Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    12/10/2024, 16:20

General

  • Target

    8219fe19473af014d21ea1f74c22c90da1ec37401fda06860e16472c9f28c3a0.exe

  • Size

    1.1MB

  • MD5

    4c7576c47be1159e7d67d42228a2ed42

  • SHA1

    3f5d4c47e975bcddfbb3cfe78eca9f9418741902

  • SHA256

    8219fe19473af014d21ea1f74c22c90da1ec37401fda06860e16472c9f28c3a0

  • SHA512

    3edbe2e46e781eb2e0161af40d8e0ae4f4ca4eb25677f01358d002417686856186d9b602ac69b1cfb95c600d10807ecd5c73f884bf2da7301cecac1ec4cf294a

  • SSDEEP

    24576:t1sXT9T+w6zY8v5a2FZ7WDpk2Kvfd5nP6Wp8zrMBThYBjv:sZ6zY8/7WDaDvfd5iQ8zoBThojv

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 43 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1160
      • C:\Users\Admin\AppData\Local\Temp\8219fe19473af014d21ea1f74c22c90da1ec37401fda06860e16472c9f28c3a0.exe
        "C:\Users\Admin\AppData\Local\Temp\8219fe19473af014d21ea1f74c22c90da1ec37401fda06860e16472c9f28c3a0.exe"
        2⤵
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1668
        • C:\Windows\SysWOW64\net.exe
          net stop "Kingsoft AntiVirus Service"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2300
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:2492
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c C:\Users\Admin\AppData\Local\Temp\$$aD430.bat
          3⤵
          • Deletes itself
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2640
          • C:\Users\Admin\AppData\Local\Temp\8219fe19473af014d21ea1f74c22c90da1ec37401fda06860e16472c9f28c3a0.exe
            "C:\Users\Admin\AppData\Local\Temp\8219fe19473af014d21ea1f74c22c90da1ec37401fda06860e16472c9f28c3a0.exe"
            4⤵
            • Executes dropped EXE
            PID:2788
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Drops startup file
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2516
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2660
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2936
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2932
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2592

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

      Filesize

      258KB

      MD5

      0456bac8764a3f78c967821119bb4f07

      SHA1

      f296b8ce103fa29383807d78a08f023cb46e1958

      SHA256

      edfe13ae1351ec0f0e9c4820fd1219065c3d1d9133555cea67aa33f831021700

      SHA512

      3abed39dc45ab5aa95073cdc1be3965c5f7e581d96b1fd3befd231fc6cf2db9bb0f6996e50a8c7249d240a141185c8abf0b4a064aeddfe7adeb9b89bee3844c9

    • C:\Users\Admin\AppData\Local\Temp\$$aD430.bat

      Filesize

      722B

      MD5

      547ab21aaf48bd9bdfba2f3fe6156447

      SHA1

      ae091dd343b0fe8bccd39910fa0653f2fe6c10d5

      SHA256

      8db5630af128735b3309e0ab119279fcba0a854063e6b068dc73e7007b2f0662

      SHA512

      1ba0a8b7ebae4f231469775e94187765d29d8bf8034bff1d880673f94ba0f8ae691fcce444fecb12b9c76e21f5e133f886ff25d9ba7c8e9f1a3dad8cdfa00147

    • C:\Users\Admin\AppData\Local\Temp\8219fe19473af014d21ea1f74c22c90da1ec37401fda06860e16472c9f28c3a0.exe.exe

      Filesize

      1.1MB

      MD5

      f012ebe3b9f0c4d18b43076b68295667

      SHA1

      27ce582d305bf5ec574fd7edf39e1300783e9323

      SHA256

      bdff5163ff3787a7a8b6bb3f688e877c5fa10db2ad535bb9765c91e976fbcafe

      SHA512

      06ce3eceb42ca555511f55e85fe79441a4a8c70ad32c36a045560cb8449e44f08bcd9e938e9a11a0360c7363ba2fff4dd92b1a300e21e214a6d273009d8c2463

    • C:\Windows\Logo1_.exe

      Filesize

      33KB

      MD5

      c4440056e06065be031cfa6acd94c763

      SHA1

      6c1f366e99fb096685fe30bab2f51d0a41dc7188

      SHA256

      878628fbd3611ca93730e8df7e81fa34165480a71e875cbfc192fb83f97e386e

      SHA512

      e8301dc938a9bc3b2205951171ca38d7c441e425d4d8e1e97ad82fb2b2f519ad4b9774d58b482183a50b769a7a16ec951ea828755c7433b454016b0fae2c86d4

    • F:\$RECYCLE.BIN\S-1-5-21-312935884-697965778-3955649944-1000\_desktop.ini

      Filesize

      10B

      MD5

      291aa08828faa68893c7f89a0dfc158b

      SHA1

      fcae3d190f0d8c14b44dc2be0b627b0680d2eab9

      SHA256

      f9e79f635e09441b5a073e6263a1d1de881c2105d7637650b5ec2d20f6a7c841

      SHA512

      9c80a5e3e37731eb0eba85b496e512dbfe08c77c207bcb41ad429d289e3d348e8e7b83ef00052c445581df37aa60729a4f0c2dd3ed0ed2e5d05a8758a23f1f38

    • memory/1160-31-0x0000000002CE0000-0x0000000002CE1000-memory.dmp

      Filesize

      4KB

    • memory/1668-18-0x0000000000400000-0x000000000043D000-memory.dmp

      Filesize

      244KB

    • memory/1668-19-0x00000000001C0000-0x00000000001FD000-memory.dmp

      Filesize

      244KB

    • memory/1668-0-0x0000000000400000-0x000000000043D000-memory.dmp

      Filesize

      244KB

    • memory/1668-16-0x00000000001C0000-0x00000000001FD000-memory.dmp

      Filesize

      244KB

    • memory/2516-34-0x0000000000400000-0x000000000043D000-memory.dmp

      Filesize

      244KB

    • memory/2516-2956-0x0000000000400000-0x000000000043D000-memory.dmp

      Filesize

      244KB

    • memory/2516-4162-0x0000000000400000-0x000000000043D000-memory.dmp

      Filesize

      244KB