Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    152s
  • max time network
    33s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    29/11/2022, 06:05

General

  • Target

    feb46b7a9db8e5dba46df813eab4328f07d19c9922b352aab4e9fac1e88c0301.exe

  • Size

    255KB

  • MD5

    c883f057fd44e432933630bfa7b16787

  • SHA1

    ebc8944e4b1ca122c8bfaa0d178707675083acb8

  • SHA256

    feb46b7a9db8e5dba46df813eab4328f07d19c9922b352aab4e9fac1e88c0301

  • SHA512

    981d9316665087e3f903c58565be5ba3464de5844355d8f8b068665942219a2ee78a48ff1f419f36a75c83edbba7f4d90da29c91fd24e94c9a1311905a1ec42a

  • SSDEEP

    3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJz:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIw

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 5 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Executes dropped EXE 6 IoCs
  • UPX packed file 36 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 6 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
  • AutoIT Executable 14 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 21 IoCs
  • Suspicious use of SendNotifyMessage 21 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\feb46b7a9db8e5dba46df813eab4328f07d19c9922b352aab4e9fac1e88c0301.exe
    "C:\Users\Admin\AppData\Local\Temp\feb46b7a9db8e5dba46df813eab4328f07d19c9922b352aab4e9fac1e88c0301.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1992
    • C:\Windows\SysWOW64\fjjgvavkht.exe
      fjjgvavkht.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1056
      • C:\Windows\SysWOW64\pvbowpqt.exe
        C:\Windows\system32\pvbowpqt.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1572
    • C:\Windows\SysWOW64\xhrrcylothuvpaw.exe
      xhrrcylothuvpaw.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1176
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c cctlcrjxbtsgh.exe
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1276
        • C:\Windows\SysWOW64\cctlcrjxbtsgh.exe
          cctlcrjxbtsgh.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:552
    • C:\Windows\SysWOW64\pvbowpqt.exe
      pvbowpqt.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1240
    • C:\Windows\SysWOW64\cctlcrjxbtsgh.exe
      cctlcrjxbtsgh.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:664
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1624
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:1816

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe

      Filesize

      255KB

      MD5

      cc6b9e3dc2d514ca938bc79b0cf9c92c

      SHA1

      6219c96c1aed08af577f494b0dce5612bb337a83

      SHA256

      55b3bacdc6d167665154b25baba1a3d8942f67251d61407f7d10812d83781b02

      SHA512

      08cf36d880e7c8926319b0e53d21465ca2f8a56df82a9098a5daf5aeae9c5c60fbcdac298a9b91ae12a31081536e558c5dde2f07e70b06dacb2ae04d41f8a83a

    • C:\Users\Admin\AppData\Roaming\MoveResolve.doc.exe

      Filesize

      255KB

      MD5

      b52e64b8c6abf202a1d2f1449b9b35e2

      SHA1

      d61ba6f3f163a60cf11bfaa7b1534b64692aa271

      SHA256

      1f73494fd181af678d80c7a941b8c766f90df638704bce23b8fdffd17c1e250c

      SHA512

      e4f28ce39ffbc4c8b283ff52af1ba3a4ad77e89c60956c8adb37af8bd0b723ddee6762bdfa305a6fab9b91f6246c3ddacf483c322513ee210af5d4c917be0029

    • C:\Users\Admin\Desktop\FindMount.doc.exe

      Filesize

      255KB

      MD5

      eec1f44976ed9aa2126d483a996126bf

      SHA1

      72a31e1069dc99d4c454a7e9699de29fa3b90b69

      SHA256

      4a1ec7a377e76f72662e7675bc0b0ae1a9c8b824618fa39bbad3b5015c1c5a3f

      SHA512

      76a13b02a59be676b77ace715de9bbbb1fe8886c21f795334e0a12d90833cc22f64dceb2b5adbad31401e4d8fb7ac295b27dab64b7d68d8e48d045bf50cbdebe

    • C:\Users\Admin\Documents\DenyAssert.doc.exe

      Filesize

      255KB

      MD5

      4e60af5a4b8dda7910e8446b203a10c3

      SHA1

      f25d0cd83eaaab68c88b0dcf7965580b9868d907

      SHA256

      7975ff8e7ab5d2218603ef70bd8f0b20c5bc97b88141650bcdba2707f413b881

      SHA512

      44a124ec12a9e0089b008972af4641f2dd926937796c9692dead74a85c112ef3fd7716cac2b2a907cbfa5401d5274262319ee1056dc768f8326875b5d97c1787

    • C:\Users\Admin\Music\RestartGrant.doc.exe

      Filesize

      255KB

      MD5

      bf9a076f69cf8836522f1c15e5ad6f53

      SHA1

      f326e7427544340f663ce99b866484f844dac0ca

      SHA256

      dda3b1faa6e04e25827f4ea88d4fb73e166e72f89310a8724a25e67c3d4fb03c

      SHA512

      cc17640e10089b84255e157466cfda43d641dafd8fd708e21c8598c430d52ff0ba8846776ec70d444b1b43e802576870f8c4c4f20e443446451de80272776865

    • C:\Windows\SysWOW64\cctlcrjxbtsgh.exe

      Filesize

      255KB

      MD5

      fed85d4d0fa276d6d2882cbbfa875e4a

      SHA1

      e320a17a78936054e2dfe682303f636c4b5eb60e

      SHA256

      79508caa7e7f506c6123395a316b9c43fd5bb0f08e48b159a4388bce7288679e

      SHA512

      fde21255dd93a6fba4afa1a1b8b50aa7981d2fcb4e52d648fbc19ca7ddb2a3488050f5e618e4af91bb94d876b576ee182809bdc321edd199d257a558288118de

    • C:\Windows\SysWOW64\cctlcrjxbtsgh.exe

      Filesize

      255KB

      MD5

      fed85d4d0fa276d6d2882cbbfa875e4a

      SHA1

      e320a17a78936054e2dfe682303f636c4b5eb60e

      SHA256

      79508caa7e7f506c6123395a316b9c43fd5bb0f08e48b159a4388bce7288679e

      SHA512

      fde21255dd93a6fba4afa1a1b8b50aa7981d2fcb4e52d648fbc19ca7ddb2a3488050f5e618e4af91bb94d876b576ee182809bdc321edd199d257a558288118de

    • C:\Windows\SysWOW64\cctlcrjxbtsgh.exe

      Filesize

      255KB

      MD5

      fed85d4d0fa276d6d2882cbbfa875e4a

      SHA1

      e320a17a78936054e2dfe682303f636c4b5eb60e

      SHA256

      79508caa7e7f506c6123395a316b9c43fd5bb0f08e48b159a4388bce7288679e

      SHA512

      fde21255dd93a6fba4afa1a1b8b50aa7981d2fcb4e52d648fbc19ca7ddb2a3488050f5e618e4af91bb94d876b576ee182809bdc321edd199d257a558288118de

    • C:\Windows\SysWOW64\fjjgvavkht.exe

      Filesize

      255KB

      MD5

      ce3d3a2ea8bd5d6471fddf159ea2d2da

      SHA1

      b50d6dad449c08eea0790e39d3a2e421e70e3a22

      SHA256

      81d18c0f5168f8521eb8f5b9508ae0928283fd82819df61618d569d043f5cc80

      SHA512

      80d3d8cb06bebd67e25e20cb1a32cfa6c55f9962976ed96d556e42593f2808af6b139b0ab832eda192b2c424aa2886d6f1cc5ec2b8248849d8af53880042812d

    • C:\Windows\SysWOW64\fjjgvavkht.exe

      Filesize

      255KB

      MD5

      ce3d3a2ea8bd5d6471fddf159ea2d2da

      SHA1

      b50d6dad449c08eea0790e39d3a2e421e70e3a22

      SHA256

      81d18c0f5168f8521eb8f5b9508ae0928283fd82819df61618d569d043f5cc80

      SHA512

      80d3d8cb06bebd67e25e20cb1a32cfa6c55f9962976ed96d556e42593f2808af6b139b0ab832eda192b2c424aa2886d6f1cc5ec2b8248849d8af53880042812d

    • C:\Windows\SysWOW64\pvbowpqt.exe

      Filesize

      255KB

      MD5

      5d7b1ad5fd0f13ea91ff1e4a1bfb4e2e

      SHA1

      3ffdb3884fc3654682c7bd5d44deb74161969bcc

      SHA256

      e6e7aa8a285998593deb544e517ec5ee70bb885a64e2e2c0139892694aaf38e1

      SHA512

      5beacf8d3c5225772e5e9b99eac6555345ce5217711f67ed45262d7c3e3cc554adf23d719e93e4ca6b2909a4b5516184570addcc8edb83c52495914fe0a35ef8

    • C:\Windows\SysWOW64\pvbowpqt.exe

      Filesize

      255KB

      MD5

      5d7b1ad5fd0f13ea91ff1e4a1bfb4e2e

      SHA1

      3ffdb3884fc3654682c7bd5d44deb74161969bcc

      SHA256

      e6e7aa8a285998593deb544e517ec5ee70bb885a64e2e2c0139892694aaf38e1

      SHA512

      5beacf8d3c5225772e5e9b99eac6555345ce5217711f67ed45262d7c3e3cc554adf23d719e93e4ca6b2909a4b5516184570addcc8edb83c52495914fe0a35ef8

    • C:\Windows\SysWOW64\pvbowpqt.exe

      Filesize

      255KB

      MD5

      5d7b1ad5fd0f13ea91ff1e4a1bfb4e2e

      SHA1

      3ffdb3884fc3654682c7bd5d44deb74161969bcc

      SHA256

      e6e7aa8a285998593deb544e517ec5ee70bb885a64e2e2c0139892694aaf38e1

      SHA512

      5beacf8d3c5225772e5e9b99eac6555345ce5217711f67ed45262d7c3e3cc554adf23d719e93e4ca6b2909a4b5516184570addcc8edb83c52495914fe0a35ef8

    • C:\Windows\SysWOW64\xhrrcylothuvpaw.exe

      Filesize

      255KB

      MD5

      5f77820edf7c518b6ef7377e062c1271

      SHA1

      8dc96cd573321834800aeef8ee4fabd5f0f1eeec

      SHA256

      adeeb8f7dd1ee73ea8c91153f1c1d9112823c8da1dbae9b2ff84f1af27563cf3

      SHA512

      04af61c5fb09fd712291e30e95a17e39a778d54d7740e4423fa7a739e19ff57a6956c4e89fcd26cf18cb55c3ff82c8436254d9afd9962b1bc359919f7841d721

    • C:\Windows\SysWOW64\xhrrcylothuvpaw.exe

      Filesize

      255KB

      MD5

      5f77820edf7c518b6ef7377e062c1271

      SHA1

      8dc96cd573321834800aeef8ee4fabd5f0f1eeec

      SHA256

      adeeb8f7dd1ee73ea8c91153f1c1d9112823c8da1dbae9b2ff84f1af27563cf3

      SHA512

      04af61c5fb09fd712291e30e95a17e39a778d54d7740e4423fa7a739e19ff57a6956c4e89fcd26cf18cb55c3ff82c8436254d9afd9962b1bc359919f7841d721

    • C:\Windows\mydoc.rtf

      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

    • \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe

      Filesize

      255KB

      MD5

      04e21ad76f3f2b82b11993607f41868a

      SHA1

      f78ad6ec55ac81e84a2c7a2c372cf6a53b096586

      SHA256

      603a3298523daad6595773fe9269094e98b8da00629955cad80021c1281a1118

      SHA512

      65e4a512c317bbc20429e2c0481690fce9664b2456c7d74b7a9851010e740f2b9d0ef07f46a940f62dc27a2e968a4426caa48d91171c2afaa024a001d096528e

    • \Windows\SysWOW64\cctlcrjxbtsgh.exe

      Filesize

      255KB

      MD5

      fed85d4d0fa276d6d2882cbbfa875e4a

      SHA1

      e320a17a78936054e2dfe682303f636c4b5eb60e

      SHA256

      79508caa7e7f506c6123395a316b9c43fd5bb0f08e48b159a4388bce7288679e

      SHA512

      fde21255dd93a6fba4afa1a1b8b50aa7981d2fcb4e52d648fbc19ca7ddb2a3488050f5e618e4af91bb94d876b576ee182809bdc321edd199d257a558288118de

    • \Windows\SysWOW64\cctlcrjxbtsgh.exe

      Filesize

      255KB

      MD5

      fed85d4d0fa276d6d2882cbbfa875e4a

      SHA1

      e320a17a78936054e2dfe682303f636c4b5eb60e

      SHA256

      79508caa7e7f506c6123395a316b9c43fd5bb0f08e48b159a4388bce7288679e

      SHA512

      fde21255dd93a6fba4afa1a1b8b50aa7981d2fcb4e52d648fbc19ca7ddb2a3488050f5e618e4af91bb94d876b576ee182809bdc321edd199d257a558288118de

    • \Windows\SysWOW64\fjjgvavkht.exe

      Filesize

      255KB

      MD5

      ce3d3a2ea8bd5d6471fddf159ea2d2da

      SHA1

      b50d6dad449c08eea0790e39d3a2e421e70e3a22

      SHA256

      81d18c0f5168f8521eb8f5b9508ae0928283fd82819df61618d569d043f5cc80

      SHA512

      80d3d8cb06bebd67e25e20cb1a32cfa6c55f9962976ed96d556e42593f2808af6b139b0ab832eda192b2c424aa2886d6f1cc5ec2b8248849d8af53880042812d

    • \Windows\SysWOW64\pvbowpqt.exe

      Filesize

      255KB

      MD5

      5d7b1ad5fd0f13ea91ff1e4a1bfb4e2e

      SHA1

      3ffdb3884fc3654682c7bd5d44deb74161969bcc

      SHA256

      e6e7aa8a285998593deb544e517ec5ee70bb885a64e2e2c0139892694aaf38e1

      SHA512

      5beacf8d3c5225772e5e9b99eac6555345ce5217711f67ed45262d7c3e3cc554adf23d719e93e4ca6b2909a4b5516184570addcc8edb83c52495914fe0a35ef8

    • \Windows\SysWOW64\pvbowpqt.exe

      Filesize

      255KB

      MD5

      5d7b1ad5fd0f13ea91ff1e4a1bfb4e2e

      SHA1

      3ffdb3884fc3654682c7bd5d44deb74161969bcc

      SHA256

      e6e7aa8a285998593deb544e517ec5ee70bb885a64e2e2c0139892694aaf38e1

      SHA512

      5beacf8d3c5225772e5e9b99eac6555345ce5217711f67ed45262d7c3e3cc554adf23d719e93e4ca6b2909a4b5516184570addcc8edb83c52495914fe0a35ef8

    • \Windows\SysWOW64\xhrrcylothuvpaw.exe

      Filesize

      255KB

      MD5

      5f77820edf7c518b6ef7377e062c1271

      SHA1

      8dc96cd573321834800aeef8ee4fabd5f0f1eeec

      SHA256

      adeeb8f7dd1ee73ea8c91153f1c1d9112823c8da1dbae9b2ff84f1af27563cf3

      SHA512

      04af61c5fb09fd712291e30e95a17e39a778d54d7740e4423fa7a739e19ff57a6956c4e89fcd26cf18cb55c3ff82c8436254d9afd9962b1bc359919f7841d721

    • memory/552-90-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/552-100-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/664-99-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/664-89-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1056-96-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1056-85-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1176-87-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1176-97-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1240-98-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1240-88-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1572-101-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1572-91-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1624-104-0x0000000071A3D000-0x0000000071A48000-memory.dmp

      Filesize

      44KB

    • memory/1624-102-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1624-94-0x0000000072FD1000-0x0000000072FD4000-memory.dmp

      Filesize

      12KB

    • memory/1624-95-0x0000000070A51000-0x0000000070A53000-memory.dmp

      Filesize

      8KB

    • memory/1624-114-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1624-115-0x0000000071A3D000-0x0000000071A48000-memory.dmp

      Filesize

      44KB

    • memory/1816-107-0x000007FEFC4E1000-0x000007FEFC4E3000-memory.dmp

      Filesize

      8KB

    • memory/1992-93-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1992-54-0x0000000076411000-0x0000000076413000-memory.dmp

      Filesize

      8KB

    • memory/1992-86-0x0000000002F00000-0x0000000002FA0000-memory.dmp

      Filesize

      640KB

    • memory/1992-55-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB