Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    189s
  • max time network
    45s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    07/11/2022, 21:33

General

  • Target

    44554cab83629ece40ba7b12870919ddd65ca56a8969d3780f9849695477ec24.exe

  • Size

    255KB

  • MD5

    059ad3161a90c5598d3bee56f285f946

  • SHA1

    554b1197d84c2c06ca4f336bcdd2f650e58fc697

  • SHA256

    44554cab83629ece40ba7b12870919ddd65ca56a8969d3780f9849695477ec24

  • SHA512

    5ef16e24c797359476ad81a530a096b34805238a97ac1a2b83fabe2f201d53d4490765f61d259d32a4be8f7137edce8313d482b03c0a79d6926f867456f96d1b

  • SSDEEP

    6144:1xlZam+akqx6YQJXcNlEHUIQeE3mmBWFv6I:Plf5j6zCNa0xeE3mr

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 5 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Executes dropped EXE 6 IoCs
  • UPX packed file 29 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 6 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
  • AutoIT Executable 12 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 8 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\44554cab83629ece40ba7b12870919ddd65ca56a8969d3780f9849695477ec24.exe
    "C:\Users\Admin\AppData\Local\Temp\44554cab83629ece40ba7b12870919ddd65ca56a8969d3780f9849695477ec24.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1368
    • C:\Windows\SysWOW64\axywsnjdsg.exe
      axywsnjdsg.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1404
      • C:\Windows\SysWOW64\pxaifjfp.exe
        C:\Windows\system32\pxaifjfp.exe
        3⤵
        • Executes dropped EXE
        PID:1984
    • C:\Windows\SysWOW64\kzhyqmkcwqckjof.exe
      kzhyqmkcwqckjof.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1744
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c ndebkmctfqtds.exe
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1172
        • C:\Windows\SysWOW64\ndebkmctfqtds.exe
          ndebkmctfqtds.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:268
    • C:\Windows\SysWOW64\pxaifjfp.exe
      pxaifjfp.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1904
    • C:\Windows\SysWOW64\ndebkmctfqtds.exe
      ndebkmctfqtds.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1344
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1936
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:1912

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\SysWOW64\axywsnjdsg.exe

      Filesize

      255KB

      MD5

      bf8b75efa1e0f8b618ff0f73aed8b78f

      SHA1

      fef347b7ebf29da26fc523a6aaa32f1e5a3197df

      SHA256

      65a1aa6625800f27e72a70f890a761f073883e553776ef4305dfad45ae7b575b

      SHA512

      8b53985f8afb7c31e526d2c3290658096ff2b586c46c37e359115d2148b4b0dc3656c926cbcb966d7638eec05056fceef9492a49dc5e52a5f2dee865af0c3ada

    • C:\Windows\SysWOW64\axywsnjdsg.exe

      Filesize

      255KB

      MD5

      bf8b75efa1e0f8b618ff0f73aed8b78f

      SHA1

      fef347b7ebf29da26fc523a6aaa32f1e5a3197df

      SHA256

      65a1aa6625800f27e72a70f890a761f073883e553776ef4305dfad45ae7b575b

      SHA512

      8b53985f8afb7c31e526d2c3290658096ff2b586c46c37e359115d2148b4b0dc3656c926cbcb966d7638eec05056fceef9492a49dc5e52a5f2dee865af0c3ada

    • C:\Windows\SysWOW64\kzhyqmkcwqckjof.exe

      Filesize

      255KB

      MD5

      4bb405ffc5039a34c2524d696309f294

      SHA1

      681c0813aed7f7d068fffc00efbde1c6b7599a11

      SHA256

      9853a6151ba23753e465ccc8b5041de38930af037d05ab29334a1a7ddc1be8f6

      SHA512

      c4327992ab62bdf977026881c128aac09fd63c3fd1ed9cf33b00f2ddfaf932f257bf1f14bdc3f78133d7ababf62290b582e5c72a51bebe550a92aba535554a57

    • C:\Windows\SysWOW64\kzhyqmkcwqckjof.exe

      Filesize

      255KB

      MD5

      4bb405ffc5039a34c2524d696309f294

      SHA1

      681c0813aed7f7d068fffc00efbde1c6b7599a11

      SHA256

      9853a6151ba23753e465ccc8b5041de38930af037d05ab29334a1a7ddc1be8f6

      SHA512

      c4327992ab62bdf977026881c128aac09fd63c3fd1ed9cf33b00f2ddfaf932f257bf1f14bdc3f78133d7ababf62290b582e5c72a51bebe550a92aba535554a57

    • C:\Windows\SysWOW64\ndebkmctfqtds.exe

      Filesize

      255KB

      MD5

      4b7890fa8ddf55af01970b8f9d2738f8

      SHA1

      c7a393e9a7e0ad0109fc7248cb55ae47224cebc9

      SHA256

      556cf3a44e52e36b292376dc1c6ce2801535c6717eb044ca7f8e166c379f3f57

      SHA512

      2a6de6158135998a2ebc140754a7176c98cf7f761b9cddfc61e3978212e3e6eb8abb1a1c9df08ff771391d994681ce3fe783bea206325e3086a509c6aebc7ece

    • C:\Windows\SysWOW64\ndebkmctfqtds.exe

      Filesize

      255KB

      MD5

      4b7890fa8ddf55af01970b8f9d2738f8

      SHA1

      c7a393e9a7e0ad0109fc7248cb55ae47224cebc9

      SHA256

      556cf3a44e52e36b292376dc1c6ce2801535c6717eb044ca7f8e166c379f3f57

      SHA512

      2a6de6158135998a2ebc140754a7176c98cf7f761b9cddfc61e3978212e3e6eb8abb1a1c9df08ff771391d994681ce3fe783bea206325e3086a509c6aebc7ece

    • C:\Windows\SysWOW64\ndebkmctfqtds.exe

      Filesize

      255KB

      MD5

      4b7890fa8ddf55af01970b8f9d2738f8

      SHA1

      c7a393e9a7e0ad0109fc7248cb55ae47224cebc9

      SHA256

      556cf3a44e52e36b292376dc1c6ce2801535c6717eb044ca7f8e166c379f3f57

      SHA512

      2a6de6158135998a2ebc140754a7176c98cf7f761b9cddfc61e3978212e3e6eb8abb1a1c9df08ff771391d994681ce3fe783bea206325e3086a509c6aebc7ece

    • C:\Windows\SysWOW64\pxaifjfp.exe

      Filesize

      255KB

      MD5

      d5a37c3ac4b66127e608c023d189442d

      SHA1

      8ba7d1bb86bc9dacd003c656e98b04915874161d

      SHA256

      673acc014de5a69433f9d555480d8f60c7cb1cb9083fca10854c0f99f60c86e4

      SHA512

      ac11f405c9535ecb3910771716cb6d6a60c458e09087f24966652eef9b53b14d799d0a653060b0ffb1359ff5c5ce24c95f72bd63ae0c014950f92f797cab36f5

    • C:\Windows\SysWOW64\pxaifjfp.exe

      Filesize

      255KB

      MD5

      d5a37c3ac4b66127e608c023d189442d

      SHA1

      8ba7d1bb86bc9dacd003c656e98b04915874161d

      SHA256

      673acc014de5a69433f9d555480d8f60c7cb1cb9083fca10854c0f99f60c86e4

      SHA512

      ac11f405c9535ecb3910771716cb6d6a60c458e09087f24966652eef9b53b14d799d0a653060b0ffb1359ff5c5ce24c95f72bd63ae0c014950f92f797cab36f5

    • C:\Windows\SysWOW64\pxaifjfp.exe

      Filesize

      255KB

      MD5

      d5a37c3ac4b66127e608c023d189442d

      SHA1

      8ba7d1bb86bc9dacd003c656e98b04915874161d

      SHA256

      673acc014de5a69433f9d555480d8f60c7cb1cb9083fca10854c0f99f60c86e4

      SHA512

      ac11f405c9535ecb3910771716cb6d6a60c458e09087f24966652eef9b53b14d799d0a653060b0ffb1359ff5c5ce24c95f72bd63ae0c014950f92f797cab36f5

    • C:\Windows\mydoc.rtf

      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

    • \Windows\SysWOW64\axywsnjdsg.exe

      Filesize

      255KB

      MD5

      bf8b75efa1e0f8b618ff0f73aed8b78f

      SHA1

      fef347b7ebf29da26fc523a6aaa32f1e5a3197df

      SHA256

      65a1aa6625800f27e72a70f890a761f073883e553776ef4305dfad45ae7b575b

      SHA512

      8b53985f8afb7c31e526d2c3290658096ff2b586c46c37e359115d2148b4b0dc3656c926cbcb966d7638eec05056fceef9492a49dc5e52a5f2dee865af0c3ada

    • \Windows\SysWOW64\kzhyqmkcwqckjof.exe

      Filesize

      255KB

      MD5

      4bb405ffc5039a34c2524d696309f294

      SHA1

      681c0813aed7f7d068fffc00efbde1c6b7599a11

      SHA256

      9853a6151ba23753e465ccc8b5041de38930af037d05ab29334a1a7ddc1be8f6

      SHA512

      c4327992ab62bdf977026881c128aac09fd63c3fd1ed9cf33b00f2ddfaf932f257bf1f14bdc3f78133d7ababf62290b582e5c72a51bebe550a92aba535554a57

    • \Windows\SysWOW64\ndebkmctfqtds.exe

      Filesize

      255KB

      MD5

      4b7890fa8ddf55af01970b8f9d2738f8

      SHA1

      c7a393e9a7e0ad0109fc7248cb55ae47224cebc9

      SHA256

      556cf3a44e52e36b292376dc1c6ce2801535c6717eb044ca7f8e166c379f3f57

      SHA512

      2a6de6158135998a2ebc140754a7176c98cf7f761b9cddfc61e3978212e3e6eb8abb1a1c9df08ff771391d994681ce3fe783bea206325e3086a509c6aebc7ece

    • \Windows\SysWOW64\ndebkmctfqtds.exe

      Filesize

      255KB

      MD5

      4b7890fa8ddf55af01970b8f9d2738f8

      SHA1

      c7a393e9a7e0ad0109fc7248cb55ae47224cebc9

      SHA256

      556cf3a44e52e36b292376dc1c6ce2801535c6717eb044ca7f8e166c379f3f57

      SHA512

      2a6de6158135998a2ebc140754a7176c98cf7f761b9cddfc61e3978212e3e6eb8abb1a1c9df08ff771391d994681ce3fe783bea206325e3086a509c6aebc7ece

    • \Windows\SysWOW64\pxaifjfp.exe

      Filesize

      255KB

      MD5

      d5a37c3ac4b66127e608c023d189442d

      SHA1

      8ba7d1bb86bc9dacd003c656e98b04915874161d

      SHA256

      673acc014de5a69433f9d555480d8f60c7cb1cb9083fca10854c0f99f60c86e4

      SHA512

      ac11f405c9535ecb3910771716cb6d6a60c458e09087f24966652eef9b53b14d799d0a653060b0ffb1359ff5c5ce24c95f72bd63ae0c014950f92f797cab36f5

    • \Windows\SysWOW64\pxaifjfp.exe

      Filesize

      255KB

      MD5

      d5a37c3ac4b66127e608c023d189442d

      SHA1

      8ba7d1bb86bc9dacd003c656e98b04915874161d

      SHA256

      673acc014de5a69433f9d555480d8f60c7cb1cb9083fca10854c0f99f60c86e4

      SHA512

      ac11f405c9535ecb3910771716cb6d6a60c458e09087f24966652eef9b53b14d799d0a653060b0ffb1359ff5c5ce24c95f72bd63ae0c014950f92f797cab36f5

    • memory/268-104-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/268-92-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1344-103-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1344-91-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1368-60-0x0000000003330000-0x00000000033D0000-memory.dmp

      Filesize

      640KB

    • memory/1368-58-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1368-54-0x0000000075771000-0x0000000075773000-memory.dmp

      Filesize

      8KB

    • memory/1368-87-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1404-88-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1404-100-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1744-89-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1744-101-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1904-90-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1904-102-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1912-107-0x000007FEFB6A1000-0x000007FEFB6A3000-memory.dmp

      Filesize

      8KB

    • memory/1936-99-0x0000000070A5D000-0x0000000070A68000-memory.dmp

      Filesize

      44KB

    • memory/1936-95-0x000000006FA71000-0x000000006FA73000-memory.dmp

      Filesize

      8KB

    • memory/1936-105-0x0000000070A5D000-0x0000000070A68000-memory.dmp

      Filesize

      44KB

    • memory/1936-94-0x0000000071FF1000-0x0000000071FF4000-memory.dmp

      Filesize

      12KB

    • memory/1936-96-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1936-108-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1936-109-0x0000000070A5D000-0x0000000070A68000-memory.dmp

      Filesize

      44KB

    • memory/1984-93-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB