Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    21/09/2024, 10:20

General

  • Target

    0f5fa2c8c1f8632fce66cf44fdc64e0aa373295ab49e0fbc397f8be66913ff5b.exe

  • Size

    717KB

  • MD5

    a3e266623b3a04c853f776ee6ad96b46

  • SHA1

    24a7422e95c21a8cd0cd7dc4e970e1f8ba0c758b

  • SHA256

    0f5fa2c8c1f8632fce66cf44fdc64e0aa373295ab49e0fbc397f8be66913ff5b

  • SHA512

    4061a01c3a47cb54b248a642f77fdec22b2652e4c91d5e0ebab92f3963fff5594ef251a3fecc8422de272dc07279e81b8c933e07dffd1af1794efd199502f360

  • SSDEEP

    12288:q3NbGfC6Aj+TN5uixZN+8rKhUdTC/wE1ZD0Ca5ZIXV:q3NWLOS2opPIXV

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Deletes itself 1 IoCs
  • Drops startup file 2 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 43 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Executes dropped EXE
    PID:1252
    • C:\Users\Admin\AppData\Local\Temp\0f5fa2c8c1f8632fce66cf44fdc64e0aa373295ab49e0fbc397f8be66913ff5b.exe
      "C:\Users\Admin\AppData\Local\Temp\0f5fa2c8c1f8632fce66cf44fdc64e0aa373295ab49e0fbc397f8be66913ff5b.exe"
      2⤵
      • Drops file in Drivers directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2248
      • C:\Windows\SysWOW64\net.exe
        net stop "Kingsoft AntiVirus Service"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2700
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2772
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c C:\Users\Admin\AppData\Local\Temp\$$a45D6.bat
        3⤵
        • Deletes itself
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2808
        • C:\Users\Admin\AppData\Local\Temp\0f5fa2c8c1f8632fce66cf44fdc64e0aa373295ab49e0fbc397f8be66913ff5b.exe
          "C:\Users\Admin\AppData\Local\Temp\0f5fa2c8c1f8632fce66cf44fdc64e0aa373295ab49e0fbc397f8be66913ff5b.exe"
          4⤵
          • Executes dropped EXE
          PID:2584
      • C:\Windows\Logo1_.exe
        C:\Windows\Logo1_.exe
        3⤵
        • Drops file in Drivers directory
        • Drops startup file
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2704
        • C:\Windows\SysWOW64\net.exe
          net stop "Kingsoft AntiVirus Service"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2608
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2568
        • C:\Windows\SysWOW64\net.exe
          net stop "Kingsoft AntiVirus Service"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1680
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2204

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

    Filesize

    258KB

    MD5

    2e87bb70fa957a95516958a996052f03

    SHA1

    5edd1fe21cd364d55d507dfaa5b8e7acd98748d2

    SHA256

    b3d279a058ec152e1a911217b927145cbd99d1832d9f1b4b0428b2bdea4f448c

    SHA512

    26d5c80d22ff17806021b5029ea0bebdca70894f3c041c287d697d69a8342e0cf757d4578571ba25ebeba10482330e504a90354d6cef37f04ec9a0a6992ff616

  • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

    Filesize

    478KB

    MD5

    9079a18ba8965b624d3fbdb211c377a3

    SHA1

    21c0f585d6c3758c564f445a47762847abcd18d9

    SHA256

    b16a3e0f78aec79799f5cbd791293d5e896afc7244294ff5b2757973e416500e

    SHA512

    41e8e9c09432d6b0535640bddef81acbb5500d461cf3b4e0104cd0ff8a773e933df19ae9bda6d31411e670de25973a1663bb9435ff3a69ec9ffbbf1c3d88aaeb

  • C:\Users\Admin\AppData\Local\Temp\$$a45D6.bat

    Filesize

    722B

    MD5

    81a8926dc25cddf4374dd246c959bae2

    SHA1

    0d158f9e5f17325f7f3979c8d23093688cce4f83

    SHA256

    8b8a72d63de630ae749866a9ec1cb893d1424af091525d0358ffeb9cedb8d08f

    SHA512

    739805c37dffdd567db515b6b396d6ed8530cda1847b423034949da7112e553b7cf83d51412230c26f4a69c7e28dda496a4f2d0df15a40b31324ddcf770398e4

  • C:\Users\Admin\AppData\Local\Temp\0f5fa2c8c1f8632fce66cf44fdc64e0aa373295ab49e0fbc397f8be66913ff5b.exe.exe

    Filesize

    684KB

    MD5

    50f289df0c19484e970849aac4e6f977

    SHA1

    3dc77c8830836ab844975eb002149b66da2e10be

    SHA256

    b9b179b305c5268ad428b6ae59de10b4fe99cf0199bbc89b7017181905e97305

    SHA512

    877d852ea1062b90e2fd2f3c4dc7d05d9697e9a9b2929c830a770b62741f6a11e06de73275eb871113f11143faf1cb40d99f7c247862ffb778d26833ed5d7e38

  • C:\Windows\Logo1_.exe

    Filesize

    33KB

    MD5

    6c2e4d9285e03d13ad3438424d7c0433

    SHA1

    199aa50fc7e1e2cd42d28599027a07bc33c77012

    SHA256

    ed075c4bc2193c36e740c272f806413273c0cd7ecfa182cf31d9f8e0a2e37cc6

    SHA512

    e44c0dc38f8d8af74b121b1b70e7ed883e186178898e07af391858dd38340ad5915f8f079679073c8b1d60900d387764f38557e8bc1d02752fde02c596f4704c

  • C:\Windows\system32\drivers\etc\hosts

    Filesize

    832B

    MD5

    7e3a0edd0c6cd8316f4b6c159d5167a1

    SHA1

    753428b4736ffb2c9e3eb50f89255b212768c55a

    SHA256

    1965854dfa54c72529c88c7d9f41fa31b4140cad04cf03d3f0f2e7601fcbdc6c

    SHA512

    9c68f7f72dfa109fcfba6472a1cced85bc6c2a5481232c6d1d039c88b2f65fb86070aeb26ac23e420c6255daca02ea6e698892f7670298d2c4f741b9e9415c7f

  • F:\$RECYCLE.BIN\S-1-5-21-457978338-2990298471-2379561640-1000\_desktop.ini

    Filesize

    9B

    MD5

    5412111268dd2c1fb1cf8697bfab9b6c

    SHA1

    16d0b289e83c74cb50a004edd7c5750ac706f321

    SHA256

    f3aa35be7048ddbf11fc581e5f9476745d75bcf097e121ba2915614e360a0cdc

    SHA512

    13fc5bf11faaf5471fde8a1bafdcc6d27521bad796e5e532c94d9c8232dd70088e70b6d5ac60c4c15d13e59926ac38e9a9e01b4dd4694a77d70bdd1ae7005ccf

  • memory/1252-33-0x0000000002920000-0x0000000002921000-memory.dmp

    Filesize

    4KB

  • memory/2248-13-0x0000000000230000-0x000000000026E000-memory.dmp

    Filesize

    248KB

  • memory/2248-0-0x0000000000400000-0x000000000043E000-memory.dmp

    Filesize

    248KB

  • memory/2248-18-0x0000000000230000-0x000000000026E000-memory.dmp

    Filesize

    248KB

  • memory/2248-20-0x0000000000400000-0x000000000043E000-memory.dmp

    Filesize

    248KB

  • memory/2704-21-0x0000000000400000-0x000000000043E000-memory.dmp

    Filesize

    248KB

  • memory/2704-1615-0x0000000000400000-0x000000000043E000-memory.dmp

    Filesize

    248KB

  • memory/2704-36-0x0000000000400000-0x000000000043E000-memory.dmp

    Filesize

    248KB

  • memory/2704-4784-0x0000000000400000-0x000000000043E000-memory.dmp

    Filesize

    248KB

  • memory/2704-9291-0x0000000000400000-0x000000000043E000-memory.dmp

    Filesize

    248KB