Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    162s
  • max time network
    165s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/10/2022, 16:58

General

  • Target

    b064c1a44605cc6f6b006e60d4a2cca30751692858283c10aa2c13a8192fcb31.exe

  • Size

    255KB

  • MD5

    18da44bdf8cb5baa2357058f4aa12eb1

  • SHA1

    44b6e901b7c44991dc6d42a9166d699e1a8f6946

  • SHA256

    b064c1a44605cc6f6b006e60d4a2cca30751692858283c10aa2c13a8192fcb31

  • SHA512

    f64dc0f618d71b80b2298f880f0b40fa95bd691b3de29ef933d1262d3dbcfbae629a20ee2a77a999709d46417bcd800f66477086bf49bd7429d8e91ca028467c

  • SSDEEP

    6144:1xlZam+akqx6YQJXcNlEHUIQeE3mmBI6Z:Plf5j6zCNa0xeE3mg

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 5 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Executes dropped EXE 5 IoCs
  • UPX packed file 25 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 6 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
  • AutoIT Executable 11 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 19 IoCs
  • Suspicious use of SendNotifyMessage 19 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b064c1a44605cc6f6b006e60d4a2cca30751692858283c10aa2c13a8192fcb31.exe
    "C:\Users\Admin\AppData\Local\Temp\b064c1a44605cc6f6b006e60d4a2cca30751692858283c10aa2c13a8192fcb31.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3936
    • C:\Windows\SysWOW64\atgdcffrpr.exe
      atgdcffrpr.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2212
      • C:\Windows\SysWOW64\hslpouqh.exe
        C:\Windows\system32\hslpouqh.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4648
    • C:\Windows\SysWOW64\zpkoeuozwlvjvxs.exe
      zpkoeuozwlvjvxs.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3972
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c fznonocqtaxdq.exe
        3⤵
          PID:3688
      • C:\Windows\SysWOW64\hslpouqh.exe
        hslpouqh.exe
        2⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4432
      • C:\Windows\SysWOW64\fznonocqtaxdq.exe
        fznonocqtaxdq.exe
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:3540
      • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
        "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
        2⤵
        • Drops file in Windows directory
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        PID:324

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe

      Filesize

      255KB

      MD5

      04e8baba26610f4334056f8d4d4a567c

      SHA1

      ac42d68456dede1cfca636a68c8a569f86503e3f

      SHA256

      ac2b80d103e2cf54c105d052e1325a33eea76d0bbd93e5c393d30076c9f9f91b

      SHA512

      24c14fc46f09ef8a39a04a0806fc0a185f2eecb856a7e79f0038f4dc207022204986a31e24b5679dbe9dd10c53cd2f5f0a2a9ab49b9b4c9c8dd346d448575ff5

    • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe

      Filesize

      255KB

      MD5

      0849d0b48462f3c5f15e59f0506d87d5

      SHA1

      c0ca565ab39342cb38fe44c331805e9ad7cb0f05

      SHA256

      38f6f97a9169962e8debe38441c1460b23bfef7a5b75dd1fbece75c0760747fd

      SHA512

      8c81fbe5219d34bf67594ac4cf435f85b3ba0de54926aa84fd31cf510a3e82f790d507cd523fd91d90b8d4e9c891b23a59ef53e13d2f0d63dc94cc58bae66193

    • C:\Windows\SysWOW64\atgdcffrpr.exe

      Filesize

      255KB

      MD5

      618d236da3a42e233e4981550e50d28d

      SHA1

      a39dac0f6da7d07b9648d19d318b4a418d961f98

      SHA256

      11975049f504b65a3eb06a91d20853e1a1628fdc87c0e1af8cfa0023fad49971

      SHA512

      41139074bad7a056314b76c60a0325f63d1b3c59333d24780040286b04e7af22652370c39b68287a8b0e62603767ae3c32212f5397cb7c2a5f70b05bb1a6e0f7

    • C:\Windows\SysWOW64\atgdcffrpr.exe

      Filesize

      255KB

      MD5

      618d236da3a42e233e4981550e50d28d

      SHA1

      a39dac0f6da7d07b9648d19d318b4a418d961f98

      SHA256

      11975049f504b65a3eb06a91d20853e1a1628fdc87c0e1af8cfa0023fad49971

      SHA512

      41139074bad7a056314b76c60a0325f63d1b3c59333d24780040286b04e7af22652370c39b68287a8b0e62603767ae3c32212f5397cb7c2a5f70b05bb1a6e0f7

    • C:\Windows\SysWOW64\fznonocqtaxdq.exe

      Filesize

      255KB

      MD5

      47600466ea8e8eb864ac7ef4d439d969

      SHA1

      d279657091964233ddbcd150721b09e17c5091f5

      SHA256

      c00388507c56a9df17e20b7ba50aee38a98a1d0d078b71240f727447c81be1b9

      SHA512

      e97de8c75df9aa68eeabdc6763a46b551c2b87031756befdb93785c2e254b3abd72e809c92103ca4a3da2fc10536622797bb34b8a74596864a0994a9b9108c40

    • C:\Windows\SysWOW64\fznonocqtaxdq.exe

      Filesize

      255KB

      MD5

      47600466ea8e8eb864ac7ef4d439d969

      SHA1

      d279657091964233ddbcd150721b09e17c5091f5

      SHA256

      c00388507c56a9df17e20b7ba50aee38a98a1d0d078b71240f727447c81be1b9

      SHA512

      e97de8c75df9aa68eeabdc6763a46b551c2b87031756befdb93785c2e254b3abd72e809c92103ca4a3da2fc10536622797bb34b8a74596864a0994a9b9108c40

    • C:\Windows\SysWOW64\hslpouqh.exe

      Filesize

      255KB

      MD5

      4d48207459775e54985dc796a6d5e385

      SHA1

      9eadb580cd521426b56198fd90e1c036a28c5ab3

      SHA256

      1f3fd05970b1269dfdb920b1c3d72d39e5ee880955af29e19edad6dea59870f7

      SHA512

      7b2674b5b2099a2a004f075974f6646a7722a13e4a07b95e6374588c5c963ac538ecb2401e8fdc16a205b5db8d1f9984b8889dff9bc8f4b7889edeb1ab62e14d

    • C:\Windows\SysWOW64\hslpouqh.exe

      Filesize

      255KB

      MD5

      4d48207459775e54985dc796a6d5e385

      SHA1

      9eadb580cd521426b56198fd90e1c036a28c5ab3

      SHA256

      1f3fd05970b1269dfdb920b1c3d72d39e5ee880955af29e19edad6dea59870f7

      SHA512

      7b2674b5b2099a2a004f075974f6646a7722a13e4a07b95e6374588c5c963ac538ecb2401e8fdc16a205b5db8d1f9984b8889dff9bc8f4b7889edeb1ab62e14d

    • C:\Windows\SysWOW64\hslpouqh.exe

      Filesize

      255KB

      MD5

      4d48207459775e54985dc796a6d5e385

      SHA1

      9eadb580cd521426b56198fd90e1c036a28c5ab3

      SHA256

      1f3fd05970b1269dfdb920b1c3d72d39e5ee880955af29e19edad6dea59870f7

      SHA512

      7b2674b5b2099a2a004f075974f6646a7722a13e4a07b95e6374588c5c963ac538ecb2401e8fdc16a205b5db8d1f9984b8889dff9bc8f4b7889edeb1ab62e14d

    • C:\Windows\SysWOW64\zpkoeuozwlvjvxs.exe

      Filesize

      255KB

      MD5

      b8ef7d76e27e45e6654f4cba55a90dce

      SHA1

      8db546adc08042b1a9c6f69e6b29da4445bd32e2

      SHA256

      1000c5c6f9aab29307a21f2600b0bf74c771fff91166702fb000ce14d7afb8b5

      SHA512

      39a73a2df088a177e1ddf007228ba3485cf6cf881a37e960ff7f420bdf80b4e9e42a2581a910461baf01ac0eef9ee0683c8801fa34a89d1f6749e8856c80faf0

    • C:\Windows\SysWOW64\zpkoeuozwlvjvxs.exe

      Filesize

      255KB

      MD5

      b8ef7d76e27e45e6654f4cba55a90dce

      SHA1

      8db546adc08042b1a9c6f69e6b29da4445bd32e2

      SHA256

      1000c5c6f9aab29307a21f2600b0bf74c771fff91166702fb000ce14d7afb8b5

      SHA512

      39a73a2df088a177e1ddf007228ba3485cf6cf881a37e960ff7f420bdf80b4e9e42a2581a910461baf01ac0eef9ee0683c8801fa34a89d1f6749e8856c80faf0

    • C:\Windows\mydoc.rtf

      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

    • \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe

      Filesize

      255KB

      MD5

      0849d0b48462f3c5f15e59f0506d87d5

      SHA1

      c0ca565ab39342cb38fe44c331805e9ad7cb0f05

      SHA256

      38f6f97a9169962e8debe38441c1460b23bfef7a5b75dd1fbece75c0760747fd

      SHA512

      8c81fbe5219d34bf67594ac4cf435f85b3ba0de54926aa84fd31cf510a3e82f790d507cd523fd91d90b8d4e9c891b23a59ef53e13d2f0d63dc94cc58bae66193

    • memory/324-168-0x00007FFA72110000-0x00007FFA72120000-memory.dmp

      Filesize

      64KB

    • memory/324-167-0x00007FFA72110000-0x00007FFA72120000-memory.dmp

      Filesize

      64KB

    • memory/324-166-0x00007FFA72110000-0x00007FFA72120000-memory.dmp

      Filesize

      64KB

    • memory/324-165-0x00007FFA72110000-0x00007FFA72120000-memory.dmp

      Filesize

      64KB

    • memory/324-164-0x00007FFA72110000-0x00007FFA72120000-memory.dmp

      Filesize

      64KB

    • memory/324-169-0x00007FFA6FA80000-0x00007FFA6FA90000-memory.dmp

      Filesize

      64KB

    • memory/324-170-0x00007FFA6FA80000-0x00007FFA6FA90000-memory.dmp

      Filesize

      64KB

    • memory/2212-156-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2212-140-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/3540-159-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/3540-150-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/3936-155-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/3936-132-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/3936-133-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/3972-157-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/3972-141-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/4432-158-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/4432-149-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/4648-163-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/4648-153-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB