4e

    SHA256

    a27d0dbea6f407d3439323de273778336ade45f4cbb6ecd5cdc0813f5f85b170

    SHA512

    2ad870156f3536e7a8fb3d192811592bc50879691e29220d673c6a9140a3aa7b2796b66631b90b1994c124cff041859029cf6bb3bae262a80bfe1ce0d57a12f6

  • C:\Users\Admin\AppData\Local\Temp\a43aa4c3703fbb1f366be53f0b25457be19d94a20a69a18e6fc8fba76b665c4b.exe.exe

    Filesize

    131KB

    MD5

    16438a96a8adb85472ca72da04701b29

    SHA1

    b1f5ee8bc083804de4de820255107f6541c84735

    SHA256

    9291cd97d2f1b119438f16e97ea75119f19fd959ec5414e84b337530d692e289

    SHA512

    58f659a29cb34245a261b7666b1cda4b76f2df1039f3713dda6ff5a97c33b4cc273b110d10b4131a6a5c13897efcfa9a5ef3031e0e5fb14db1adc0ac1ef25dcd

  • C:\Windows\Logo1_.exe

    Filesize

    39KB

    MD5

    0b034525c0a86d564a1585fe1b22bb5f

    SHA1

    e12b56f99a607fb621f7af46c5d829d71ce97cd6

    SHA256

    d8a7abd2d5a1dce1488ea5a68f80cdebca7225ab725853a8f5277855bdf23c4e

    SHA512

    4ccf381fcb4038259db3a9e6099e79b203e4f8e22771300f9429d811ae022327953f2648458bfa78dac78e58b2cf2af8a1dad34207d736ebf4cfff0dedabbf4a

  • F:\$RECYCLE.BIN\S-1-5-21-1506706701-1246725540-2219210854-1000\_desktop.ini

    Filesize

    8B

    MD5

    4b4a61d6d446a36ccde31e7ebd6e7aeb

    SHA1

    6abcca1983b34a570385eb5b421b92449c851dfc

    SHA256

    d685543d9800644339454e98bc6c2f9ccea646fd51fdb5181583ca60fcdef8e9

    SHA512

    c25ac03153db7beb8b163c82e5ef75e916346047a00202825b79797b6259f877eea6fac6ea333743d7e423d5fc65d713e9e0cafc0631321beab8ae01ede9ee65

  • memory/1188-31-0x0000000002540000-0x0000000002541000-memory.dmp

    Filesize

    4KB

  • memory/2180-34-0x0000000000400000-0x000000000043D000-memory.dmp

    Filesize

    244KB

  • memory/2180-3005-0x0000000000400000-0x000000000043D000-memory.dmp

    Filesize

    244KB

  • memory/2180-4196-0x0000000000400000-0x000000000043D000-memory.dmp

    Filesize

    244KB

  • memory/2220-0-0x0000000000400000-0x000000000043D000-memory.dmp

    Filesize

    244KB

  • memory/2220-16-0x00000000003C0000-0x00000000003FD000-memory.dmp

    Filesize

    244KB

  • memory/2220-18-0x0000000000400000-0x000000000043D000-memory.dmp

    Filesize

    244KB

  • memory/2220-19-0x00000000003C0000-0x00000000003FD000-memory.dmp

    Filesize

    244KB

  • memory/2792-25-0x00000000000E0000-0x00000000000E1000-memory.dmp

    Filesize

    4KB

  • memory/2792-36-0x00000000000E0000-0x00000000000E1000-memory.dmp

    Filesize

    4KB