Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

8e4cdc2920...9c.exe

windows7-x64

8

8e4cdc2920...9c.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    152s
  • max time network
    187s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    29/11/2022, 14:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8e4cdc2920b4adaed1409726d95e1803c3e3440a4fc6a611206fb2d63e07a99c.exe

  • Size

    361KB

  • MD5

    56ff7347af8b71f605f3f8540db3c86f

  • SHA1

    a86ed632f309de6a0df00d912f3ef58d7a2bcf66

  • SHA256

    8e4cdc2920b4adaed1409726d95e1803c3e3440a4fc6a611206fb2d63e07a99c

  • SHA512

    7fdc8e785fa8ed8bbb0d830c165af8e6267f0f0e9e91acd790ca5b3775e2f79b34803ec308b5ae19998edaa9702e6e070059b37a1ee9529559f90c1d786eee16

  • SSDEEP

    6144:UflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:UflfAsiVGjSGecvX

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 4 IoCs
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies Internet Explorer settings 1 TTPs 23 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 42 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8e4cdc2920b4adaed1409726d95e1803c3e3440a4fc6a611206fb2d63e07a99c.exe
    "C:\Users\Admin\AppData\Local\Temp\8e4cdc2920b4adaed1409726d95e1803c3e3440a4fc6a611206fb2d63e07a99c.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:436
    • C:\Temp\cyrfbyunjfbyifbx.exe
      C:\Temp\cyrfbyunjfbyifbx.exe run
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1492
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\yioyipzgqa.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:636
        • C:\Temp\yioyipzgqa.exe
          C:\Temp\yioyipzgqa.exe ups_run
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1008
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:2036
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:1972
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:680
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:680 CREDAT:275457 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1104

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Temp\CreateProcess.exe
    Filesize

    3KB

    MD5

    4696d190b327138a2198ce39cc431301

    SHA1

    f78488ded8ff1a6cb99304414c3233bd0855c209

    SHA256

    1d9fd8e9226f726356354cd38ba4ac4ce6c3a1f5e01e505787edbf35aefc0d49

    SHA512

    e50dfea7a18717f9825dacc8ab95ea2be920940664b8928cc5efc59d0e22082f9c193f6b5192ec8b5f78dc9db7311d5b451269bbee97c53b26a3bd3c57ad9220

    Download Submit

  • C:\Temp\CreateProcess.exe
    Filesize

    3KB

    MD5

    4696d190b327138a2198ce39cc431301

    SHA1

    f78488ded8ff1a6cb99304414c3233bd0855c209

    SHA256

    1d9fd8e9226f726356354cd38ba4ac4ce6c3a1f5e01e505787edbf35aefc0d49

    SHA512

    e50dfea7a18717f9825dacc8ab95ea2be920940664b8928cc5efc59d0e22082f9c193f6b5192ec8b5f78dc9db7311d5b451269bbee97c53b26a3bd3c57ad9220

    Download Submit

  • C:\Temp\cyrfbyunjfbyifbx.exe
    Filesize

    361KB

    MD5

    f34d74e7d084d6bdec4a17b110f3107e

    SHA1

    4bdedbb12e232ea37c883f793852bd6c81e87bf8

    SHA256

    c748da6ae9a58e39e74735220f65b57dbbd600a94df3fbe7ba68777cf229d3e5

    SHA512

    f68db07a28a23694040eacb1963451e3376402f9a35b67221d96555d2321b1c7bbce7838c54730dbad1d88d756aaf06635fedb4762e5adef76d379690bfd786b

    Download Submit

  • C:\Temp\cyrfbyunjfbyifbx.exe
    Filesize

    361KB

    MD5

    f34d74e7d084d6bdec4a17b110f3107e

    SHA1

    4bdedbb12e232ea37c883f793852bd6c81e87bf8

    SHA256

    c748da6ae9a58e39e74735220f65b57dbbd600a94df3fbe7ba68777cf229d3e5

    SHA512

    f68db07a28a23694040eacb1963451e3376402f9a35b67221d96555d2321b1c7bbce7838c54730dbad1d88d756aaf06635fedb4762e5adef76d379690bfd786b

    Download Submit

  • C:\Temp\yioyipzgqa.exe
    Filesize

    361KB

    MD5

    b09e9d7d97e953bd9be7f670e6aa1a01

    SHA1

    d22ae0251a9d8bb417298ccc52fcad36a979783e

    SHA256

    86e68a867270b7d669829308f47ec4ef2300527c577060474e863afc70e27a3d

    SHA512

    6c127ed427daa2cd30557adb87989324f70d70df2a713c93bac5f08aab787243265da17427610d4702640223dd9e2c34ce1e19b9da9b21c438bafaf1c6f0e263

    Download Submit

  • C:\temp\CreateProcess.exe
    Filesize

    3KB

    MD5

    4696d190b327138a2198ce39cc431301

    SHA1

    f78488ded8ff1a6cb99304414c3233bd0855c209

    SHA256

    1d9fd8e9226f726356354cd38ba4ac4ce6c3a1f5e01e505787edbf35aefc0d49

    SHA512

    e50dfea7a18717f9825dacc8ab95ea2be920940664b8928cc5efc59d0e22082f9c193f6b5192ec8b5f78dc9db7311d5b451269bbee97c53b26a3bd3c57ad9220

    Download Submit

  • \Temp\CreateProcess.exe
    Filesize

    3KB

    MD5

    4696d190b327138a2198ce39cc431301

    SHA1

    f78488ded8ff1a6cb99304414c3233bd0855c209

    SHA256

    1d9fd8e9226f726356354cd38ba4ac4ce6c3a1f5e01e505787edbf35aefc0d49

    SHA512

    e50dfea7a18717f9825dacc8ab95ea2be920940664b8928cc5efc59d0e22082f9c193f6b5192ec8b5f78dc9db7311d5b451269bbee97c53b26a3bd3c57ad9220

    Download Submit

  • \Temp\CreateProcess.exe
    Filesize

    3KB

    MD5

    4696d190b327138a2198ce39cc431301

    SHA1

    f78488ded8ff1a6cb99304414c3233bd0855c209

    SHA256

    1d9fd8e9226f726356354cd38ba4ac4ce6c3a1f5e01e505787edbf35aefc0d49

    SHA512

    e50dfea7a18717f9825dacc8ab95ea2be920940664b8928cc5efc59d0e22082f9c193f6b5192ec8b5f78dc9db7311d5b451269bbee97c53b26a3bd3c57ad9220

    Download Submit

  • \Temp\CreateProcess.exe
    Filesize

    3KB

    MD5

    4696d190b327138a2198ce39cc431301

    SHA1

    f78488ded8ff1a6cb99304414c3233bd0855c209

    SHA256

    1d9fd8e9226f726356354cd38ba4ac4ce6c3a1f5e01e505787edbf35aefc0d49

    SHA512

    e50dfea7a18717f9825dacc8ab95ea2be920940664b8928cc5efc59d0e22082f9c193f6b5192ec8b5f78dc9db7311d5b451269bbee97c53b26a3bd3c57ad9220

    Download Submit

  • \Temp\cyrfbyunjfbyifbx.exe
    Filesize

    361KB

    MD5

    f34d74e7d084d6bdec4a17b110f3107e

    SHA1

    4bdedbb12e232ea37c883f793852bd6c81e87bf8

    SHA256

    c748da6ae9a58e39e74735220f65b57dbbd600a94df3fbe7ba68777cf229d3e5

    SHA512

    f68db07a28a23694040eacb1963451e3376402f9a35b67221d96555d2321b1c7bbce7838c54730dbad1d88d756aaf06635fedb4762e5adef76d379690bfd786b

    Download Submit