Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    157s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    19/09/2022, 19:37

General

  • Target

    bd10ca593172763d41b09f033ad4c90fc5cb243fbbb9d7d15925839ec16c16d1.exe

  • Size

    45KB

  • MD5

    020891f9564e88267b002a4731429b4b

  • SHA1

    154b6231dc8866917a633cb02814047df7b21df3

  • SHA256

    bd10ca593172763d41b09f033ad4c90fc5cb243fbbb9d7d15925839ec16c16d1

  • SHA512

    47cd5b3e2d45f12e686e0686f52018fdce0bfa696a200e6f8b70c9023f3b9b1005c80b86bd8afa8f1ff301d957f9b0b8b8963b819e62f82bd95558c8ebd76f55

  • SSDEEP

    768:r9FyRBrXcPo0LomyVXyEDel8CYk4HV8jr5AJFNcy259f5FwekD8V9LgctsWkc9B/:PyDjcPaRVEGtkMV8/CJFNcyE9bwe08Vf

Score
10/10

Malware Config

Signatures

  • Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 6 IoCs
  • Drops file in Drivers directory 2 IoCs
  • Executes dropped EXE 4 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 6 IoCs
  • Drops file in System32 directory 7 IoCs
  • Modifies registry class 16 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1208
      • C:\Users\Admin\AppData\Local\Temp\bd10ca593172763d41b09f033ad4c90fc5cb243fbbb9d7d15925839ec16c16d1.exe
        "C:\Users\Admin\AppData\Local\Temp\bd10ca593172763d41b09f033ad4c90fc5cb243fbbb9d7d15925839ec16c16d1.exe"
        2⤵
        • Adds autorun key to be loaded by Explorer.exe on startup
        • Loads dropped DLL
        • Drops file in System32 directory
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:1288
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /C start c:\boot.sys
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1280
          • \??\c:\boot.sys
            c:\boot.sys
            4⤵
            • Adds autorun key to be loaded by Explorer.exe on startup
            • Drops file in Drivers directory
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in System32 directory
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:672
        • C:\Windows\SysWOW64\Apbcjo32.exe
          C:\Windows\system32\Apbcjo32.exe
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in System32 directory
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of WriteProcessMemory
          PID:872
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /C start c:\boot.sys
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1748
            • \??\c:\boot.sys
              c:\boot.sys
              5⤵
              • Adds autorun key to be loaded by Explorer.exe on startup
              • Drops file in Drivers directory
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in System32 directory
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:1716
          • C:\Windows\SysWOW64\EBCGBIDD.exe
            C:\Windows\system32\EBCGBIDD.exe C:\Windows\SysWOW64\Apbcjo32.exe
            4⤵
            • Executes dropped EXE
            PID:452
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /C C:\Windows\system32\xslfdlnt.bat
          3⤵
          • Deletes itself
          PID:940

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\SysWOW64\Apbcjo32.exe

      Filesize

      45KB

      MD5

      020891f9564e88267b002a4731429b4b

      SHA1

      154b6231dc8866917a633cb02814047df7b21df3

      SHA256

      bd10ca593172763d41b09f033ad4c90fc5cb243fbbb9d7d15925839ec16c16d1

      SHA512

      47cd5b3e2d45f12e686e0686f52018fdce0bfa696a200e6f8b70c9023f3b9b1005c80b86bd8afa8f1ff301d957f9b0b8b8963b819e62f82bd95558c8ebd76f55

    • C:\Windows\SysWOW64\Apbcjo32.exe

      Filesize

      45KB

      MD5

      020891f9564e88267b002a4731429b4b

      SHA1

      154b6231dc8866917a633cb02814047df7b21df3

      SHA256

      bd10ca593172763d41b09f033ad4c90fc5cb243fbbb9d7d15925839ec16c16d1

      SHA512

      47cd5b3e2d45f12e686e0686f52018fdce0bfa696a200e6f8b70c9023f3b9b1005c80b86bd8afa8f1ff301d957f9b0b8b8963b819e62f82bd95558c8ebd76f55

    • C:\Windows\SysWOW64\EBCGBIDD.exe

      Filesize

      13KB

      MD5

      3c3441990e0bf0eada3a93de7bb6b829

      SHA1

      1642694577d033cd73c0348b8754ce5403dc6530

      SHA256

      852e1896be3f1be4483c058c94c179cbf2ffeea8d8d7b574ee54934950330121

      SHA512

      0c4218b51f61fffb148d28f858b087fa07fe561b54b3988f379339f8ce6649fad36fff3c3f620e23efda213ce5475b0d823f157dd4e47b30226fb078563165b0

    • C:\Windows\SysWOW64\drivers\ndisrd.sys

      Filesize

      14KB

      MD5

      62d4ef02daab1e5a32a2dee911bbb8a2

      SHA1

      99eb26074ef938a8474aaa2ee57687044772f093

      SHA256

      f70bc344cad6386fe95b4c389eae117d8a7c68d982055939f60a15ca0d01ef77

      SHA512

      03b87bc7558e7502f325f2c46abb8d5ca17ac8077f13896ae6a305865f7965cfcf6b07cc236d20772691599f35c9602fdce3714a835a23fa8316340982bb8f67

    • C:\Windows\SysWOW64\xslfdlnt.bat

      Filesize

      287B

      MD5

      fa761cf8bddf680783f85e65f96418b2

      SHA1

      520fcaad5d4f332401db69d1cc8040e814d2040a

      SHA256

      367136f8e8b6d1078e92f4aebb33d6e51b2c2ce5427521852c27fed645745641

      SHA512

      15e282857190c14e25438792d0fb7635fe9f00d8542c86101de048ccbc1bedadd5c4aad545d4c0a2785045a92c69f10c4f2a6e1b03429d62e5041f11cc9395ea

    • C:\boot.sys

      Filesize

      16KB

      MD5

      37c28dd5c1e185c5cded257ad6c91c03

      SHA1

      3f84157f5bbfeebd135220130a8b0bd616017545

      SHA256

      1e2813f4a23f085eb4812095a26d592902cda2582e190e162c3f7dc3825c5c1b

      SHA512

      f7cab8fc08ff970577b6a1b79743fbedb53eb4318394f6e0c54efc575c709d55b74d33c3bf7e0b7ad5c1b625a384538ee1434caf460eb158e5352efc08ed3b41

    • C:\boot.sys

      Filesize

      16KB

      MD5

      37c28dd5c1e185c5cded257ad6c91c03

      SHA1

      3f84157f5bbfeebd135220130a8b0bd616017545

      SHA256

      1e2813f4a23f085eb4812095a26d592902cda2582e190e162c3f7dc3825c5c1b

      SHA512

      f7cab8fc08ff970577b6a1b79743fbedb53eb4318394f6e0c54efc575c709d55b74d33c3bf7e0b7ad5c1b625a384538ee1434caf460eb158e5352efc08ed3b41

    • \??\c:\boot.sys

      Filesize

      16KB

      MD5

      37c28dd5c1e185c5cded257ad6c91c03

      SHA1

      3f84157f5bbfeebd135220130a8b0bd616017545

      SHA256

      1e2813f4a23f085eb4812095a26d592902cda2582e190e162c3f7dc3825c5c1b

      SHA512

      f7cab8fc08ff970577b6a1b79743fbedb53eb4318394f6e0c54efc575c709d55b74d33c3bf7e0b7ad5c1b625a384538ee1434caf460eb158e5352efc08ed3b41

    • \??\c:\boot.sys

      Filesize

      16KB

      MD5

      37c28dd5c1e185c5cded257ad6c91c03

      SHA1

      3f84157f5bbfeebd135220130a8b0bd616017545

      SHA256

      1e2813f4a23f085eb4812095a26d592902cda2582e190e162c3f7dc3825c5c1b

      SHA512

      f7cab8fc08ff970577b6a1b79743fbedb53eb4318394f6e0c54efc575c709d55b74d33c3bf7e0b7ad5c1b625a384538ee1434caf460eb158e5352efc08ed3b41

    • \Windows\SysWOW64\Apbcjo32.exe

      Filesize

      45KB

      MD5

      020891f9564e88267b002a4731429b4b

      SHA1

      154b6231dc8866917a633cb02814047df7b21df3

      SHA256

      bd10ca593172763d41b09f033ad4c90fc5cb243fbbb9d7d15925839ec16c16d1

      SHA512

      47cd5b3e2d45f12e686e0686f52018fdce0bfa696a200e6f8b70c9023f3b9b1005c80b86bd8afa8f1ff301d957f9b0b8b8963b819e62f82bd95558c8ebd76f55

    • \Windows\SysWOW64\Apbcjo32.exe

      Filesize

      45KB

      MD5

      020891f9564e88267b002a4731429b4b

      SHA1

      154b6231dc8866917a633cb02814047df7b21df3

      SHA256

      bd10ca593172763d41b09f033ad4c90fc5cb243fbbb9d7d15925839ec16c16d1

      SHA512

      47cd5b3e2d45f12e686e0686f52018fdce0bfa696a200e6f8b70c9023f3b9b1005c80b86bd8afa8f1ff301d957f9b0b8b8963b819e62f82bd95558c8ebd76f55

    • \Windows\SysWOW64\EBCGBIDD.exe

      Filesize

      13KB

      MD5

      3c3441990e0bf0eada3a93de7bb6b829

      SHA1

      1642694577d033cd73c0348b8754ce5403dc6530

      SHA256

      852e1896be3f1be4483c058c94c179cbf2ffeea8d8d7b574ee54934950330121

      SHA512

      0c4218b51f61fffb148d28f858b087fa07fe561b54b3988f379339f8ce6649fad36fff3c3f620e23efda213ce5475b0d823f157dd4e47b30226fb078563165b0

    • \Windows\SysWOW64\EBCGBIDD.exe

      Filesize

      13KB

      MD5

      3c3441990e0bf0eada3a93de7bb6b829

      SHA1

      1642694577d033cd73c0348b8754ce5403dc6530

      SHA256

      852e1896be3f1be4483c058c94c179cbf2ffeea8d8d7b574ee54934950330121

      SHA512

      0c4218b51f61fffb148d28f858b087fa07fe561b54b3988f379339f8ce6649fad36fff3c3f620e23efda213ce5475b0d823f157dd4e47b30226fb078563165b0

    • \Windows\SysWOW64\gzvpo32.dll

      Filesize

      10KB

      MD5

      8bf32bb81490a0c0428ff8b6f59ee042

      SHA1

      959550372bfb3e254057c750bf858df375e8848e

      SHA256

      f48fedceac21e1b76871f30d84786d2bc3c6de854d0d58ea3f6a53f6f16a03db

      SHA512

      9caeefa2a2d275983b29a8fc454e3fa140b0217533d9102f722381bbf3d6a76db708de7d4da3c6ec1687c9896752e8c5137276ee2db0b0eaa903bb9dde8b6b48

    • \Windows\SysWOW64\lfcob32.dll

      Filesize

      10KB

      MD5

      8bf32bb81490a0c0428ff8b6f59ee042

      SHA1

      959550372bfb3e254057c750bf858df375e8848e

      SHA256

      f48fedceac21e1b76871f30d84786d2bc3c6de854d0d58ea3f6a53f6f16a03db

      SHA512

      9caeefa2a2d275983b29a8fc454e3fa140b0217533d9102f722381bbf3d6a76db708de7d4da3c6ec1687c9896752e8c5137276ee2db0b0eaa903bb9dde8b6b48

    • memory/452-73-0x00000000752B1000-0x00000000752B3000-memory.dmp

      Filesize

      8KB

    • memory/672-79-0x0000000073250000-0x0000000073255000-memory.dmp

      Filesize

      20KB

    • memory/872-78-0x0000000000400000-0x000000000042A000-memory.dmp

      Filesize

      168KB

    • memory/872-82-0x0000000000400000-0x000000000042A000-memory.dmp

      Filesize

      168KB

    • memory/1288-75-0x0000000000400000-0x000000000042A000-memory.dmp

      Filesize

      168KB

    • memory/1716-80-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB

    • memory/1716-81-0x0000000073250000-0x0000000073255000-memory.dmp

      Filesize

      20KB