Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    50s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    29/10/2022, 16:42

General

  • Target

    c4c4bdf560a1675c1885f97c38d2e45497992fd20f6f38425514998f26f15fa4.exe

  • Size

    256KB

  • MD5

    a38ae7b8057be4f40b876cc1a3a4abe0

  • SHA1

    fb10c7ec9370cc72111560ee8abbe7db3f8202a6

  • SHA256

    c4c4bdf560a1675c1885f97c38d2e45497992fd20f6f38425514998f26f15fa4

  • SHA512

    7b142c6d848e9de74f32be7e6528de3d8f542ea7cef3a243ea1454360401789029f9f296608df71b3b33f07e5e81cc95d09607a52fd8a43f06d7659fabdc7f65

  • SSDEEP

    6144:1xlZam+akqx6YQJXcNlEHUIQeE3mmBWFv6X:Plf5j6zCNa0xeE3mC

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 5 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Executes dropped EXE 5 IoCs
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
  • UPX packed file 26 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 6 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
  • AutoIT Executable 13 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 12 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Suspicious use of FindShellTrayWindow 40 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c4c4bdf560a1675c1885f97c38d2e45497992fd20f6f38425514998f26f15fa4.exe
    "C:\Users\Admin\AppData\Local\Temp\c4c4bdf560a1675c1885f97c38d2e45497992fd20f6f38425514998f26f15fa4.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1352
    • C:\Windows\SysWOW64\criafkhhzv.exe
      criafkhhzv.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1472
      • C:\Windows\SysWOW64\yxrueqkr.exe
        C:\Windows\system32\yxrueqkr.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1216
    • C:\Windows\SysWOW64\srahdmmhrtgijfk.exe
      srahdmmhrtgijfk.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:952
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c cazzaymplllpu.exe
        3⤵
          PID:1624
      • C:\Windows\SysWOW64\yxrueqkr.exe
        yxrueqkr.exe
        2⤵
        • Executes dropped EXE
        PID:1380
      • C:\Windows\SysWOW64\cazzaymplllpu.exe
        cazzaymplllpu.exe
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:844
      • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
        "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
        2⤵
        • Drops file in Windows directory
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1332
        • C:\Windows\splwow64.exe
          C:\Windows\splwow64.exe 12288
          3⤵
            PID:560
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1660
      • C:\Windows\system32\AUDIODG.EXE
        C:\Windows\system32\AUDIODG.EXE 0x1ac
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1112

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Windows\SysWOW64\cazzaymplllpu.exe

        Filesize

        256KB

        MD5

        268d818157c91cb801252bd0bb95e1f4

        SHA1

        656a8ed4124d02adad673703b23c40d9c3bfacd0

        SHA256

        64cc571c497e63321362e4982d607ee92cc6a16d6a9aeb0927a0465efb40d8b7

        SHA512

        e8601b166e1596709d344c59e3b666a11e989c44313e5be7bbf2ff9240f27c8bc821aac8eb64aec40f83b2679d88805b90067a8204f5d67763d02578c6b8ecdc

      • C:\Windows\SysWOW64\cazzaymplllpu.exe

        Filesize

        256KB

        MD5

        268d818157c91cb801252bd0bb95e1f4

        SHA1

        656a8ed4124d02adad673703b23c40d9c3bfacd0

        SHA256

        64cc571c497e63321362e4982d607ee92cc6a16d6a9aeb0927a0465efb40d8b7

        SHA512

        e8601b166e1596709d344c59e3b666a11e989c44313e5be7bbf2ff9240f27c8bc821aac8eb64aec40f83b2679d88805b90067a8204f5d67763d02578c6b8ecdc

      • C:\Windows\SysWOW64\criafkhhzv.exe

        Filesize

        256KB

        MD5

        1b74ec61842c962bff51ebd48c28d753

        SHA1

        e74e0806c215d8d83da055bbbf245b09f87e78d6

        SHA256

        2360ab838227708fdd685f3a472e3dd91e80c4ff3f5a0967b8e546b597d7c130

        SHA512

        f5af7596ee5c7db2a65136e3cbb3f9cc90b2e3733fb90fe2c758aefb0044d7d56e095c4638f9cb0ffb44a19a51ba762eef6a4aba6e7e4083a322fd5f376cf9e3

      • C:\Windows\SysWOW64\criafkhhzv.exe

        Filesize

        256KB

        MD5

        1b74ec61842c962bff51ebd48c28d753

        SHA1

        e74e0806c215d8d83da055bbbf245b09f87e78d6

        SHA256

        2360ab838227708fdd685f3a472e3dd91e80c4ff3f5a0967b8e546b597d7c130

        SHA512

        f5af7596ee5c7db2a65136e3cbb3f9cc90b2e3733fb90fe2c758aefb0044d7d56e095c4638f9cb0ffb44a19a51ba762eef6a4aba6e7e4083a322fd5f376cf9e3

      • C:\Windows\SysWOW64\srahdmmhrtgijfk.exe

        Filesize

        256KB

        MD5

        a57d580d63b265992e3d8e01416fa0f7

        SHA1

        4555a4b06efd9083e5776a96d4eb38bfb8fa5368

        SHA256

        8ecafafb70b41af3264ded9c87a2c1d0bb396ba861f431ae6e4f365963571635

        SHA512

        e8521f5cb0434681ca45259e412ea9ddbf0693664b224ad49982a366f8a7dc4e1c0d82b84bc9e327055ecbdd5c37ba4602925b378625404d292cfa9bcdbb58c5

      • C:\Windows\SysWOW64\srahdmmhrtgijfk.exe

        Filesize

        256KB

        MD5

        a57d580d63b265992e3d8e01416fa0f7

        SHA1

        4555a4b06efd9083e5776a96d4eb38bfb8fa5368

        SHA256

        8ecafafb70b41af3264ded9c87a2c1d0bb396ba861f431ae6e4f365963571635

        SHA512

        e8521f5cb0434681ca45259e412ea9ddbf0693664b224ad49982a366f8a7dc4e1c0d82b84bc9e327055ecbdd5c37ba4602925b378625404d292cfa9bcdbb58c5

      • C:\Windows\SysWOW64\yxrueqkr.exe

        Filesize

        256KB

        MD5

        3ead8eacf9b44403b0ffac64915f14c1

        SHA1

        d8353a52df3497fc0756c6c1378eb569c9a9edaf

        SHA256

        9dee841b91b0e32df516ffbec56ae87fd55d1334e3e3fa34a576f53898e3e151

        SHA512

        cba9b35ad781e13b4d9b0574ba90c08a2ce834c210de94b628ee10038c39028ca485d7e496e4a38fa8a92e7087cfcdfca6a25d3038239dda757d7c29f3d818bd

      • C:\Windows\SysWOW64\yxrueqkr.exe

        Filesize

        256KB

        MD5

        3ead8eacf9b44403b0ffac64915f14c1

        SHA1

        d8353a52df3497fc0756c6c1378eb569c9a9edaf

        SHA256

        9dee841b91b0e32df516ffbec56ae87fd55d1334e3e3fa34a576f53898e3e151

        SHA512

        cba9b35ad781e13b4d9b0574ba90c08a2ce834c210de94b628ee10038c39028ca485d7e496e4a38fa8a92e7087cfcdfca6a25d3038239dda757d7c29f3d818bd

      • C:\Windows\SysWOW64\yxrueqkr.exe

        Filesize

        256KB

        MD5

        3ead8eacf9b44403b0ffac64915f14c1

        SHA1

        d8353a52df3497fc0756c6c1378eb569c9a9edaf

        SHA256

        9dee841b91b0e32df516ffbec56ae87fd55d1334e3e3fa34a576f53898e3e151

        SHA512

        cba9b35ad781e13b4d9b0574ba90c08a2ce834c210de94b628ee10038c39028ca485d7e496e4a38fa8a92e7087cfcdfca6a25d3038239dda757d7c29f3d818bd

      • C:\Windows\mydoc.rtf

        Filesize

        223B

        MD5

        06604e5941c126e2e7be02c5cd9f62ec

        SHA1

        4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

        SHA256

        85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

        SHA512

        803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

      • \Windows\SysWOW64\cazzaymplllpu.exe

        Filesize

        256KB

        MD5

        268d818157c91cb801252bd0bb95e1f4

        SHA1

        656a8ed4124d02adad673703b23c40d9c3bfacd0

        SHA256

        64cc571c497e63321362e4982d607ee92cc6a16d6a9aeb0927a0465efb40d8b7

        SHA512

        e8601b166e1596709d344c59e3b666a11e989c44313e5be7bbf2ff9240f27c8bc821aac8eb64aec40f83b2679d88805b90067a8204f5d67763d02578c6b8ecdc

      • \Windows\SysWOW64\criafkhhzv.exe

        Filesize

        256KB

        MD5

        1b74ec61842c962bff51ebd48c28d753

        SHA1

        e74e0806c215d8d83da055bbbf245b09f87e78d6

        SHA256

        2360ab838227708fdd685f3a472e3dd91e80c4ff3f5a0967b8e546b597d7c130

        SHA512

        f5af7596ee5c7db2a65136e3cbb3f9cc90b2e3733fb90fe2c758aefb0044d7d56e095c4638f9cb0ffb44a19a51ba762eef6a4aba6e7e4083a322fd5f376cf9e3

