Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    178s
  • max time network
    195s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/11/2022, 06:12

General

  • Target

    2a14da1cc4b47e0ccfb5bcedf38d4a6bc941fa3e81c59b5058ba7a0048f3c698.exe

  • Size

    255KB

  • MD5

    2f9697108175f2c6563dcedea7bf616f

  • SHA1

    a0fd9fe22ccf08ff659821df2870ef8525b6e294

  • SHA256

    2a14da1cc4b47e0ccfb5bcedf38d4a6bc941fa3e81c59b5058ba7a0048f3c698

  • SHA512

    218374059aa96121c7df0ebcd04ed97e7946564359b6ef9e9c693d7261c987fcff89ad3507786e0f872a86f9384f6ddcb836315be189f9ad6c888f3c646021d9

  • SSDEEP

    6144:1xlZam+akqx6YQJXcNlEHUIQeE3mmBI6+:Plf5j6zCNa0xeE3mx

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 5 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Executes dropped EXE 5 IoCs
  • UPX packed file 24 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Windows security modification 2 TTPs 6 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
  • AutoIT Executable 11 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2a14da1cc4b47e0ccfb5bcedf38d4a6bc941fa3e81c59b5058ba7a0048f3c698.exe
    "C:\Users\Admin\AppData\Local\Temp\2a14da1cc4b47e0ccfb5bcedf38d4a6bc941fa3e81c59b5058ba7a0048f3c698.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1404
    • C:\Windows\SysWOW64\riripoypiv.exe
      riripoypiv.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:5044
      • C:\Windows\SysWOW64\jgepdelg.exe
        C:\Windows\system32\jgepdelg.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1652
    • C:\Windows\SysWOW64\qaalrrcgeliockd.exe
      qaalrrcgeliockd.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4480
    • C:\Windows\SysWOW64\jgepdelg.exe
      jgepdelg.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:5028
    • C:\Windows\SysWOW64\cqegloqpvfgdp.exe
      cqegloqpvfgdp.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3720
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:800

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe

    Filesize

    255KB

    MD5

    b77252a35ce75b1678c38c2657051ea2

    SHA1

    2d6169009b4155c72f962f1b4ca57c74d6fee015

    SHA256

    74ca6b47d852cbbeed240ffbbd08ad4defd1a8101ab8fa221b08ce7432041dce

    SHA512

    7d1245cd50a7881425faa577394faa6a61eeb67da687900b89c3a179f493ad9cf117ffd4b9560b96a2a8c0d4860e2971de93e76833d27b8c73b1917e7f8a29a8

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe

    Filesize

    255KB

    MD5

    c0d58fc3af8505a4e63f39ea96f37ad5

    SHA1

    fc43a72001bcdf36c68b0649092e26563b86c370

    SHA256

    7e269513753b5f6b45a07dd3d002fef2f979a997d0899b3f087a1cc7f1fb2a2b

    SHA512

    2314f796f6d0992362db05dae5428e5c1dcaeffbb86d083851718afadb7c724361ec28c67d207ff55f5f956a36820c1e5cd23ab1fa4e4eaca7cb12ef62a826c5

  • C:\Windows\SysWOW64\cqegloqpvfgdp.exe

    Filesize

    255KB

    MD5

    1b90fba67e0ad333535e1abd58e74a1b

    SHA1

    183b6f855e9ce64bcf548c90ca4d08e239d45c97

    SHA256

    369e4a7143308ed3f06a6e7a125eacc353de5093a870ee7f03ee36fdfbf27793

    SHA512

    96756d5c54d4bce1f4405c155769cba6269e1592b044cd770933844de016ab28b958c52d70466a77f2affbdbd6f1ba9b7dc85e4d6fb744793a9c7b81f2f6fb98

  • C:\Windows\SysWOW64\cqegloqpvfgdp.exe

    Filesize

    255KB

    MD5

    1b90fba67e0ad333535e1abd58e74a1b

    SHA1

    183b6f855e9ce64bcf548c90ca4d08e239d45c97

    SHA256

    369e4a7143308ed3f06a6e7a125eacc353de5093a870ee7f03ee36fdfbf27793

    SHA512

    96756d5c54d4bce1f4405c155769cba6269e1592b044cd770933844de016ab28b958c52d70466a77f2affbdbd6f1ba9b7dc85e4d6fb744793a9c7b81f2f6fb98

  • C:\Windows\SysWOW64\jgepdelg.exe

    Filesize

    255KB

    MD5

    312c78e698e25d0b02d5bd879af0f4e0

    SHA1

    2a1713ca57fe736c9174e21c1048d59bea52a86a

    SHA256

    28e6375007139b6dcf6df105adddb0d9015b462384df9677f52f121d70d95538

    SHA512

    3f52911e474e474969e12a1c7e6b64bda0b8978e65dd924be8a993232c45c65a66f147b10994dc91f06e65e6dbeda9bae0e36a60f41d9ced515791ae01ee933f

  • C:\Windows\SysWOW64\jgepdelg.exe

    Filesize

    255KB

    MD5

    312c78e698e25d0b02d5bd879af0f4e0

    SHA1

    2a1713ca57fe736c9174e21c1048d59bea52a86a

    SHA256

    28e6375007139b6dcf6df105adddb0d9015b462384df9677f52f121d70d95538

    SHA512

    3f52911e474e474969e12a1c7e6b64bda0b8978e65dd924be8a993232c45c65a66f147b10994dc91f06e65e6dbeda9bae0e36a60f41d9ced515791ae01ee933f

  • C:\Windows\SysWOW64\jgepdelg.exe

    Filesize

    255KB

    MD5

    312c78e698e25d0b02d5bd879af0f4e0

    SHA1

    2a1713ca57fe736c9174e21c1048d59bea52a86a

    SHA256

    28e6375007139b6dcf6df105adddb0d9015b462384df9677f52f121d70d95538

    SHA512

    3f52911e474e474969e12a1c7e6b64bda0b8978e65dd924be8a993232c45c65a66f147b10994dc91f06e65e6dbeda9bae0e36a60f41d9ced515791ae01ee933f

  • C:\Windows\SysWOW64\qaalrrcgeliockd.exe

    Filesize

    255KB

    MD5

    dcf16550941cace159e1337e33ad8d71

    SHA1

    78fd728add7f0594e9f59cd4c4bc54d1f93ce213

    SHA256

    13314fd29df0af279256c2a4d9f57e4a82beb6cef3c2f16763eeffd456f47a8e

    SHA512

    f97b9fb35897de599a48853b5f4df199474c993f60d23687e898de31f0f114214e49521e2bce52c1d03f69ecb58b7853aa25da8158f1b3c62a743089391a76c5

  • C:\Windows\SysWOW64\qaalrrcgeliockd.exe

    Filesize

    255KB

    MD5

    dcf16550941cace159e1337e33ad8d71

    SHA1

    78fd728add7f0594e9f59cd4c4bc54d1f93ce213

    SHA256

    13314fd29df0af279256c2a4d9f57e4a82beb6cef3c2f16763eeffd456f47a8e

    SHA512

    f97b9fb35897de599a48853b5f4df199474c993f60d23687e898de31f0f114214e49521e2bce52c1d03f69ecb58b7853aa25da8158f1b3c62a743089391a76c5

  • C:\Windows\SysWOW64\riripoypiv.exe

    Filesize

    255KB

    MD5

    bcea0ccf2fde0ff47b1770eec2ed7d62

    SHA1

    eb125c211864e83c9649cf16a37a2b59b20df11e

    SHA256

    3adec395f72f20c8435f8f5997eff900a875cf5ca4ad4772063f37ba6af6282c

    SHA512

    198251867af4c781a0dee8d0fe1fa22fad6557f78facddd5ba4fad0d4895c79dcaf9404c20ac9ab24a4cd7d278a88714c326aded22ccf7070a1574be2162e218

  • C:\Windows\SysWOW64\riripoypiv.exe

    Filesize

    255KB

    MD5

    bcea0ccf2fde0ff47b1770eec2ed7d62

    SHA1

    eb125c211864e83c9649cf16a37a2b59b20df11e

    SHA256

    3adec395f72f20c8435f8f5997eff900a875cf5ca4ad4772063f37ba6af6282c

    SHA512

    198251867af4c781a0dee8d0fe1fa22fad6557f78facddd5ba4fad0d4895c79dcaf9404c20ac9ab24a4cd7d278a88714c326aded22ccf7070a1574be2162e218

  • C:\Windows\mydoc.rtf

    Filesize

    223B

    MD5

    06604e5941c126e2e7be02c5cd9f62ec

    SHA1

    4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

    SHA256

    85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

    SHA512

    803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

  • \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe

    Filesize

    255KB

    MD5

    c0d58fc3af8505a4e63f39ea96f37ad5

    SHA1

    fc43a72001bcdf36c68b0649092e26563b86c370

    SHA256

    7e269513753b5f6b45a07dd3d002fef2f979a997d0899b3f087a1cc7f1fb2a2b

    SHA512

    2314f796f6d0992362db05dae5428e5c1dcaeffbb86d083851718afadb7c724361ec28c67d207ff55f5f956a36820c1e5cd23ab1fa4e4eaca7cb12ef62a826c5

  • memory/800-166-0x00007FF99E140000-0x00007FF99E150000-memory.dmp

    Filesize

    64KB

  • memory/800-158-0x00007FF9A0410000-0x00007FF9A0420000-memory.dmp

    Filesize

    64KB

  • memory/800-168-0x00007FF99E140000-0x00007FF99E150000-memory.dmp

    Filesize

    64KB

  • memory/800-162-0x00007FF9A0410000-0x00007FF9A0420000-memory.dmp

    Filesize

    64KB

  • memory/800-161-0x00007FF9A0410000-0x00007FF9A0420000-memory.dmp

    Filesize

    64KB

  • memory/800-160-0x00007FF9A0410000-0x00007FF9A0420000-memory.dmp

    Filesize

    64KB

  • memory/800-159-0x00007FF9A0410000-0x00007FF9A0420000-memory.dmp

    Filesize

    64KB

  • memory/1404-153-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/1404-132-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/1652-151-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/1652-167-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/3720-157-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/3720-148-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/4480-146-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/4480-155-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/5028-147-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/5028-156-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/5044-145-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/5044-154-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB