Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    174s
  • max time network
    32s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    27/11/2022, 10:43

General

  • Target

    eff2650df4553efad1a2d33639d4cc5882f4f3c9c6f86c083142f4224b41a29e.exe

  • Size

    255KB

  • MD5

    40527cd1cd4784f0e47dbc5b3a05b600

  • SHA1

    2b0e60502ecbd26bb3c4b8da6fdaa15a894a9fb8

  • SHA256

    eff2650df4553efad1a2d33639d4cc5882f4f3c9c6f86c083142f4224b41a29e

  • SHA512

    665e47ead615771fd1dc95bb8661adbc534f1a93c6e2fc5b223f9e23e86c39e01e2623002ad9608880505bf07a8354efdb4975bba15e4c7b61dd706620796e43

  • SSDEEP

    3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJq:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIp

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 5 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Executes dropped EXE 6 IoCs
  • UPX packed file 34 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 6 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
  • AutoIT Executable 14 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 22 IoCs
  • Suspicious use of SendNotifyMessage 22 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eff2650df4553efad1a2d33639d4cc5882f4f3c9c6f86c083142f4224b41a29e.exe
    "C:\Users\Admin\AppData\Local\Temp\eff2650df4553efad1a2d33639d4cc5882f4f3c9c6f86c083142f4224b41a29e.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:960
    • C:\Windows\SysWOW64\trhwfxawbv.exe
      trhwfxawbv.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:876
      • C:\Windows\SysWOW64\cjyvphab.exe
        C:\Windows\system32\cjyvphab.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1284
    • C:\Windows\SysWOW64\vozdcdifynpetqo.exe
      vozdcdifynpetqo.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:596
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c dqweumtibjkjt.exe
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:840
        • C:\Windows\SysWOW64\dqweumtibjkjt.exe
          dqweumtibjkjt.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:964
    • C:\Windows\SysWOW64\cjyvphab.exe
      cjyvphab.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:580
    • C:\Windows\SysWOW64\dqweumtibjkjt.exe
      dqweumtibjkjt.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1804
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1648
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:1148

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe

      Filesize

      255KB

      MD5

      2aa760288e8e018d37f53f69c8e61c36

      SHA1

      2fe02f57e11d60fbeb724224e064272963693f14

      SHA256

      a8f33c4fda00f8cd44a67d62e7237908d3c29f2241c624fd8756493f115c7a9a

      SHA512

      d2929d8df7fc693be4a967e0f36b9474a750cae39ef11196591c9f4038716cec3e593463d73e42b7c8a751adcbc8d054ce608848a63abcafcebf2d52e6266d72

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe

      Filesize

      255KB

      MD5

      2aa760288e8e018d37f53f69c8e61c36

      SHA1

      2fe02f57e11d60fbeb724224e064272963693f14

      SHA256

      a8f33c4fda00f8cd44a67d62e7237908d3c29f2241c624fd8756493f115c7a9a

      SHA512

      d2929d8df7fc693be4a967e0f36b9474a750cae39ef11196591c9f4038716cec3e593463d73e42b7c8a751adcbc8d054ce608848a63abcafcebf2d52e6266d72

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe

      Filesize

      255KB

      MD5

      d926092c82719b70e0d273964045abb9

      SHA1

      266f79d4978ed79c76dce4c7df52b1f689a96f56

      SHA256

      72a3dde2b0d126916749208d8556cb622a0a38e87cd1b79a6b8693056a0a06e3

      SHA512

      ba60e2e1843eb9eb92e65022dba5d7f10b24d0fcb4599252175533ba8ba9cbf5e711f6c61765b1195b028e94656920c4771b74ea286c9d3cbc382f346051e369

    • C:\Windows\SysWOW64\cjyvphab.exe

      Filesize

      255KB

      MD5

      167b735e1b45bcc049df3098218262cb

      SHA1

      43bf45d1fe52904ba515a5fea8269bd3cd308e18

      SHA256

      b2c1b95eb7c7cc1c55be4d1e1d04855dc1a2c9e309083a373320f25fd2ff6c6a

      SHA512

      498eae782dd2a34537fa53ab0672cf055bf02764c16c8a1c6696512479a5075e7c3d972fa298c5a1195e0cf38b7919a3cd1a1f5b582f8a8ad6aab93dfa39d8e0

    • C:\Windows\SysWOW64\cjyvphab.exe

      Filesize

      255KB

      MD5

      167b735e1b45bcc049df3098218262cb

      SHA1

      43bf45d1fe52904ba515a5fea8269bd3cd308e18

      SHA256

      b2c1b95eb7c7cc1c55be4d1e1d04855dc1a2c9e309083a373320f25fd2ff6c6a

      SHA512

      498eae782dd2a34537fa53ab0672cf055bf02764c16c8a1c6696512479a5075e7c3d972fa298c5a1195e0cf38b7919a3cd1a1f5b582f8a8ad6aab93dfa39d8e0

    • C:\Windows\SysWOW64\cjyvphab.exe

      Filesize

      255KB

      MD5

      167b735e1b45bcc049df3098218262cb

      SHA1

      43bf45d1fe52904ba515a5fea8269bd3cd308e18

      SHA256

      b2c1b95eb7c7cc1c55be4d1e1d04855dc1a2c9e309083a373320f25fd2ff6c6a

      SHA512

      498eae782dd2a34537fa53ab0672cf055bf02764c16c8a1c6696512479a5075e7c3d972fa298c5a1195e0cf38b7919a3cd1a1f5b582f8a8ad6aab93dfa39d8e0

    • C:\Windows\SysWOW64\dqweumtibjkjt.exe

      Filesize

      255KB

      MD5

      0f8d703fa2a1f1fed255438095bb8de5

      SHA1

      6ef9f0fe1804654530f7b3b3e0d6407c6ed48092

      SHA256

      5f486a2b6fc7331e531827cdc2848f540710c16a5211131d6972cafcc5941981

      SHA512

      1d3052dd106a7f35353a6b91adac50117fdac4a3336d34d0bb772592a9ae0d16f7a5106fe2a6c0ccc13f0be2c09ac667877837dd914df6b4e047cb9c44bba4e6

    • C:\Windows\SysWOW64\dqweumtibjkjt.exe

      Filesize

      255KB

      MD5

      0f8d703fa2a1f1fed255438095bb8de5

      SHA1

      6ef9f0fe1804654530f7b3b3e0d6407c6ed48092

      SHA256

      5f486a2b6fc7331e531827cdc2848f540710c16a5211131d6972cafcc5941981

      SHA512

      1d3052dd106a7f35353a6b91adac50117fdac4a3336d34d0bb772592a9ae0d16f7a5106fe2a6c0ccc13f0be2c09ac667877837dd914df6b4e047cb9c44bba4e6

    • C:\Windows\SysWOW64\dqweumtibjkjt.exe

      Filesize

      255KB

      MD5

      0f8d703fa2a1f1fed255438095bb8de5

      SHA1

      6ef9f0fe1804654530f7b3b3e0d6407c6ed48092

      SHA256

      5f486a2b6fc7331e531827cdc2848f540710c16a5211131d6972cafcc5941981

      SHA512

      1d3052dd106a7f35353a6b91adac50117fdac4a3336d34d0bb772592a9ae0d16f7a5106fe2a6c0ccc13f0be2c09ac667877837dd914df6b4e047cb9c44bba4e6

    • C:\Windows\SysWOW64\trhwfxawbv.exe

      Filesize

      255KB

      MD5

      d3d5c901c498b81487597a27236e3be4

      SHA1

      91fd9a57a88e9b1687d06f8c6b0a8f5963c9c97b

      SHA256

      850164962ec7ac3263fc2d01f957f5d527e5c3d43a0e52babf781f96fc1288c5

      SHA512

      a848679d64d8cedc55fbbd4a942c18e1151132671459d39b5922a27c630d3011a95d2aa57b9ef8b60f06809c40f983f5df4db7cfe09b3ac2f0ec07eb6531725e

    • C:\Windows\SysWOW64\trhwfxawbv.exe

      Filesize

      255KB

      MD5

      d3d5c901c498b81487597a27236e3be4

      SHA1

      91fd9a57a88e9b1687d06f8c6b0a8f5963c9c97b

      SHA256

      850164962ec7ac3263fc2d01f957f5d527e5c3d43a0e52babf781f96fc1288c5

      SHA512

      a848679d64d8cedc55fbbd4a942c18e1151132671459d39b5922a27c630d3011a95d2aa57b9ef8b60f06809c40f983f5df4db7cfe09b3ac2f0ec07eb6531725e

    • C:\Windows\SysWOW64\vozdcdifynpetqo.exe

      Filesize

      255KB

      MD5

      0a2befbff90d167ccf2159b4f124f62a

      SHA1

      e206b671a975a609cd4d540f31dfc18dc528ddac

      SHA256

      18247e1999fe5e4034109618de89bb3def33d6e8930cf27d08268c04aa8dd8e1

      SHA512

      22a477acbf61119eb3f740aaf620570e7a789d7114e3a28683fffb68086e9337ab926bca36a28eccd0c83400482342ab13a36388fc1f161053fb350655d5acc5

    • C:\Windows\SysWOW64\vozdcdifynpetqo.exe

      Filesize

      255KB

      MD5

      0a2befbff90d167ccf2159b4f124f62a

      SHA1

      e206b671a975a609cd4d540f31dfc18dc528ddac

      SHA256

      18247e1999fe5e4034109618de89bb3def33d6e8930cf27d08268c04aa8dd8e1

      SHA512

      22a477acbf61119eb3f740aaf620570e7a789d7114e3a28683fffb68086e9337ab926bca36a28eccd0c83400482342ab13a36388fc1f161053fb350655d5acc5

    • C:\Windows\mydoc.rtf

      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

    • \Windows\SysWOW64\cjyvphab.exe

      Filesize

      255KB

      MD5

      167b735e1b45bcc049df3098218262cb

      SHA1

      43bf45d1fe52904ba515a5fea8269bd3cd308e18

      SHA256

      b2c1b95eb7c7cc1c55be4d1e1d04855dc1a2c9e309083a373320f25fd2ff6c6a

      SHA512

      498eae782dd2a34537fa53ab0672cf055bf02764c16c8a1c6696512479a5075e7c3d972fa298c5a1195e0cf38b7919a3cd1a1f5b582f8a8ad6aab93dfa39d8e0

    • \Windows\SysWOW64\cjyvphab.exe

      Filesize

      255KB

      MD5

      167b735e1b45bcc049df3098218262cb

      SHA1

      43bf45d1fe52904ba515a5fea8269bd3cd308e18

      SHA256

      b2c1b95eb7c7cc1c55be4d1e1d04855dc1a2c9e309083a373320f25fd2ff6c6a

      SHA512

      498eae782dd2a34537fa53ab0672cf055bf02764c16c8a1c6696512479a5075e7c3d972fa298c5a1195e0cf38b7919a3cd1a1f5b582f8a8ad6aab93dfa39d8e0

    • \Windows\SysWOW64\dqweumtibjkjt.exe

      Filesize

      255KB

      MD5

      0f8d703fa2a1f1fed255438095bb8de5

      SHA1

      6ef9f0fe1804654530f7b3b3e0d6407c6ed48092

      SHA256

      5f486a2b6fc7331e531827cdc2848f540710c16a5211131d6972cafcc5941981

      SHA512

      1d3052dd106a7f35353a6b91adac50117fdac4a3336d34d0bb772592a9ae0d16f7a5106fe2a6c0ccc13f0be2c09ac667877837dd914df6b4e047cb9c44bba4e6

    • \Windows\SysWOW64\dqweumtibjkjt.exe

      Filesize

      255KB

      MD5

      0f8d703fa2a1f1fed255438095bb8de5

      SHA1

      6ef9f0fe1804654530f7b3b3e0d6407c6ed48092

      SHA256

      5f486a2b6fc7331e531827cdc2848f540710c16a5211131d6972cafcc5941981

      SHA512

      1d3052dd106a7f35353a6b91adac50117fdac4a3336d34d0bb772592a9ae0d16f7a5106fe2a6c0ccc13f0be2c09ac667877837dd914df6b4e047cb9c44bba4e6

    • \Windows\SysWOW64\trhwfxawbv.exe

      Filesize

      255KB

      MD5

      d3d5c901c498b81487597a27236e3be4

      SHA1

      91fd9a57a88e9b1687d06f8c6b0a8f5963c9c97b

      SHA256

      850164962ec7ac3263fc2d01f957f5d527e5c3d43a0e52babf781f96fc1288c5

      SHA512

      a848679d64d8cedc55fbbd4a942c18e1151132671459d39b5922a27c630d3011a95d2aa57b9ef8b60f06809c40f983f5df4db7cfe09b3ac2f0ec07eb6531725e

    • \Windows\SysWOW64\vozdcdifynpetqo.exe

      Filesize

      255KB

      MD5

      0a2befbff90d167ccf2159b4f124f62a

      SHA1

      e206b671a975a609cd4d540f31dfc18dc528ddac

      SHA256

      18247e1999fe5e4034109618de89bb3def33d6e8930cf27d08268c04aa8dd8e1

      SHA512

      22a477acbf61119eb3f740aaf620570e7a789d7114e3a28683fffb68086e9337ab926bca36a28eccd0c83400482342ab13a36388fc1f161053fb350655d5acc5

    • memory/580-85-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/580-103-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/596-84-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/596-102-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/876-82-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/876-101-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/960-83-0x0000000002FB0000-0x0000000003050000-memory.dmp

      Filesize

      640KB

    • memory/960-56-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/960-94-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/960-55-0x00000000753D1000-0x00000000753D3000-memory.dmp

      Filesize

      8KB

    • memory/960-54-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/964-87-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/964-105-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1148-109-0x000007FEFBBA1000-0x000007FEFBBA3000-memory.dmp

      Filesize

      8KB

    • memory/1284-106-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1284-93-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1648-100-0x00000000710FD000-0x0000000071108000-memory.dmp

      Filesize

      44KB

    • memory/1648-97-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1648-96-0x0000000070111000-0x0000000070113000-memory.dmp

      Filesize

      8KB

    • memory/1648-107-0x00000000710FD000-0x0000000071108000-memory.dmp

      Filesize

      44KB

    • memory/1648-95-0x0000000072691000-0x0000000072694000-memory.dmp

      Filesize

      12KB

    • memory/1804-104-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1804-86-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB