Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    48s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    24/11/2022, 01:02

General

  • Target

    3625f77630daaca4b1b2a846bf0b7245eae152992b0299f311e1cde75d4793f5.exe

  • Size

    255KB

  • MD5

    1f5799971cddf63c9e08588aef21e1c1

  • SHA1

    4cb0609159d7479b77db22d74671bfc9019b67f5

  • SHA256

    3625f77630daaca4b1b2a846bf0b7245eae152992b0299f311e1cde75d4793f5

  • SHA512

    a07fa8470ec56f35241c83796fbb05735ffc07cb2787aaea439f8f13f31f632e03023261341cfce5f73e38de1db82b837f5a969fa14ee7a90ac3d17ed2ae52a8

  • SSDEEP

    3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJP:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIY

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 5 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Executes dropped EXE 6 IoCs
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
  • UPX packed file 35 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 6 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
  • AutoIT Executable 14 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 21 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 20 IoCs
  • Suspicious use of FindShellTrayWindow 60 IoCs
  • Suspicious use of SendNotifyMessage 40 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3625f77630daaca4b1b2a846bf0b7245eae152992b0299f311e1cde75d4793f5.exe
    "C:\Users\Admin\AppData\Local\Temp\3625f77630daaca4b1b2a846bf0b7245eae152992b0299f311e1cde75d4793f5.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1808
    • C:\Windows\SysWOW64\zwzdwolcqv.exe
      zwzdwolcqv.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1216
      • C:\Windows\SysWOW64\wiroomsh.exe
        C:\Windows\system32\wiroomsh.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        PID:872
    • C:\Windows\SysWOW64\wiroomsh.exe
      wiroomsh.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1380
    • C:\Windows\SysWOW64\prgyqnsbbpioown.exe
      prgyqnsbbpioown.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1528
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c ujcemwtsemalc.exe
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:432
        • C:\Windows\SysWOW64\ujcemwtsemalc.exe
          ujcemwtsemalc.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          PID:1780
    • C:\Windows\SysWOW64\ujcemwtsemalc.exe
      ujcemwtsemalc.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:584
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1504
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:1688
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1328
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x59c
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1652

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe

      Filesize

      255KB

      MD5

      cec39df270f138f0e5f0066d42a01b6c

      SHA1

      32615f0febf2e61b98019dd7adae1adc2be6d1a0

      SHA256

      8b4f47a73bf01a54fac8492daef64b26764f8ce3eefce945ce692406a666b748

      SHA512

      1d2a15aa673a89a14b78072856b6c29f4ad94e59dabf1529cdbe652917be5630a18a9917bfe3ac184c70d48b64cbc715251363f49360ef4f25abe612eaa6b5b6

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe

      Filesize

      255KB

      MD5

      a7ddd12bc754f3b2e12c0bcf8cfe699c

      SHA1

      a71d0810e69f174a828e747610ecd1117daf3499

      SHA256

      9a4e9723b07ab4fe657071ff58ff3d8fa8f2b468c20bc0c7d0b86453c9a1d433

      SHA512

      caa3d28416f33a8f268f28ed18758e87196ae349933e571f78f516ddd809722e692db62eead1766bcd64d578bf2492b5847a13c4058578cfaa55b059af276a04

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe

      Filesize

      255KB

      MD5

      d78533a821522056cbb80eeed2ac3066

      SHA1

      1f5d5cd92483447e14c27ed1d008188940b8f6cc

      SHA256

      7e816aff170d10ee2d8d9bb2cee515ec026dcc0d105da88a27020e17917a29e0

      SHA512

      6c62a9401b54d020e1cef58c64cb5728ac5ff522a310377881a3b1ddd5f5e4968dc6682027f953995183ab38a5f3105ba56f0733e27c9dc74d1c72917c0d0bea

    • C:\Program Files\ExpandApprove.doc.exe

      Filesize

      255KB

      MD5

      87237de2f6c20c84114a4a8c495bb068

      SHA1

      7d25b295cb0f294aed2ff9124bb54a07f35db77a

      SHA256

      e90146a528af38cb8ea0d9665bd05f89b0aa9f5cbd14e35d3237c91ce4ede2bb

      SHA512

      50633cbc6376b39d3e3efb638e6ddf1a83d7874579c3074dc869891e9913415f93e17a2a1fb309e8124e26d28b3c7297befb12594bf6fae570d8d57943af7013

    • C:\Windows\SysWOW64\prgyqnsbbpioown.exe

      Filesize

      255KB

      MD5

      87056f39c80b2213a0727a5516443e00

      SHA1

      aadd788708aa2e8cc7cc6dd0d061328c5ba3a8f9

      SHA256

      f35f7007057f41a66d3b12a3cec86bf92bfd96f89b4fcfb8db823b18e9204c7f

      SHA512

      a96b5f455c04bddf5ee6adacbd755b38edf5dfaaa8b3c08c3f4a4901974be8a73b4d7e477aca81450fd635f9e82d67ca841187dc70270875b270936e5306826d

    • C:\Windows\SysWOW64\prgyqnsbbpioown.exe

      Filesize

      255KB

      MD5

      87056f39c80b2213a0727a5516443e00

      SHA1

      aadd788708aa2e8cc7cc6dd0d061328c5ba3a8f9

      SHA256

      f35f7007057f41a66d3b12a3cec86bf92bfd96f89b4fcfb8db823b18e9204c7f

      SHA512

      a96b5f455c04bddf5ee6adacbd755b38edf5dfaaa8b3c08c3f4a4901974be8a73b4d7e477aca81450fd635f9e82d67ca841187dc70270875b270936e5306826d

    • C:\Windows\SysWOW64\ujcemwtsemalc.exe

      Filesize

      255KB

      MD5

      643f05b0569d8f5b83d4f6fadf851530

      SHA1

      222c5f0adb548f37b3ef75b4323df65cde4cc8d8

      SHA256

      35d9300e197264cae7ea9099e8d0ea0f860ea44f6708082860b15ea62fed04c8

      SHA512

      02eac85e48075df152fb0b262014f2b5e19aafa2bbd6929040d9c3c1e47a1f70323b05f347a8ad8280332d5ad5cddb6382a4ce8241d3b59ed8ce4494e6eb88c3

    • C:\Windows\SysWOW64\ujcemwtsemalc.exe

      Filesize

      255KB

      MD5

      643f05b0569d8f5b83d4f6fadf851530

      SHA1

      222c5f0adb548f37b3ef75b4323df65cde4cc8d8

      SHA256

      35d9300e197264cae7ea9099e8d0ea0f860ea44f6708082860b15ea62fed04c8

      SHA512

      02eac85e48075df152fb0b262014f2b5e19aafa2bbd6929040d9c3c1e47a1f70323b05f347a8ad8280332d5ad5cddb6382a4ce8241d3b59ed8ce4494e6eb88c3

    • C:\Windows\SysWOW64\ujcemwtsemalc.exe

      Filesize

      255KB

      MD5

      643f05b0569d8f5b83d4f6fadf851530

      SHA1

      222c5f0adb548f37b3ef75b4323df65cde4cc8d8

      SHA256

      35d9300e197264cae7ea9099e8d0ea0f860ea44f6708082860b15ea62fed04c8

      SHA512

      02eac85e48075df152fb0b262014f2b5e19aafa2bbd6929040d9c3c1e47a1f70323b05f347a8ad8280332d5ad5cddb6382a4ce8241d3b59ed8ce4494e6eb88c3

    • C:\Windows\SysWOW64\wiroomsh.exe

      Filesize

      255KB

      MD5

      f5cea6b25ee698bc65c25ada4cfca41f

      SHA1

      3e8443b1d9bd3c89b14b3aa549f726ef9c75d566

      SHA256

      5d1c7eb4f05271a2dab1c0e1e9efe99bde1cf6985c6112a67d1baee8adb7d357

      SHA512

      a4407240f79b35dfd4f7a9d33e8975f860418a394652b04a7cf094945bd0279b024a7654d0a45a01c3d9db03d278282eb766e27bbb678de05272fb6eac9c2cd9

    • C:\Windows\SysWOW64\wiroomsh.exe

      Filesize

      255KB

      MD5

      f5cea6b25ee698bc65c25ada4cfca41f

      SHA1

      3e8443b1d9bd3c89b14b3aa549f726ef9c75d566

      SHA256

      5d1c7eb4f05271a2dab1c0e1e9efe99bde1cf6985c6112a67d1baee8adb7d357

      SHA512

      a4407240f79b35dfd4f7a9d33e8975f860418a394652b04a7cf094945bd0279b024a7654d0a45a01c3d9db03d278282eb766e27bbb678de05272fb6eac9c2cd9

    • C:\Windows\SysWOW64\wiroomsh.exe

      Filesize

      255KB

      MD5

      f5cea6b25ee698bc65c25ada4cfca41f

      SHA1

      3e8443b1d9bd3c89b14b3aa549f726ef9c75d566

      SHA256

      5d1c7eb4f05271a2dab1c0e1e9efe99bde1cf6985c6112a67d1baee8adb7d357

      SHA512

      a4407240f79b35dfd4f7a9d33e8975f860418a394652b04a7cf094945bd0279b024a7654d0a45a01c3d9db03d278282eb766e27bbb678de05272fb6eac9c2cd9

    • C:\Windows\SysWOW64\zwzdwolcqv.exe

      Filesize

      255KB

      MD5

      cefb920a4aa39df4935d74b1603036c1

      SHA1

      93393830e103b630d0d7e69963c11f2305f80880

      SHA256

      5613c7cd6ce69ed6877ad5d4674a46c45f7c7869e74908ac3bfdd20be23cdb8f

      SHA512

      d4fea9b0f71a987a45a7e6787f7ab0ebbf553f0a517cd254a6c67b16da6be44b7fc8ac4b74c844211d1c5c03837db48a45b9eea50ca9e5b7ee02ea3409a981d8

    • C:\Windows\SysWOW64\zwzdwolcqv.exe

      Filesize

      255KB

      MD5

      cefb920a4aa39df4935d74b1603036c1

      SHA1

      93393830e103b630d0d7e69963c11f2305f80880

      SHA256

      5613c7cd6ce69ed6877ad5d4674a46c45f7c7869e74908ac3bfdd20be23cdb8f

      SHA512

      d4fea9b0f71a987a45a7e6787f7ab0ebbf553f0a517cd254a6c67b16da6be44b7fc8ac4b74c844211d1c5c03837db48a45b9eea50ca9e5b7ee02ea3409a981d8

    • C:\Windows\mydoc.rtf

      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

    • \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe

      Filesize

      255KB

      MD5

      cec39df270f138f0e5f0066d42a01b6c

      SHA1

      32615f0febf2e61b98019dd7adae1adc2be6d1a0

      SHA256

      8b4f47a73bf01a54fac8492daef64b26764f8ce3eefce945ce692406a666b748

      SHA512

      1d2a15aa673a89a14b78072856b6c29f4ad94e59dabf1529cdbe652917be5630a18a9917bfe3ac184c70d48b64cbc715251363f49360ef4f25abe612eaa6b5b6

    • \Windows\SysWOW64\prgyqnsbbpioown.exe

      Filesize

      255KB

      MD5

      87056f39c80b2213a0727a5516443e00

      SHA1

      aadd788708aa2e8cc7cc6dd0d061328c5ba3a8f9

      SHA256

      f35f7007057f41a66d3b12a3cec86bf92bfd96f89b4fcfb8db823b18e9204c7f

      SHA512

      a96b5f455c04bddf5ee6adacbd755b38edf5dfaaa8b3c08c3f4a4901974be8a73b4d7e477aca81450fd635f9e82d67ca841187dc70270875b270936e5306826d

    • \Windows\SysWOW64\ujcemwtsemalc.exe

      Filesize

      255KB

      MD5

      643f05b0569d8f5b83d4f6fadf851530

      SHA1

      222c5f0adb548f37b3ef75b4323df65cde4cc8d8

      SHA256

      35d9300e197264cae7ea9099e8d0ea0f860ea44f6708082860b15ea62fed04c8

      SHA512

      02eac85e48075df152fb0b262014f2b5e19aafa2bbd6929040d9c3c1e47a1f70323b05f347a8ad8280332d5ad5cddb6382a4ce8241d3b59ed8ce4494e6eb88c3

    • \Windows\SysWOW64\ujcemwtsemalc.exe

      Filesize

      255KB

      MD5

      643f05b0569d8f5b83d4f6fadf851530

      SHA1

      222c5f0adb548f37b3ef75b4323df65cde4cc8d8

      SHA256

      35d9300e197264cae7ea9099e8d0ea0f860ea44f6708082860b15ea62fed04c8

      SHA512

      02eac85e48075df152fb0b262014f2b5e19aafa2bbd6929040d9c3c1e47a1f70323b05f347a8ad8280332d5ad5cddb6382a4ce8241d3b59ed8ce4494e6eb88c3

    • \Windows\SysWOW64\wiroomsh.exe

      Filesize

      255KB

      MD5

      f5cea6b25ee698bc65c25ada4cfca41f

      SHA1

      3e8443b1d9bd3c89b14b3aa549f726ef9c75d566

      SHA256

      5d1c7eb4f05271a2dab1c0e1e9efe99bde1cf6985c6112a67d1baee8adb7d357

      SHA512

      a4407240f79b35dfd4f7a9d33e8975f860418a394652b04a7cf094945bd0279b024a7654d0a45a01c3d9db03d278282eb766e27bbb678de05272fb6eac9c2cd9

    • \Windows\SysWOW64\wiroomsh.exe

      Filesize

      255KB

      MD5

      f5cea6b25ee698bc65c25ada4cfca41f

      SHA1

      3e8443b1d9bd3c89b14b3aa549f726ef9c75d566

      SHA256

      5d1c7eb4f05271a2dab1c0e1e9efe99bde1cf6985c6112a67d1baee8adb7d357

      SHA512

      a4407240f79b35dfd4f7a9d33e8975f860418a394652b04a7cf094945bd0279b024a7654d0a45a01c3d9db03d278282eb766e27bbb678de05272fb6eac9c2cd9

    • \Windows\SysWOW64\zwzdwolcqv.exe

      Filesize

      255KB

      MD5

      cefb920a4aa39df4935d74b1603036c1

      SHA1

      93393830e103b630d0d7e69963c11f2305f80880

      SHA256

      5613c7cd6ce69ed6877ad5d4674a46c45f7c7869e74908ac3bfdd20be23cdb8f

      SHA512

      d4fea9b0f71a987a45a7e6787f7ab0ebbf553f0a517cd254a6c67b16da6be44b7fc8ac4b74c844211d1c5c03837db48a45b9eea50ca9e5b7ee02ea3409a981d8

    • memory/584-80-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/584-105-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/872-94-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/872-107-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1216-102-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1216-106-0x0000000003840000-0x00000000038E0000-memory.dmp

      Filesize

      640KB

    • memory/1216-77-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1328-101-0x000007FEFBCB1000-0x000007FEFBCB3000-memory.dmp

      Filesize

      8KB

    • memory/1380-104-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1380-79-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1504-93-0x0000000070221000-0x0000000070223000-memory.dmp

      Filesize

      8KB

    • memory/1504-97-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1504-100-0x000000007120D000-0x0000000071218000-memory.dmp

      Filesize

      44KB

    • memory/1504-110-0x000000006B2F1000-0x000000006B2F3000-memory.dmp

      Filesize

      8KB

    • memory/1504-109-0x000000006B721000-0x000000006B723000-memory.dmp

      Filesize

      8KB

    • memory/1504-92-0x00000000727A1000-0x00000000727A4000-memory.dmp

      Filesize

      12KB

    • memory/1528-103-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1528-78-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1780-108-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1780-95-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1808-76-0x0000000002F30000-0x0000000002FD0000-memory.dmp

      Filesize

      640KB

    • memory/1808-74-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1808-91-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1808-54-0x0000000075211000-0x0000000075213000-memory.dmp

      Filesize

      8KB