Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

d3fb9e3760...60.exe

windows7-x64

7

d3fb9e3760...60.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/10/2024, 03:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d3fb9e376020fafcb32c23aa3bf24f477139b0a3975ebd9f0230f984b76bac60.exe

  • Size

    11.1MB

  • MD5

    ed123a2573e3e6086e7c3d6d6bc49950

  • SHA1

    9f8bbf1891f17762b22e95c152328b759e57b1b4

  • SHA256

    d3fb9e376020fafcb32c23aa3bf24f477139b0a3975ebd9f0230f984b76bac60

  • SHA512

    10bc7e6134ed30b723f8b619d669ca5d98457e153d7e1b513cbd5e85cead25872ea28bc7ee0a0bd97bf0360b134ccb91569a4f11d839509840884874262fa24c

  • SSDEEP

    98304:4b+0ChEPIGiq3y3vx+w9TbfjJ+kdfpK46Tle36jknz9Y:y+kIGv3y/x+KTbfjJ+kdnAlejY

Score
7/10
discoveryspywarestealer

Malware Config

Signatures

  • Drops startup file 2 IoCs
  • Executes dropped EXE 3 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3428
      • C:\Users\Admin\AppData\Local\Temp\d3fb9e376020fafcb32c23aa3bf24f477139b0a3975ebd9f0230f984b76bac60.exe
        "C:\Users\Admin\AppData\Local\Temp\d3fb9e376020fafcb32c23aa3bf24f477139b0a3975ebd9f0230f984b76bac60.exe"
        2⤵
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2560
        • C:\Windows\SysWOW64\net.exe
          net stop "Kingsoft AntiVirus Service"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4980
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:3344
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7E48.bat
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4848
          • C:\Users\Admin\AppData\Local\Temp\d3fb9e376020fafcb32c23aa3bf24f477139b0a3975ebd9f0230f984b76bac60.exe
            "C:\Users\Admin\AppData\Local\Temp\d3fb9e376020fafcb32c23aa3bf24f477139b0a3975ebd9f0230f984b76bac60.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:3144
            • C:\Users\Admin\AppData\Local\Temp\d3fb9e376020fafcb32c23aa3bf24f477139b0a3975ebd9f0230f984b76bac60.exe
              "C:\Users\Admin\AppData\Local\Temp\d3fb9e376020fafcb32c23aa3bf24f477139b0a3975ebd9f0230f984b76bac60.exe" --type=collab-renderer --proc=3144
              5⤵
              • Executes dropped EXE
              PID:3456
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Drops startup file
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1388
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1004
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:1152
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4596
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:4796

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\7-Zip\7z.exe
      Filesize

      584KB

      MD5

      67d7e6cf7aed74f7691c574b384a136d

      SHA1

      dbe1104bc4730caa943d97162a5c1ac66c80dace

      SHA256

      d36e5d6ac949eafddcab2ac72b37e21c643cbc651bd17eb68b4826eb37662817

      SHA512

      54a55205d5d7c9cef943fbe4e75ae503a3266c3a35cdacb70d9cb273c04e436152abfce3a39ad9e8f3cbcb826b12792554faebada33166d3af24cfe85a3db33f

      Download Submit

    • C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
      Filesize

      650KB

      MD5

      278994ea44c90109b34535a2f167ee27

      SHA1

      c035d1606ce9f8dbfea2906995ec5ab678f99b05

      SHA256

      c42840f9fc85f325582af1db90179974d80e3879364da16e2ac26c16addb5955

      SHA512

      3a990679ffe6446dd11e0b2a8fd4d0273d4e8ace61280d5a02970a33cbcceb072fd52d5c3712c5b8edcc314152f9b2069835a53f7a7857a00659c68bee0ea051

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\$$a7E48.bat
      Filesize

      722B

      MD5

      246f7ee8e931897525f51aba87c26661

      SHA1

      ca9255103036843b69c78e4469089612a6fe3fbc

      SHA256

      bf138546639eac7648628fc4a8934ca71ab9620b197a32fe6a3490f74d73ca81

      SHA512

      1d118e3b76324bf2e826cf1aa7e3573361d92c9e9e45dd674c8c7079f591d490753f778465f07c46284be759e965265ff8db5a72cd1fed91dddbae6d2318cd86

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\d3fb9e376020fafcb32c23aa3bf24f477139b0a3975ebd9f0230f984b76bac60.exe.exe
      Filesize

      11.0MB

      MD5

      b45b7bd6eb92c5b65378d8d0a0964747

      SHA1

      5ca6f198ac83c90496110259b57ff4a5f47b64bb

      SHA256

      5f1d9218f9735a763ffecc47c7b6f0c342b7f1a5da835733e0b3b73903f864a0

      SHA512

      bde39c4b6d04caae8280bdd53e6036c53ed394a72f0d4d1273c149175570e8a87f87c8963869c96834fef7e82893da38c49ce4aaa1851e65c055dbbcac7c1708

      Download Submit

    • C:\Windows\Logo1_.exe
      Filesize

      40KB

      MD5

      9ae17c14a91b8bdf6a83ef198fdbd729

      SHA1

      00f7e10bdea77650c2dfb5e94cf2b5a45e660cef

      SHA256

      d8d5c4b344590da9b3932b357a251794c8bde0c995f69dcf822f320c425f9c46

      SHA512

      6a0cd4e6112e343dac34eab21833589f59719de05e3ee9f807f831a9b27cc4cf23c9b7a5cfda455f305389322228d719caefd32d17609bd1a9016f1e4751ad0b

      Download Submit

    • F:\$RECYCLE.BIN\S-1-5-21-355097885-2402257403-2971294179-1000\_desktop.ini
      Filesize

      9B

      MD5

      b8eb46e1bdf11b43e775bc46642c7950

      SHA1

      1c08b422249f0a0fa1d7d2c3946f6aaa8b669da5

      SHA256

      1760d532341817f2887d51e6a9b5fcc53a69eb75e3591356c5b25c40d6b04f60

      SHA512

      d947832ba4e2593b7d04760d9e285d10021b0dcf3040fa0aeb82cde089afaf6384865d482ac9acd6ae5473d57e79b8d242254b6372f7d759cd00e95fe339c37c

      Download Submit

    • memory/1388-9-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

      Download

    • memory/1388-19-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

      Download

    • memory/1388-3952-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

      Download

    • memory/1388-8789-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

      Download

    • memory/2560-0-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

      Download

    • memory/2560-11-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

      Download