Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    153s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/10/2022, 10:43

General

  • Target

    cd0156a292ab30feb1503fc1bde45dfa849d947c116ed17a1520923f7e19ed15.exe

  • Size

    255KB

  • MD5

    041517df62f8e841367468104014d91a

  • SHA1

    469d197f59194f70a58941921de4c14c86f4dceb

  • SHA256

    cd0156a292ab30feb1503fc1bde45dfa849d947c116ed17a1520923f7e19ed15

  • SHA512

    0ae84ae5977380d411ba41917c94446a98361dcff643cb952a69317e925470dcc0e18c5069b2be49e0a08e8eeb43343466815bdab5d438a0ca7d71aa0f017d66

  • SSDEEP

    3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJH:1xlZam+akqx6YQJXcNlEHUIQeE3mmBI2

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 5 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Executes dropped EXE 5 IoCs
  • UPX packed file 23 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 6 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
  • AutoIT Executable 12 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cd0156a292ab30feb1503fc1bde45dfa849d947c116ed17a1520923f7e19ed15.exe
    "C:\Users\Admin\AppData\Local\Temp\cd0156a292ab30feb1503fc1bde45dfa849d947c116ed17a1520923f7e19ed15.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4480
    • C:\Windows\SysWOW64\juglmfelim.exe
      juglmfelim.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:5108
      • C:\Windows\SysWOW64\gkwcbbsz.exe
        C:\Windows\system32\gkwcbbsz.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1372
    • C:\Windows\SysWOW64\kxqdteyvlpghacc.exe
      kxqdteyvlpghacc.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4220
    • C:\Windows\SysWOW64\gkwcbbsz.exe
      gkwcbbsz.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4684
    • C:\Windows\SysWOW64\ehxyjrcprqnch.exe
      ehxyjrcprqnch.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4444
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:1836

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe

    Filesize

    255KB

    MD5

    e32a2aa6a7d11302251825d96f6bf182

    SHA1

    229e8ff88641b1664af15f7f644197656e5e8af2

    SHA256

    3eb744878f58acafd7b4abf81b368525ac07b2f7b695401a14ae345981b49f98

    SHA512

    a5517cd83950792d206720b066ca35c83d7096c6c197181333d57594d64aa6cafcee3934c78715d72a93f94b9b1ac57072b2468773e4e56951031cb159cd3447

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe

    Filesize

    255KB

    MD5

    79e14448f95b32e39157a135f78e72d1

    SHA1

    167bb3cc269e1951b08e3f3390636a20ed1f8f09

    SHA256

    a672697cfa7821dbbb3cfdd7b90a5fcad728aafa9ff4854ff19a4f2fc41604f1

    SHA512

    1958f59a72a187215320bc019309c49b8d35276a828f99ef45353b81ebf0fd2ac71693ee7f956adc8bf10c7195809a7511d52a4c5b926d301b39e6fb4a793d2f

  • C:\Windows\SysWOW64\ehxyjrcprqnch.exe

    Filesize

    255KB

    MD5

    5018d4f14168784cf79de5246d0e4e9b

    SHA1

    5bbcd9685594c56091e8ded9461d0e12fdd73294

    SHA256

    36230fc7bc0f35310d6089a4f0708c7f6fe3c1d3354b62d52d9869e6e69c85f0

    SHA512

    282499141bada65ada1dfc5dd3bf64b64b1ee1bd8fa16ed1651e474f8e2340cd4fd11d723323ed4ffae90f4a42684b57b936d168d2c9274f9c7424d615cd2d03

  • C:\Windows\SysWOW64\ehxyjrcprqnch.exe

    Filesize

    255KB

    MD5

    5018d4f14168784cf79de5246d0e4e9b

    SHA1

    5bbcd9685594c56091e8ded9461d0e12fdd73294

    SHA256

    36230fc7bc0f35310d6089a4f0708c7f6fe3c1d3354b62d52d9869e6e69c85f0

    SHA512

    282499141bada65ada1dfc5dd3bf64b64b1ee1bd8fa16ed1651e474f8e2340cd4fd11d723323ed4ffae90f4a42684b57b936d168d2c9274f9c7424d615cd2d03

  • C:\Windows\SysWOW64\gkwcbbsz.exe

    Filesize

    255KB

    MD5

    dcd3222a49d3c1da9911ce4f6122ab77

    SHA1

    40ca2067d1efe0620611fa8688d5c92cd59bdee6

    SHA256

    5094cb2e0b21d5965cb82267ad89dc580e858ef61e0c6809ee8d09ccb1fdbf50

    SHA512

    f9783f640bdbaeca10de1fc0322e273fb70045e2fe77f89756a09ce5b3e8ab5d72799c8a9b06ed65f3975f176b2da850bb118151d0a2077e0e28827ef1778ab8

  • C:\Windows\SysWOW64\gkwcbbsz.exe

    Filesize

    255KB

    MD5

    dcd3222a49d3c1da9911ce4f6122ab77

    SHA1

    40ca2067d1efe0620611fa8688d5c92cd59bdee6

    SHA256

    5094cb2e0b21d5965cb82267ad89dc580e858ef61e0c6809ee8d09ccb1fdbf50

    SHA512

    f9783f640bdbaeca10de1fc0322e273fb70045e2fe77f89756a09ce5b3e8ab5d72799c8a9b06ed65f3975f176b2da850bb118151d0a2077e0e28827ef1778ab8

  • C:\Windows\SysWOW64\gkwcbbsz.exe

    Filesize

    255KB

    MD5

    dcd3222a49d3c1da9911ce4f6122ab77

    SHA1

    40ca2067d1efe0620611fa8688d5c92cd59bdee6

    SHA256

    5094cb2e0b21d5965cb82267ad89dc580e858ef61e0c6809ee8d09ccb1fdbf50

    SHA512

    f9783f640bdbaeca10de1fc0322e273fb70045e2fe77f89756a09ce5b3e8ab5d72799c8a9b06ed65f3975f176b2da850bb118151d0a2077e0e28827ef1778ab8

  • C:\Windows\SysWOW64\juglmfelim.exe

    Filesize

    255KB

    MD5

    44c4dc2e21f9f1e1b2e2c6fae04f11a6

    SHA1

    b360bccfa43562dbf5efabf25a8c9232176699b8

    SHA256

    81c5559006d571dc24d6cefb6d1529352bcf8e2e29c5656fe54157470cf9ef12

    SHA512

    be9a6f891d0b4317b9630d62fbcba42f7c51313df5b62f661741ea813b0a19a66c504b026c305a9644c5221370de4a6d75f27ca71db174b7752245689cc1d521

  • C:\Windows\SysWOW64\juglmfelim.exe

    Filesize

    255KB

    MD5

    44c4dc2e21f9f1e1b2e2c6fae04f11a6

    SHA1

    b360bccfa43562dbf5efabf25a8c9232176699b8

    SHA256

    81c5559006d571dc24d6cefb6d1529352bcf8e2e29c5656fe54157470cf9ef12

    SHA512

    be9a6f891d0b4317b9630d62fbcba42f7c51313df5b62f661741ea813b0a19a66c504b026c305a9644c5221370de4a6d75f27ca71db174b7752245689cc1d521

  • C:\Windows\SysWOW64\kxqdteyvlpghacc.exe

    Filesize

    255KB

    MD5

    d73015970f7f49a33ca7d9e6d5df7696

    SHA1

    f39a365c552518b869207e7538cfe7b7ff2d92bf

    SHA256

    8b602cf6aa2b22c934586008efc041af6a9920e51a0b4a3fd3225502d5524921

    SHA512

    f59215b801c9b5d1e3091f6e758028b20839aca5c7cc8600e19fa5ad2ee036747f66ef3512e750ac9b0082e25495753d5f6bb329bc50f45a1dd5897b00b4aacc

  • C:\Windows\SysWOW64\kxqdteyvlpghacc.exe

    Filesize

    255KB

    MD5

    d73015970f7f49a33ca7d9e6d5df7696

    SHA1

    f39a365c552518b869207e7538cfe7b7ff2d92bf

    SHA256

    8b602cf6aa2b22c934586008efc041af6a9920e51a0b4a3fd3225502d5524921

    SHA512

    f59215b801c9b5d1e3091f6e758028b20839aca5c7cc8600e19fa5ad2ee036747f66ef3512e750ac9b0082e25495753d5f6bb329bc50f45a1dd5897b00b4aacc

  • C:\Windows\mydoc.rtf

    Filesize

    223B

    MD5

    06604e5941c126e2e7be02c5cd9f62ec

    SHA1

    4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

    SHA256

    85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

    SHA512

    803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

  • memory/1372-153-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/1372-168-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/1836-172-0x00007FFFADAD0000-0x00007FFFADAE0000-memory.dmp

    Filesize

    64KB

  • memory/1836-154-0x00007FFFADAD0000-0x00007FFFADAE0000-memory.dmp

    Filesize

    64KB

  • memory/1836-161-0x00007FFFAB600000-0x00007FFFAB610000-memory.dmp

    Filesize

    64KB

  • memory/1836-170-0x00007FFFADAD0000-0x00007FFFADAE0000-memory.dmp

    Filesize

    64KB

  • memory/1836-171-0x00007FFFADAD0000-0x00007FFFADAE0000-memory.dmp

    Filesize

    64KB

  • memory/1836-162-0x00007FFFAB600000-0x00007FFFAB610000-memory.dmp

    Filesize

    64KB

  • memory/1836-173-0x00007FFFADAD0000-0x00007FFFADAE0000-memory.dmp

    Filesize

    64KB

  • memory/1836-155-0x00007FFFADAD0000-0x00007FFFADAE0000-memory.dmp

    Filesize

    64KB

  • memory/1836-156-0x00007FFFADAD0000-0x00007FFFADAE0000-memory.dmp

    Filesize

    64KB

  • memory/1836-157-0x00007FFFADAD0000-0x00007FFFADAE0000-memory.dmp

    Filesize

    64KB

  • memory/1836-158-0x00007FFFADAD0000-0x00007FFFADAE0000-memory.dmp

    Filesize

    64KB

  • memory/4220-165-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/4220-146-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/4444-148-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/4444-167-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/4480-152-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/4480-132-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/4684-166-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/4684-147-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/5108-164-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/5108-145-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB