Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    153s
  • max time network
    167s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/11/2022, 01:02

General

  • Target

    3625f77630daaca4b1b2a846bf0b7245eae152992b0299f311e1cde75d4793f5.exe

  • Size

    255KB

  • MD5

    1f5799971cddf63c9e08588aef21e1c1

  • SHA1

    4cb0609159d7479b77db22d74671bfc9019b67f5

  • SHA256

    3625f77630daaca4b1b2a846bf0b7245eae152992b0299f311e1cde75d4793f5

  • SHA512

    a07fa8470ec56f35241c83796fbb05735ffc07cb2787aaea439f8f13f31f632e03023261341cfce5f73e38de1db82b837f5a969fa14ee7a90ac3d17ed2ae52a8

  • SSDEEP

    3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJP:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIY

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 5 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Executes dropped EXE 5 IoCs
  • UPX packed file 27 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 6 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
  • AutoIT Executable 12 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3625f77630daaca4b1b2a846bf0b7245eae152992b0299f311e1cde75d4793f5.exe
    "C:\Users\Admin\AppData\Local\Temp\3625f77630daaca4b1b2a846bf0b7245eae152992b0299f311e1cde75d4793f5.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4172
    • C:\Windows\SysWOW64\dasznvsqhk.exe
      dasznvsqhk.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4204
      • C:\Windows\SysWOW64\uwruolgt.exe
        C:\Windows\system32\uwruolgt.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2032
    • C:\Windows\SysWOW64\qgwboajgjpcbhdg.exe
      qgwboajgjpcbhdg.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4560
    • C:\Windows\SysWOW64\uwruolgt.exe
      uwruolgt.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4164
    • C:\Windows\SysWOW64\beqsieqpcubyo.exe
      beqsieqpcubyo.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3592
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:3192

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe

    Filesize

    255KB

    MD5

    ac7b1eadf664a7f26f9eff80f1426797

    SHA1

    7a140ce60d60f89a01ff4d8b7fc19f4fc51a9e0d

    SHA256

    851848d59cfcf5f1cc2693c17b697670000f607d4ee0182d54c2608324350a35

    SHA512

    3e81d827571b855e39c4997a6a7fa2d48a245dd58eccb25f9399083a977ef4d7eb3ae74fa4a140134b9d1f9f85528df7142ec15579e15daf8edbeaf2220d6201

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe

    Filesize

    255KB

    MD5

    78cb5f4a8d3c3947c2e6e1e921bf9d3c

    SHA1

    9025046207f32564504a96961994e9c729fd0bed

    SHA256

    af3da1cd0dc48010c6f27d3b4c3cb9667d48bda22cec71234ae78242db9bff54

    SHA512

    2252061fb8b4b2ecd56ad06b66d2823c570971a2f0d5ab0531494eb97ca605113e6f39c34008d46dc26d2b239363515bb03ccbfb5bf12f003e95d0d8225f27f1

  • C:\Users\Admin\Downloads\GroupClose.doc.exe

    Filesize

    255KB

    MD5

    83d9ebb90fbe3a572a27468f4f39808b

    SHA1

    9ddb52915075d9f43ad7c42752a5f6bc3b0126a8

    SHA256

    0dbcd3d64cba1afa21aa23445c0ae693c96e1d3faa29a3a27428cfd46f6d58ef

    SHA512

    817f23a92657235b635b35accc5509daf5b17fc11e375d6d1ef77abf9f4de5af22f6d55e7b1ca7f3734e94447a31cfe2fcbe1dee0ca50945e69a11b2c99e5178

  • C:\Windows\SysWOW64\beqsieqpcubyo.exe

    Filesize

    255KB

    MD5

    7913650fdce2ac0fbc6c0917b8286f93

    SHA1

    4b3ffea6c3c559a94c3133f3718c56fa4b662940

    SHA256

    020444cebf3ce25eea0b23c5bb5c2e30cbeb81d3d147f1499d2e905c3f14b0de

    SHA512

    a3f7cb5996fb29ad46e8d0e0c463ec5eef48e07596652fb83fa6f6ccfc1c8f5b7e8acdba4d4939001f2d6604d5c8883b2a957501f9b3ecb8647fcdb194299d2b

  • C:\Windows\SysWOW64\beqsieqpcubyo.exe

    Filesize

    255KB

    MD5

    7913650fdce2ac0fbc6c0917b8286f93

    SHA1

    4b3ffea6c3c559a94c3133f3718c56fa4b662940

    SHA256

    020444cebf3ce25eea0b23c5bb5c2e30cbeb81d3d147f1499d2e905c3f14b0de

    SHA512

    a3f7cb5996fb29ad46e8d0e0c463ec5eef48e07596652fb83fa6f6ccfc1c8f5b7e8acdba4d4939001f2d6604d5c8883b2a957501f9b3ecb8647fcdb194299d2b

  • C:\Windows\SysWOW64\dasznvsqhk.exe

    Filesize

    255KB

    MD5

    e4aa840ad2c5611ec438c703fe336cd6

    SHA1

    5e12dc0a04a03c2380c2d54e43e3bb3ac5e9b34d

    SHA256

    879ca579ad1dd57d5b3530efc4bd7a0c668916114b6ee1b3d39e6a0c99a7fd5d

    SHA512

    f78b68043bed8e6e60b9b279d3f2994938c4f33b0bd64432d5bbfd75c886632a3e2e2d5c8bc21aabb0d9db2a46f81694da4a4a4504b0495b9726c5284d712b1d

  • C:\Windows\SysWOW64\dasznvsqhk.exe

    Filesize

    255KB

    MD5

    e4aa840ad2c5611ec438c703fe336cd6

    SHA1

    5e12dc0a04a03c2380c2d54e43e3bb3ac5e9b34d

    SHA256

    879ca579ad1dd57d5b3530efc4bd7a0c668916114b6ee1b3d39e6a0c99a7fd5d

    SHA512

    f78b68043bed8e6e60b9b279d3f2994938c4f33b0bd64432d5bbfd75c886632a3e2e2d5c8bc21aabb0d9db2a46f81694da4a4a4504b0495b9726c5284d712b1d

  • C:\Windows\SysWOW64\qgwboajgjpcbhdg.exe

    Filesize

    255KB

    MD5

    a2609168d381baaee2a7beb3bf9d39a4

    SHA1

    07322ef5df4456f1cb89ef2364788fac88911d37

    SHA256

    542fa99d6c179e8d5dfe5fcc4e63df9a8c419837ea41b9e61a7a0e684cf5c3cd

    SHA512

    c774397ce91fd4560dafcd46f9dd3a3a17a1e439d27a0c0fc30b1491db985dc76817632ec8ee65958b5f3862454764c54ef930d691f7611485813368d3224285

  • C:\Windows\SysWOW64\qgwboajgjpcbhdg.exe

    Filesize

    255KB

    MD5

    a2609168d381baaee2a7beb3bf9d39a4

    SHA1

    07322ef5df4456f1cb89ef2364788fac88911d37

    SHA256

    542fa99d6c179e8d5dfe5fcc4e63df9a8c419837ea41b9e61a7a0e684cf5c3cd

    SHA512

    c774397ce91fd4560dafcd46f9dd3a3a17a1e439d27a0c0fc30b1491db985dc76817632ec8ee65958b5f3862454764c54ef930d691f7611485813368d3224285

  • C:\Windows\SysWOW64\uwruolgt.exe

    Filesize

    255KB

    MD5

    14329fcf90df33f8178155e032b77cd8

    SHA1

    0b29866563a1a5d5690b7cae87a6f9dde7dfbf37

    SHA256

    c7083420bcf8dbadde98e3e239c127aff8daa173de50f4bc38693a2ced203538

    SHA512

    fc19af17fb92e5e72ed2e080a013a03c244887fdb8960bd2804aa7b7f81baeabbfc7776b7b4bfa99c09b11abfb0699d34b69a3e0afdfd101de41a1227832b430

  • C:\Windows\SysWOW64\uwruolgt.exe

    Filesize

    255KB

    MD5

    14329fcf90df33f8178155e032b77cd8

    SHA1

    0b29866563a1a5d5690b7cae87a6f9dde7dfbf37

    SHA256

    c7083420bcf8dbadde98e3e239c127aff8daa173de50f4bc38693a2ced203538

    SHA512

    fc19af17fb92e5e72ed2e080a013a03c244887fdb8960bd2804aa7b7f81baeabbfc7776b7b4bfa99c09b11abfb0699d34b69a3e0afdfd101de41a1227832b430

  • C:\Windows\SysWOW64\uwruolgt.exe

    Filesize

    255KB

    MD5

    14329fcf90df33f8178155e032b77cd8

    SHA1

    0b29866563a1a5d5690b7cae87a6f9dde7dfbf37

    SHA256

    c7083420bcf8dbadde98e3e239c127aff8daa173de50f4bc38693a2ced203538

    SHA512

    fc19af17fb92e5e72ed2e080a013a03c244887fdb8960bd2804aa7b7f81baeabbfc7776b7b4bfa99c09b11abfb0699d34b69a3e0afdfd101de41a1227832b430

  • C:\Windows\mydoc.rtf

    Filesize

    223B

    MD5

    06604e5941c126e2e7be02c5cd9f62ec

    SHA1

    4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

    SHA256

    85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

    SHA512

    803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

  • \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe

    Filesize

    255KB

    MD5

    78cb5f4a8d3c3947c2e6e1e921bf9d3c

    SHA1

    9025046207f32564504a96961994e9c729fd0bed

    SHA256

    af3da1cd0dc48010c6f27d3b4c3cb9667d48bda22cec71234ae78242db9bff54

    SHA512

    2252061fb8b4b2ecd56ad06b66d2823c570971a2f0d5ab0531494eb97ca605113e6f39c34008d46dc26d2b239363515bb03ccbfb5bf12f003e95d0d8225f27f1

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

    Filesize

    255KB

    MD5

    026108103f4f5b87b86d5e9f141e2318

    SHA1

    c5ff61c9a2b61e81a255b4da81046151e03128bd

    SHA256

    f14d8cf690414c22fdd416b412680372b66f7fa5c6611cc5b1d37ebf74282f19

    SHA512

    1233c51614afd3aa316db915abf46b72ab27d387c4979c0136835351e0b2f1896f6eea2cb2eb41db83e6dd8d24fa845dbb3e43a910c46cb4c95891932de8fa81

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

    Filesize

    255KB

    MD5

    d782ed8190d2e7d15a0edd438d9a8a4f

    SHA1

    64d7aff01cdd546b0a07fedb19b0710587a23dc5

    SHA256

    48ace9fd64decedb1797974bc0fbdb7f4f9d88e3e7cfd986420cb8c169ef40a9

    SHA512

    e7fa0b3470b9d9969d077d8753c0deddbaec991435bc7e88bfa02c42466fbc09d1c04f3bcf32c5de64ebeae63b86be2fdb27976be9012f62b8984e8b1cfbfaee

  • memory/2032-169-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2032-153-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/3192-154-0x00007FFBBAEF0000-0x00007FFBBAF00000-memory.dmp

    Filesize

    64KB

  • memory/3192-171-0x00007FFBBAEF0000-0x00007FFBBAF00000-memory.dmp

    Filesize

    64KB

  • memory/3192-173-0x00007FFBBAEF0000-0x00007FFBBAF00000-memory.dmp

    Filesize

    64KB

  • memory/3192-155-0x00007FFBBAEF0000-0x00007FFBBAF00000-memory.dmp

    Filesize

    64KB

  • memory/3192-156-0x00007FFBBAEF0000-0x00007FFBBAF00000-memory.dmp

    Filesize

    64KB

  • memory/3192-157-0x00007FFBBAEF0000-0x00007FFBBAF00000-memory.dmp

    Filesize

    64KB

  • memory/3192-158-0x00007FFBBAEF0000-0x00007FFBBAF00000-memory.dmp

    Filesize

    64KB

  • memory/3192-174-0x00007FFBBAEF0000-0x00007FFBBAF00000-memory.dmp

    Filesize

    64KB

  • memory/3192-172-0x00007FFBBAEF0000-0x00007FFBBAF00000-memory.dmp

    Filesize

    64KB

  • memory/3192-163-0x00007FFBB8690000-0x00007FFBB86A0000-memory.dmp

    Filesize

    64KB

  • memory/3192-162-0x00007FFBB8690000-0x00007FFBB86A0000-memory.dmp

    Filesize

    64KB

  • memory/3592-148-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/3592-168-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/4164-147-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/4164-167-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/4172-144-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/4172-152-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/4204-145-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/4204-165-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/4560-166-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/4560-146-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB