Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    45s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    29/11/2022, 06:06

General

  • Target

    dc34d655d95547a4e9a6eeac16a492a79b5030a0068edcefca879000afc6b011.exe

  • Size

    255KB

  • MD5

    2c72f5a0b43dd9ef308615989bb1956d

  • SHA1

    d677181fb9c4d56ebcfac7549844eed2be1d8f69

  • SHA256

    dc34d655d95547a4e9a6eeac16a492a79b5030a0068edcefca879000afc6b011

  • SHA512

    9765a6d906ffe76fa483002f386ba722b2de77e91ab16be02fe7dec10e765358b0b90e43cae0af14683e4c9974eceaf54785328409bc9253d14aa6b1571ca4a5

  • SSDEEP

    6144:1xlZam+akqx6YQJXcNlEHUIQeE3mmBI6b:Plf5j6zCNa0xeE3mW

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 5 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Executes dropped EXE 5 IoCs
  • UPX packed file 29 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 6 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
  • AutoIT Executable 12 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dc34d655d95547a4e9a6eeac16a492a79b5030a0068edcefca879000afc6b011.exe
    "C:\Users\Admin\AppData\Local\Temp\dc34d655d95547a4e9a6eeac16a492a79b5030a0068edcefca879000afc6b011.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1776
    • C:\Windows\SysWOW64\didispkovs.exe
      didispkovs.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1740
      • C:\Windows\SysWOW64\nthepejy.exe
        C:\Windows\system32\nthepejy.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:784
    • C:\Windows\SysWOW64\uqjnyzbpaxbckcc.exe
      uqjnyzbpaxbckcc.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1564
    • C:\Windows\SysWOW64\nthepejy.exe
      nthepejy.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1488
    • C:\Windows\SysWOW64\gsocchdnudain.exe
      gsocchdnudain.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1336
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:272
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:892

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe

      Filesize

      255KB

      MD5

      551fd5246dd37f01d64bf474f1556134

      SHA1

      82e27153815bdc43f1a9d897701a731accc1f4bb

      SHA256

      c1eebf410fbada6e086ec65e6e45c61e2432efb64bddfb50927571a73ebde3e2

      SHA512

      de619cac3bf0a21790ecabc49d34169be8dd872d750e5c0e9dce7557bac57f636362d37f79bce69be81a2250f11483d709b2a171991d3feda1cac425a2872ae1

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe

      Filesize

      255KB

      MD5

      38f83b2515fa8f2b1a964ac3a118dd23

      SHA1

      9d22366f569dd49482f0d90df2856ff24ae0cd13

      SHA256

      ecf67b58ffdf29b4171a950e72d6f25ef7a9293400d119fd7a6415b59257cd77

      SHA512

      2a1d8c0a7dc2ebc0bf67c8b4e51bf0eb44fa0ae2ed0e39fb15e8aa130a17d3f964697ae13be0ad89e806575b5c0e72179254be9120a1117a8bd9ac78d0844dbc

    • C:\Users\Admin\Documents\InvokeUninstall.doc.exe

      Filesize

      255KB

      MD5

      baf2af9c83bc509394aacadf537d682b

      SHA1

      fee4562c6c2b91eb8b2ff2057e34675dfeb36ada

      SHA256

      1e84745608b0f1800186400cec46ac0ac6d18ff181a21df960649824ad7e3e3e

      SHA512

      1a9c14a9253d46c463f50fcdc2c86b3f98155f359c8f43ec1538cf0ec91c9162e7378c75607a544490e6a26065947dc22230e73c3676d553489d0b5660850b4c

    • C:\Windows\SysWOW64\didispkovs.exe

      Filesize

      255KB

      MD5

      c21a559a71c49146ea10004724b20323

      SHA1

      4c2cc95ccaa99717e870d308a3d2ac5be9e8e754

      SHA256

      955e90316001f022654a24716fa8c19932c28b877ca5df30a3405120a96659a1

      SHA512

      82ff6eb31bc1fefcd79ab78fd904da4ee78dd98c6d1b79f774b0f3d12c04029ce92a1d0c6184d233c2c0996c1c85220c831583328ef8dac969f8b0e09d1a90ef

    • C:\Windows\SysWOW64\didispkovs.exe

      Filesize

      255KB

      MD5

      c21a559a71c49146ea10004724b20323

      SHA1

      4c2cc95ccaa99717e870d308a3d2ac5be9e8e754

      SHA256

      955e90316001f022654a24716fa8c19932c28b877ca5df30a3405120a96659a1

      SHA512

      82ff6eb31bc1fefcd79ab78fd904da4ee78dd98c6d1b79f774b0f3d12c04029ce92a1d0c6184d233c2c0996c1c85220c831583328ef8dac969f8b0e09d1a90ef

    • C:\Windows\SysWOW64\gsocchdnudain.exe

      Filesize

      255KB

      MD5

      557f50573dd60470e11e237c0e1f1b47

      SHA1

      45ba891a06f7807bb13c415607a49b26d46f71fb

      SHA256

      cc2a946916ff6533603bcbf908c903a2922b55cacf72b2bbc004f6e8d5d77026

      SHA512

      3339833d6b070b0417329ad912aa28ee2c52b41eba1de2ee19dec6d774c9a019e10e8bcdcaa23c6cf86882fa2a0e7c0590c83c67301683b50876ec69636dacbc

    • C:\Windows\SysWOW64\gsocchdnudain.exe

      Filesize

      255KB

      MD5

      557f50573dd60470e11e237c0e1f1b47

      SHA1

      45ba891a06f7807bb13c415607a49b26d46f71fb

      SHA256

      cc2a946916ff6533603bcbf908c903a2922b55cacf72b2bbc004f6e8d5d77026

      SHA512

      3339833d6b070b0417329ad912aa28ee2c52b41eba1de2ee19dec6d774c9a019e10e8bcdcaa23c6cf86882fa2a0e7c0590c83c67301683b50876ec69636dacbc

    • C:\Windows\SysWOW64\nthepejy.exe

      Filesize

      255KB

      MD5

      e879ff34b0f05fecb4b0f5844e4babba

      SHA1

      a1a88091192440cd82ff6e9a508118badd056930

      SHA256

      c65d5aa93496d295509dc7302322d8f57daaaeef01c68cec6e03aaa9648edfbc

      SHA512

      799cc22db48237a0c5403dd45a6f7d7d0f1a85e964b7ff58024bc4a6da81f5ea029785c1765eab03b2f6134fbb787a85757fcd0298e2b89953ddbcba170d33d5

    • C:\Windows\SysWOW64\nthepejy.exe

      Filesize

      255KB

      MD5

      e879ff34b0f05fecb4b0f5844e4babba

      SHA1

      a1a88091192440cd82ff6e9a508118badd056930

      SHA256

      c65d5aa93496d295509dc7302322d8f57daaaeef01c68cec6e03aaa9648edfbc

      SHA512

      799cc22db48237a0c5403dd45a6f7d7d0f1a85e964b7ff58024bc4a6da81f5ea029785c1765eab03b2f6134fbb787a85757fcd0298e2b89953ddbcba170d33d5

    • C:\Windows\SysWOW64\nthepejy.exe

      Filesize

      255KB

      MD5

      e879ff34b0f05fecb4b0f5844e4babba

      SHA1

      a1a88091192440cd82ff6e9a508118badd056930

      SHA256

      c65d5aa93496d295509dc7302322d8f57daaaeef01c68cec6e03aaa9648edfbc

      SHA512

      799cc22db48237a0c5403dd45a6f7d7d0f1a85e964b7ff58024bc4a6da81f5ea029785c1765eab03b2f6134fbb787a85757fcd0298e2b89953ddbcba170d33d5

    • C:\Windows\SysWOW64\uqjnyzbpaxbckcc.exe

      Filesize

      255KB

      MD5

      e17e2bf20ce8a07125df64fc688fd5cb

      SHA1

      a116ee90d7829ef5a656aaf24b52350d3f7434ec

      SHA256

      e984c1514f2723035848d1b8b8cc9ee937cd63284aa48cf387a0e82137d55a19

      SHA512

      c2bebe23b3ff5e946083b48303e05190ceb3d8c8923db37e8fd7af2d1cff7c7485fa28c267e4b7993f5b4ec85609d17d2651861bab37ddbe9978136fec47fd73

    • C:\Windows\SysWOW64\uqjnyzbpaxbckcc.exe

      Filesize

      255KB

      MD5

      e17e2bf20ce8a07125df64fc688fd5cb

      SHA1

      a116ee90d7829ef5a656aaf24b52350d3f7434ec

      SHA256

      e984c1514f2723035848d1b8b8cc9ee937cd63284aa48cf387a0e82137d55a19

      SHA512

      c2bebe23b3ff5e946083b48303e05190ceb3d8c8923db37e8fd7af2d1cff7c7485fa28c267e4b7993f5b4ec85609d17d2651861bab37ddbe9978136fec47fd73

    • C:\Windows\mydoc.rtf

      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

    • \Windows\SysWOW64\didispkovs.exe

      Filesize

      255KB

      MD5

      c21a559a71c49146ea10004724b20323

      SHA1

      4c2cc95ccaa99717e870d308a3d2ac5be9e8e754

      SHA256

      955e90316001f022654a24716fa8c19932c28b877ca5df30a3405120a96659a1

      SHA512

      82ff6eb31bc1fefcd79ab78fd904da4ee78dd98c6d1b79f774b0f3d12c04029ce92a1d0c6184d233c2c0996c1c85220c831583328ef8dac969f8b0e09d1a90ef

    • \Windows\SysWOW64\gsocchdnudain.exe

      Filesize

      255KB

      MD5

      557f50573dd60470e11e237c0e1f1b47

      SHA1

      45ba891a06f7807bb13c415607a49b26d46f71fb

      SHA256

      cc2a946916ff6533603bcbf908c903a2922b55cacf72b2bbc004f6e8d5d77026

      SHA512

      3339833d6b070b0417329ad912aa28ee2c52b41eba1de2ee19dec6d774c9a019e10e8bcdcaa23c6cf86882fa2a0e7c0590c83c67301683b50876ec69636dacbc

    • \Windows\SysWOW64\nthepejy.exe

      Filesize

      255KB

      MD5

      e879ff34b0f05fecb4b0f5844e4babba

      SHA1

      a1a88091192440cd82ff6e9a508118badd056930

      SHA256

      c65d5aa93496d295509dc7302322d8f57daaaeef01c68cec6e03aaa9648edfbc

      SHA512

      799cc22db48237a0c5403dd45a6f7d7d0f1a85e964b7ff58024bc4a6da81f5ea029785c1765eab03b2f6134fbb787a85757fcd0298e2b89953ddbcba170d33d5

    • \Windows\SysWOW64\nthepejy.exe

      Filesize

      255KB

      MD5

      e879ff34b0f05fecb4b0f5844e4babba

      SHA1

      a1a88091192440cd82ff6e9a508118badd056930

      SHA256

      c65d5aa93496d295509dc7302322d8f57daaaeef01c68cec6e03aaa9648edfbc

      SHA512

      799cc22db48237a0c5403dd45a6f7d7d0f1a85e964b7ff58024bc4a6da81f5ea029785c1765eab03b2f6134fbb787a85757fcd0298e2b89953ddbcba170d33d5

    • \Windows\SysWOW64\uqjnyzbpaxbckcc.exe

      Filesize

      255KB

      MD5

      e17e2bf20ce8a07125df64fc688fd5cb

      SHA1

      a116ee90d7829ef5a656aaf24b52350d3f7434ec

      SHA256

      e984c1514f2723035848d1b8b8cc9ee937cd63284aa48cf387a0e82137d55a19

      SHA512

      c2bebe23b3ff5e946083b48303e05190ceb3d8c8923db37e8fd7af2d1cff7c7485fa28c267e4b7993f5b4ec85609d17d2651861bab37ddbe9978136fec47fd73

    • memory/272-90-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/272-106-0x0000000070FDD000-0x0000000070FE8000-memory.dmp

      Filesize

      44KB

    • memory/272-105-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/272-99-0x0000000070FDD000-0x0000000070FE8000-memory.dmp

      Filesize

      44KB

    • memory/272-92-0x0000000070FDD000-0x0000000070FE8000-memory.dmp

      Filesize

      44KB

    • memory/272-89-0x000000006FFF1000-0x000000006FFF3000-memory.dmp

      Filesize

      8KB

    • memory/272-87-0x0000000072571000-0x0000000072574000-memory.dmp

      Filesize

      12KB

    • memory/784-88-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/784-98-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/892-101-0x000007FEFBA81000-0x000007FEFBA83000-memory.dmp

      Filesize

      8KB

    • memory/1336-80-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1336-97-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1488-79-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1488-96-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1564-95-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1564-78-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1740-94-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1740-77-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1776-75-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1776-76-0x0000000002E50000-0x0000000002EF0000-memory.dmp

      Filesize

      640KB

    • memory/1776-86-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1776-54-0x0000000075521000-0x0000000075523000-memory.dmp

      Filesize

      8KB