Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    152s
  • max time network
    48s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    03/10/2022, 16:56

General

  • Target

    ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe

  • Size

    255KB

  • MD5

    626509ddae151d48789e02639aac4d60

  • SHA1

    af14c973814bd987d8f2c8d62c39308c68dc2878

  • SHA256

    ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5

  • SHA512

    9f54a6e2ff181c0c093204d6183b23cd4919d91e10cc0d786cd214e0cf9f698043b64b1ee73870dedd8788ecbb2fb792fce257a5a50bffe28b580e1dba5e5d25

  • SSDEEP

    3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJN:1xlZam+akqx6YQJXcNlEHUIQeE3mmBI4

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 5 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Executes dropped EXE 6 IoCs
  • UPX packed file 35 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 6 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
  • AutoIT Executable 17 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 21 IoCs
  • Suspicious use of SendNotifyMessage 21 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe
    "C:\Users\Admin\AppData\Local\Temp\ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1672
    • C:\Windows\SysWOW64\pjbseccxqo.exe
      pjbseccxqo.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1540
      • C:\Windows\SysWOW64\eclgnelm.exe
        C:\Windows\system32\eclgnelm.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1636
    • C:\Windows\SysWOW64\nnjlxnauwnqitnl.exe
      nnjlxnauwnqitnl.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1028
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c tjvoigoixjtsi.exe
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:856
        • C:\Windows\SysWOW64\tjvoigoixjtsi.exe
          tjvoigoixjtsi.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:824
    • C:\Windows\SysWOW64\eclgnelm.exe
      eclgnelm.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:584
    • C:\Windows\SysWOW64\tjvoigoixjtsi.exe
      tjvoigoixjtsi.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:516
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1964
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:1696

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe

      Filesize

      256KB

      MD5

      81c876c317f8b2da6d461b47bbb22e49

      SHA1

      92c943ad9f427cdf08b648baf698dcaee3b6bc49

      SHA256

      f58d99ca76a224b810d20b35cf909f6a89152b404f55559e99436587f7c1b7c7

      SHA512

      b90af41526d6c38c9fcee5c1e5a2bba996acc82853e1f03df01f500376599e6e8401cd56488eba0ebbe6111a27ec74e1a625f6fb2995f31ef8cc6db860a51d03

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe

      Filesize

      256KB

      MD5

      75d3a4e2f7c32aa7b70f842101bbccf0

      SHA1

      ccd544097b62278b8968312ad0349dda38d9eb65

      SHA256

      0dc0b656e5529bde74a03d3b533cdffbb315e61d07091c3d2c731a60af824ae2

      SHA512

      a7613ce87aaaab6227e795f4e792cf4702efcaae09c09c32ddf697fe5893dfa451e535670ca2ad79ca62ac4ff18c365ae8edfc53de32c7c4e50a8e96b72985ad

    • C:\Users\Admin\Music\PublishWatch.doc.exe

      Filesize

      256KB

      MD5

      02ead720413f475af3103c06d42e70aa

      SHA1

      a812e6a4c6bff94970b195d1ebc890b3b0306276

      SHA256

      a6e8c1bc259d9dab73baa6b4bbd0cb2131927b98d1593ff78fc4bddca97e3133

      SHA512

      e17b010f7c5fb944212885f6cab8b87be5203124a33abec925b0e0c294d2f9cf761be847b5fa04d3763b25fff0bc5863f5361aa39210262992900fede49302f6

    • C:\Windows\SysWOW64\eclgnelm.exe

      Filesize

      255KB

      MD5

      dd5045eef78d00648ddcf9f4e72e9325

      SHA1

      e6de4bd4b8947d2ef16c7c108e7dda41cb58be2a

      SHA256

      8e222d8e9055bf95f069dcaec08f0b28a1e465f1123a81cd24131afc4992da02

      SHA512

      e930e3308f22c59d0c667e6b915eab96179239dabec0166e735ed0ecf82d65aa19bae02d894ad37d820f6a4b4659fa6254b65f4ae724a76f0d1b3aa7b036245b

    • C:\Windows\SysWOW64\eclgnelm.exe

      Filesize

      255KB

      MD5

      dd5045eef78d00648ddcf9f4e72e9325

      SHA1

      e6de4bd4b8947d2ef16c7c108e7dda41cb58be2a

      SHA256

      8e222d8e9055bf95f069dcaec08f0b28a1e465f1123a81cd24131afc4992da02

      SHA512

      e930e3308f22c59d0c667e6b915eab96179239dabec0166e735ed0ecf82d65aa19bae02d894ad37d820f6a4b4659fa6254b65f4ae724a76f0d1b3aa7b036245b

    • C:\Windows\SysWOW64\eclgnelm.exe

      Filesize

      255KB

      MD5

      dd5045eef78d00648ddcf9f4e72e9325

      SHA1

      e6de4bd4b8947d2ef16c7c108e7dda41cb58be2a

      SHA256

      8e222d8e9055bf95f069dcaec08f0b28a1e465f1123a81cd24131afc4992da02

      SHA512

      e930e3308f22c59d0c667e6b915eab96179239dabec0166e735ed0ecf82d65aa19bae02d894ad37d820f6a4b4659fa6254b65f4ae724a76f0d1b3aa7b036245b

    • C:\Windows\SysWOW64\nnjlxnauwnqitnl.exe

      Filesize

      255KB

      MD5

      41aa06bb457b1221c88d42467916aee6

      SHA1

      eae4771749505dfa127b562160a0a33c03d78823

      SHA256

      e96a756a2d504b5032d2b8a625ee448bb982f0fe8ac887d37a90c1a2116e949d

      SHA512

      d61b8df3cf1ccf15ca57b226c1a474342dfbd43b159a10fcac6905fceafad8ac6824178f9f6b0b145c1aa22726b04dcfe96df8f91e3c26435f9ed70c2bd561e1

    • C:\Windows\SysWOW64\nnjlxnauwnqitnl.exe

      Filesize

      255KB

      MD5

      41aa06bb457b1221c88d42467916aee6

      SHA1

      eae4771749505dfa127b562160a0a33c03d78823

      SHA256

      e96a756a2d504b5032d2b8a625ee448bb982f0fe8ac887d37a90c1a2116e949d

      SHA512

      d61b8df3cf1ccf15ca57b226c1a474342dfbd43b159a10fcac6905fceafad8ac6824178f9f6b0b145c1aa22726b04dcfe96df8f91e3c26435f9ed70c2bd561e1

    • C:\Windows\SysWOW64\pjbseccxqo.exe

      Filesize

      255KB

      MD5

      2f17221bf5cd7aeefb796fe4f297612c

      SHA1

      c52256ca97ebf96c2df976b72073a18c0392b468

      SHA256

      1313a8910bf9a96d156d736f7402b3b2e13ec10133a58c116e680630af15932b

      SHA512

      ea2f975d9f11dbdff6597516d2edb1bdff71892e13dd5fe8867b2e08297c5ee0ecf3ffa818775b2587759fd1cc9de24ab44deef631547cc54fd5aa68e479a5db

    • C:\Windows\SysWOW64\pjbseccxqo.exe

      Filesize

      255KB

      MD5

      2f17221bf5cd7aeefb796fe4f297612c

      SHA1

      c52256ca97ebf96c2df976b72073a18c0392b468

      SHA256

      1313a8910bf9a96d156d736f7402b3b2e13ec10133a58c116e680630af15932b

      SHA512

      ea2f975d9f11dbdff6597516d2edb1bdff71892e13dd5fe8867b2e08297c5ee0ecf3ffa818775b2587759fd1cc9de24ab44deef631547cc54fd5aa68e479a5db

    • C:\Windows\SysWOW64\tjvoigoixjtsi.exe

      Filesize

      255KB

      MD5

      1c30632be1902da43e5518436e219ff9

      SHA1

      bdda0c10ae20d61282390570ee4e7aab98214ae2

      SHA256

      8ca094c4c490cced1d820c963c8ef92e26d404f4ac788eaf917d06dcee8b41d3

      SHA512

      77802da9dfc5b7818f5fb65d61b2468e542df207a0a5137acd60d7991c8cbdc34a0802c6cd71b75c88e91b193a910fd812e0d77e9893295e4a9d71e812b33244

    • C:\Windows\SysWOW64\tjvoigoixjtsi.exe

      Filesize

      255KB

      MD5

      1c30632be1902da43e5518436e219ff9

      SHA1

      bdda0c10ae20d61282390570ee4e7aab98214ae2

      SHA256

      8ca094c4c490cced1d820c963c8ef92e26d404f4ac788eaf917d06dcee8b41d3

      SHA512

      77802da9dfc5b7818f5fb65d61b2468e542df207a0a5137acd60d7991c8cbdc34a0802c6cd71b75c88e91b193a910fd812e0d77e9893295e4a9d71e812b33244

    • C:\Windows\SysWOW64\tjvoigoixjtsi.exe

      Filesize

      255KB

      MD5

      1c30632be1902da43e5518436e219ff9

      SHA1

      bdda0c10ae20d61282390570ee4e7aab98214ae2

      SHA256

      8ca094c4c490cced1d820c963c8ef92e26d404f4ac788eaf917d06dcee8b41d3

      SHA512

      77802da9dfc5b7818f5fb65d61b2468e542df207a0a5137acd60d7991c8cbdc34a0802c6cd71b75c88e91b193a910fd812e0d77e9893295e4a9d71e812b33244

    • C:\Windows\mydoc.rtf

      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

    • \Windows\SysWOW64\eclgnelm.exe

      Filesize

      255KB

      MD5

      dd5045eef78d00648ddcf9f4e72e9325

      SHA1

      e6de4bd4b8947d2ef16c7c108e7dda41cb58be2a

      SHA256

      8e222d8e9055bf95f069dcaec08f0b28a1e465f1123a81cd24131afc4992da02

      SHA512

      e930e3308f22c59d0c667e6b915eab96179239dabec0166e735ed0ecf82d65aa19bae02d894ad37d820f6a4b4659fa6254b65f4ae724a76f0d1b3aa7b036245b

    • \Windows\SysWOW64\eclgnelm.exe

      Filesize

      255KB

      MD5

      dd5045eef78d00648ddcf9f4e72e9325

      SHA1

      e6de4bd4b8947d2ef16c7c108e7dda41cb58be2a

      SHA256

      8e222d8e9055bf95f069dcaec08f0b28a1e465f1123a81cd24131afc4992da02

      SHA512

      e930e3308f22c59d0c667e6b915eab96179239dabec0166e735ed0ecf82d65aa19bae02d894ad37d820f6a4b4659fa6254b65f4ae724a76f0d1b3aa7b036245b

    • \Windows\SysWOW64\nnjlxnauwnqitnl.exe

      Filesize

      255KB

      MD5

      41aa06bb457b1221c88d42467916aee6

      SHA1

      eae4771749505dfa127b562160a0a33c03d78823

      SHA256

      e96a756a2d504b5032d2b8a625ee448bb982f0fe8ac887d37a90c1a2116e949d

      SHA512

      d61b8df3cf1ccf15ca57b226c1a474342dfbd43b159a10fcac6905fceafad8ac6824178f9f6b0b145c1aa22726b04dcfe96df8f91e3c26435f9ed70c2bd561e1

    • \Windows\SysWOW64\pjbseccxqo.exe

      Filesize

      255KB

      MD5

      2f17221bf5cd7aeefb796fe4f297612c

      SHA1

      c52256ca97ebf96c2df976b72073a18c0392b468

      SHA256

      1313a8910bf9a96d156d736f7402b3b2e13ec10133a58c116e680630af15932b

      SHA512

      ea2f975d9f11dbdff6597516d2edb1bdff71892e13dd5fe8867b2e08297c5ee0ecf3ffa818775b2587759fd1cc9de24ab44deef631547cc54fd5aa68e479a5db

    • \Windows\SysWOW64\tjvoigoixjtsi.exe

      Filesize

      255KB

      MD5

      1c30632be1902da43e5518436e219ff9

      SHA1

      bdda0c10ae20d61282390570ee4e7aab98214ae2

      SHA256

      8ca094c4c490cced1d820c963c8ef92e26d404f4ac788eaf917d06dcee8b41d3

      SHA512

      77802da9dfc5b7818f5fb65d61b2468e542df207a0a5137acd60d7991c8cbdc34a0802c6cd71b75c88e91b193a910fd812e0d77e9893295e4a9d71e812b33244

    • \Windows\SysWOW64\tjvoigoixjtsi.exe

      Filesize

      255KB

      MD5

      1c30632be1902da43e5518436e219ff9

      SHA1

      bdda0c10ae20d61282390570ee4e7aab98214ae2

      SHA256

      8ca094c4c490cced1d820c963c8ef92e26d404f4ac788eaf917d06dcee8b41d3

      SHA512

      77802da9dfc5b7818f5fb65d61b2468e542df207a0a5137acd60d7991c8cbdc34a0802c6cd71b75c88e91b193a910fd812e0d77e9893295e4a9d71e812b33244

    • memory/516-107-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/516-84-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/584-114-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/584-104-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/584-80-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/824-95-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/824-108-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1028-106-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1028-79-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1540-78-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1540-105-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1636-96-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1636-109-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1636-113-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1672-54-0x0000000075111000-0x0000000075113000-memory.dmp

      Filesize

      8KB

    • memory/1672-77-0x0000000002EE0000-0x0000000002F80000-memory.dmp

      Filesize

      640KB

    • memory/1672-82-0x0000000002EE0000-0x0000000002F80000-memory.dmp

      Filesize

      640KB

    • memory/1672-92-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1672-76-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1696-112-0x000007FEFB7F1000-0x000007FEFB7F3000-memory.dmp

      Filesize

      8KB

    • memory/1964-97-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1964-110-0x0000000070BAD000-0x0000000070BB8000-memory.dmp

      Filesize

      44KB

    • memory/1964-100-0x0000000070BAD000-0x0000000070BB8000-memory.dmp

      Filesize

      44KB

    • memory/1964-94-0x000000006FBC1000-0x000000006FBC3000-memory.dmp

      Filesize

      8KB

    • memory/1964-93-0x0000000072141000-0x0000000072144000-memory.dmp

      Filesize

      12KB

    • memory/1964-115-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1964-116-0x0000000070BAD000-0x0000000070BB8000-memory.dmp

      Filesize

      44KB