      • \Windows\SysWOW64\srahdmmhrtgijfk.exe

        Filesize

        256KB

        MD5

        a57d580d63b265992e3d8e01416fa0f7

        SHA1

        4555a4b06efd9083e5776a96d4eb38bfb8fa5368

        SHA256

        8ecafafb70b41af3264ded9c87a2c1d0bb396ba861f431ae6e4f365963571635

        SHA512

        e8521f5cb0434681ca45259e412ea9ddbf0693664b224ad49982a366f8a7dc4e1c0d82b84bc9e327055ecbdd5c37ba4602925b378625404d292cfa9bcdbb58c5

      • \Windows\SysWOW64\yxrueqkr.exe

        Filesize

        256KB

        MD5

        3ead8eacf9b44403b0ffac64915f14c1

        SHA1

        d8353a52df3497fc0756c6c1378eb569c9a9edaf

        SHA256

        9dee841b91b0e32df516ffbec56ae87fd55d1334e3e3fa34a576f53898e3e151

        SHA512

        cba9b35ad781e13b4d9b0574ba90c08a2ce834c210de94b628ee10038c39028ca485d7e496e4a38fa8a92e7087cfcdfca6a25d3038239dda757d7c29f3d818bd

      • \Windows\SysWOW64\yxrueqkr.exe

        Filesize

        256KB

        MD5

        3ead8eacf9b44403b0ffac64915f14c1

        SHA1

        d8353a52df3497fc0756c6c1378eb569c9a9edaf

        SHA256

        9dee841b91b0e32df516ffbec56ae87fd55d1334e3e3fa34a576f53898e3e151

        SHA512

        cba9b35ad781e13b4d9b0574ba90c08a2ce834c210de94b628ee10038c39028ca485d7e496e4a38fa8a92e7087cfcdfca6a25d3038239dda757d7c29f3d818bd

      • memory/844-80-0x0000000000400000-0x00000000004A0000-memory.dmp

        Filesize

        640KB

      • memory/844-101-0x0000000000400000-0x00000000004A0000-memory.dmp

        Filesize

        640KB

      • memory/952-100-0x0000000000400000-0x00000000004A0000-memory.dmp

        Filesize

        640KB

      • memory/952-78-0x0000000000400000-0x00000000004A0000-memory.dmp

        Filesize

        640KB

      • memory/1216-105-0x0000000000400000-0x00000000004A0000-memory.dmp

        Filesize

        640KB

      • memory/1216-103-0x0000000000400000-0x00000000004A0000-memory.dmp

        Filesize

        640KB

      • memory/1216-91-0x0000000000400000-0x00000000004A0000-memory.dmp

        Filesize

        640KB

      • memory/1332-88-0x0000000072101000-0x0000000072104000-memory.dmp

        Filesize

        12KB

      • memory/1332-89-0x000000006FB81000-0x000000006FB83000-memory.dmp

        Filesize

        8KB

      • memory/1332-104-0x0000000070B6D000-0x0000000070B78000-memory.dmp

        Filesize

        44KB

      • memory/1332-92-0x000000005FFF0000-0x0000000060000000-memory.dmp

        Filesize

        64KB

      • memory/1332-95-0x0000000070B6D000-0x0000000070B78000-memory.dmp

        Filesize

        44KB

      • memory/1352-87-0x0000000000400000-0x00000000004A0000-memory.dmp

        Filesize

        640KB

      • memory/1352-75-0x0000000000400000-0x00000000004A0000-memory.dmp

        Filesize

        640KB

      • memory/1352-54-0x0000000075B51000-0x0000000075B53000-memory.dmp

        Filesize

        8KB

      • memory/1352-76-0x0000000002EF0000-0x0000000002F90000-memory.dmp

        Filesize

        640KB

      • memory/1380-79-0x0000000000400000-0x00000000004A0000-memory.dmp

        Filesize

        640KB

      • memory/1472-90-0x0000000003CA0000-0x0000000003D40000-memory.dmp

        Filesize

        640KB

      • memory/1472-99-0x0000000000400000-0x00000000004A0000-memory.dmp

        Filesize

        640KB

      • memory/1472-102-0x0000000003CA0000-0x0000000003D40000-memory.dmp

        Filesize

        640KB

      • memory/1472-77-0x0000000000400000-0x00000000004A0000-memory.dmp

        Filesize

        640KB

      • memory/1660-96-0x000007FEFB5E1000-0x000007FEFB5E3000-memory.dmp

        Filesize

        8KB