Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    43s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/12/2022, 18:46

General

  • Target

    1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe

  • Size

    2.0MB

  • MD5

    53ca26fbcd0c54a9529dde33d5bc2042

  • SHA1

    20fd30d5957986143fca7488762e23f97f85d28a

  • SHA256

    1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926

  • SHA512

    da4275c57f04fbcf3811336a46396ab754a3df91ea25a5ba3d89bf7499cfe700b65ec66ba4a8e4d374283a641e3e0e70aaf2337520e6c56b300693696b2442f6

  • SSDEEP

    24576:kxm0iO/DQ3eyqvtsJe30RxVIxplYJ1B3J7hoBTl+mRezac3hWYo7wszC9BPnfCvJ:kA0T/kwKQ0nVe+JGR0nBinx

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
  • UAC bypass 3 TTPs 6 IoCs
  • Executes dropped EXE 3 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 5 IoCs
  • Drops file in System32 directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry key 1 TTPs 18 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 52 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe
    "C:\Users\Admin\AppData\Local\Temp\1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1524
    • C:\Users\Admin\gMEoEUUc\sCsMcEUE.exe
      "C:\Users\Admin\gMEoEUUc\sCsMcEUE.exe"
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Adds Run key to start application
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      PID:3088
    • C:\ProgramData\LgYAAcwo\FyMMUIks.exe
      "C:\ProgramData\LgYAAcwo\FyMMUIks.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:4600
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2088
      • C:\Users\Admin\AppData\Local\Temp\1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe
        C:\Users\Admin\AppData\Local\Temp\1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4260
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4836
          • C:\Users\Admin\AppData\Local\Temp\1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe
            C:\Users\Admin\AppData\Local\Temp\1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:4784
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:4892
              • C:\Users\Admin\AppData\Local\Temp\1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe
                C:\Users\Admin\AppData\Local\Temp\1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926
                7⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:3476
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926"
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4868
                  • C:\Users\Admin\AppData\Local\Temp\1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe
                    C:\Users\Admin\AppData\Local\Temp\1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926
                    9⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4116
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926"
                      10⤵
                        PID:4904
                        • C:\Users\Admin\AppData\Local\Temp\1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926.exe
                          C:\Users\Admin\AppData\Local\Temp\1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926
                          11⤵
                            PID:3584
                            • C:\Windows\SysWOW64\reg.exe
                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                              12⤵
                              • Modifies visibility of file extensions in Explorer
                              • Modifies registry key
                              PID:3940
                            • C:\Windows\SysWOW64\reg.exe
                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                              12⤵
                              • Modifies registry key
                              PID:3936
                            • C:\Windows\SysWOW64\reg.exe
                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                              12⤵
                              • UAC bypass
                              • Modifies registry key
                              PID:2076
                        • C:\Windows\SysWOW64\reg.exe
                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                          10⤵
                          • Modifies visibility of file extensions in Explorer
                          • Modifies registry key
                          PID:4756
                        • C:\Windows\SysWOW64\reg.exe
                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                          10⤵
                          • Modifies registry key
                          PID:3280
                        • C:\Windows\SysWOW64\reg.exe
                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                          10⤵
                          • UAC bypass
                          • Modifies registry key
                          PID:2540
                    • C:\Windows\SysWOW64\reg.exe
                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                      8⤵
                      • Modifies visibility of file extensions in Explorer
                      • Modifies registry key
                      PID:5088
                    • C:\Windows\SysWOW64\reg.exe
                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                      8⤵
                      • Modifies registry key
                      PID:2372
                    • C:\Windows\SysWOW64\reg.exe
                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                      8⤵
                      • UAC bypass
                      • Modifies registry key
                      PID:4112
                • C:\Windows\SysWOW64\reg.exe
                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                  6⤵
                  • Modifies visibility of file extensions in Explorer
                  • Modifies registry key
                  PID:3900
                • C:\Windows\SysWOW64\reg.exe
                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                  6⤵
                  • Modifies registry key
                  PID:2188
                • C:\Windows\SysWOW64\reg.exe
                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                  6⤵
                  • UAC bypass
                  • Modifies registry key
                  PID:296
            • C:\Windows\SysWOW64\reg.exe
              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
              4⤵
              • Modifies visibility of file extensions in Explorer
              • Modifies registry key
              PID:536
            • C:\Windows\SysWOW64\reg.exe
              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
              4⤵
              • Modifies registry key
              PID:1792
            • C:\Windows\SysWOW64\reg.exe
              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
              4⤵
              • UAC bypass
              • Modifies registry key
              PID:3428
        • C:\Windows\SysWOW64\reg.exe
          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
          2⤵
          • Modifies visibility of file extensions in Explorer
          • Modifies registry key
          PID:2020
        • C:\Windows\SysWOW64\reg.exe
          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
          2⤵
          • UAC bypass
          • Modifies registry key
          PID:2156
        • C:\Windows\SysWOW64\reg.exe
          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
          2⤵
          • Modifies registry key
          PID:4264
      • C:\ProgramData\YmEMwEIo\MgowMocc.exe
        C:\ProgramData\YmEMwEIo\MgowMocc.exe
        1⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in System32 directory
        PID:4900
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4064

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\ProgramData\LgYAAcwo\FyMMUIks.exe

        Filesize

        2.0MB

        MD5

        9825480e14903e5c8ac443caed12e533

        SHA1

        9e079e1c6b5cbd5c3ae74c799dc0975a264adff3

        SHA256

        a40da433c2ca1516990a8d231326abc0f94e59c626b68b889c5e5a780c5c823f

        SHA512

        e76a20d7f5ce3149ac035fb68b4380b238cc15fa03b9ccaab2f9ccbf0e6f2861b7228feffc917134544c30c1da7fc91704b765e918f9dc0d909506dca4ce8ca4

      • C:\ProgramData\LgYAAcwo\FyMMUIks.exe

        Filesize

        2.0MB

        MD5

        9825480e14903e5c8ac443caed12e533

        SHA1

        9e079e1c6b5cbd5c3ae74c799dc0975a264adff3

        SHA256

        a40da433c2ca1516990a8d231326abc0f94e59c626b68b889c5e5a780c5c823f

        SHA512

        e76a20d7f5ce3149ac035fb68b4380b238cc15fa03b9ccaab2f9ccbf0e6f2861b7228feffc917134544c30c1da7fc91704b765e918f9dc0d909506dca4ce8ca4

      • C:\ProgramData\YmEMwEIo\MgowMocc.exe

        Filesize

        1.9MB

        MD5

        81029efe0d04ebd9a2725274e447e9ee

        SHA1

        13304c1b0b2114500af27b4bcbc6aafec521f4a3

        SHA256

        0e52cb3dbd60db20606e53efd002b7e3414d81784ba2f8e5f5bd7d1fab2f1173

        SHA512

        2b67fe9edf340c00e355fa0765f8b90015bde72d980dbccdbbee303be02e4f4b192f5777536287540b18892b34df80ee9ce6fe7ce50afe0063010278ca3988c6

      • C:\ProgramData\YmEMwEIo\MgowMocc.exe

        Filesize

        1.9MB

        MD5

        81029efe0d04ebd9a2725274e447e9ee

        SHA1

        13304c1b0b2114500af27b4bcbc6aafec521f4a3

        SHA256

        0e52cb3dbd60db20606e53efd002b7e3414d81784ba2f8e5f5bd7d1fab2f1173

        SHA512

        2b67fe9edf340c00e355fa0765f8b90015bde72d980dbccdbbee303be02e4f4b192f5777536287540b18892b34df80ee9ce6fe7ce50afe0063010278ca3988c6

      • C:\Users\Admin\AppData\Local\Temp\1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926

        Filesize

        6KB

        MD5

        1faaca27db89108e4db71601f485ec34

        SHA1

        0ba4ef92a3a4aa61bcc8be95e8353c7cca84855c

        SHA256

        938302353d9e5e040c36fb429ab96cd61b4e0948d1c6c027767f8ae00dc62171

        SHA512

        bd05d1a2d40a74d8049049b59c9bb6b6f99b3af0d115d5a14b8c83f8af3567b4e416517027001876821677d6464a6b3f343fd9adbf28bd196b6da97a56a9a97a

      • C:\Users\Admin\AppData\Local\Temp\1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926

        Filesize

        6KB

        MD5

        1faaca27db89108e4db71601f485ec34

        SHA1

        0ba4ef92a3a4aa61bcc8be95e8353c7cca84855c

        SHA256

        938302353d9e5e040c36fb429ab96cd61b4e0948d1c6c027767f8ae00dc62171

        SHA512

        bd05d1a2d40a74d8049049b59c9bb6b6f99b3af0d115d5a14b8c83f8af3567b4e416517027001876821677d6464a6b3f343fd9adbf28bd196b6da97a56a9a97a

      • C:\Users\Admin\AppData\Local\Temp\1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926

        Filesize

        6KB

        MD5

        1faaca27db89108e4db71601f485ec34

        SHA1

        0ba4ef92a3a4aa61bcc8be95e8353c7cca84855c

        SHA256

        938302353d9e5e040c36fb429ab96cd61b4e0948d1c6c027767f8ae00dc62171

        SHA512

        bd05d1a2d40a74d8049049b59c9bb6b6f99b3af0d115d5a14b8c83f8af3567b4e416517027001876821677d6464a6b3f343fd9adbf28bd196b6da97a56a9a97a

      • C:\Users\Admin\AppData\Local\Temp\1cb82039822cb89811f42b2c3bdbb4256d85d66e942cd69f38d3cb123596c926

        Filesize

        6KB

        MD5

        1faaca27db89108e4db71601f485ec34

        SHA1

        0ba4ef92a3a4aa61bcc8be95e8353c7cca84855c

        SHA256

        938302353d9e5e040c36fb429ab96cd61b4e0948d1c6c027767f8ae00dc62171

        SHA512

        bd05d1a2d40a74d8049049b59c9bb6b6f99b3af0d115d5a14b8c83f8af3567b4e416517027001876821677d6464a6b3f343fd9adbf28bd196b6da97a56a9a97a

      • C:\Users\Admin\gMEoEUUc\sCsMcEUE.exe

        Filesize

        2.0MB

        MD5

        9b590740ec6a57953a735ee85673376c

        SHA1

        47dc62768ad20238f026e0a1b742804f4c974848

        SHA256

        60a0dfa4e97220b0657dd6fc47d32dd47eb154d92c93b696c24db6f03a230ba6

        SHA512

        c912ca31374325b6af222818bad7b6129f1a4e017355f797b4ef0100fda06357f6c2105dc0fdf958d84dcbc2ed1640dab6953ce70465b4cb130fbf8ac5f97587

      • C:\Users\Admin\gMEoEUUc\sCsMcEUE.exe

        Filesize

        2.0MB

        MD5

        9b590740ec6a57953a735ee85673376c

        SHA1

        47dc62768ad20238f026e0a1b742804f4c974848

        SHA256

        60a0dfa4e97220b0657dd6fc47d32dd47eb154d92c93b696c24db6f03a230ba6

        SHA512

        c912ca31374325b6af222818bad7b6129f1a4e017355f797b4ef0100fda06357f6c2105dc0fdf958d84dcbc2ed1640dab6953ce70465b4cb130fbf8ac5f97587

      • memory/1524-133-0x0000000000400000-0x00000000005FB000-memory.dmp

        Filesize

        2.0MB

      • memory/1524-132-0x0000000002340000-0x000000000243F000-memory.dmp

        Filesize

        1020KB

      • memory/1524-155-0x0000000000400000-0x00000000005FB000-memory.dmp

        Filesize

        2.0MB

      • memory/1524-153-0x0000000002340000-0x000000000243F000-memory.dmp

        Filesize

        1020KB

      • memory/3088-193-0x0000000006470000-0x0000000006475000-memory.dmp

        Filesize

        20KB

      • memory/3088-156-0x00000000020B0000-0x00000000020BE000-memory.dmp

        Filesize

        56KB

      • memory/3088-145-0x0000000000400000-0x00000000005FE000-memory.dmp

        Filesize

        2.0MB

      • memory/3088-194-0x000000000AAD0000-0x000000000AAF6000-memory.dmp

        Filesize

        152KB

      • memory/3088-140-0x00000000020B0000-0x00000000020BE000-memory.dmp

        Filesize

        56KB

      • memory/3088-167-0x0000000000400000-0x00000000005FE000-memory.dmp

        Filesize

        2.0MB

      • memory/3088-203-0x000000000AAD0000-0x000000000AAF6000-memory.dmp

        Filesize

        152KB

      • memory/3476-176-0x0000000002220000-0x000000000231F000-memory.dmp

        Filesize

        1020KB

      • memory/3476-201-0x0000000000400000-0x00000000005FB000-memory.dmp

        Filesize

        2.0MB

      • memory/3476-177-0x0000000000400000-0x00000000005FB000-memory.dmp

        Filesize

        2.0MB

      • memory/3584-200-0x0000000000400000-0x00000000005FB000-memory.dmp

        Filesize

        2.0MB

      • memory/3584-196-0x0000000000400000-0x00000000005FB000-memory.dmp

        Filesize

        2.0MB

      • memory/3584-192-0x0000000002100000-0x00000000021FF000-memory.dmp

        Filesize

        1020KB

      • memory/4116-202-0x0000000000400000-0x00000000005FB000-memory.dmp

        Filesize

        2.0MB

      • memory/4116-189-0x0000000000400000-0x00000000005FB000-memory.dmp

        Filesize

        2.0MB

      • memory/4260-157-0x0000000000400000-0x00000000005FB000-memory.dmp

        Filesize

        2.0MB

      • memory/4260-154-0x0000000000810000-0x000000000090F000-memory.dmp

        Filesize

        1020KB

      • memory/4260-184-0x0000000000400000-0x00000000005FB000-memory.dmp

        Filesize

        2.0MB

      • memory/4600-168-0x0000000000400000-0x0000000000601000-memory.dmp

        Filesize

        2.0MB

      • memory/4600-146-0x0000000000400000-0x0000000000601000-memory.dmp

        Filesize

        2.0MB

      • memory/4600-164-0x0000000000710000-0x0000000000749000-memory.dmp

        Filesize

        228KB

      • memory/4600-143-0x0000000000710000-0x0000000000749000-memory.dmp

        Filesize

        228KB

      • memory/4784-195-0x0000000000400000-0x00000000005FB000-memory.dmp

        Filesize

        2.0MB

      • memory/4784-175-0x0000000000400000-0x00000000005FB000-memory.dmp

        Filesize

        2.0MB

      • memory/4784-165-0x00000000021C0000-0x00000000022BF000-memory.dmp

        Filesize

        1020KB

      • memory/4900-144-0x0000000000720000-0x000000000076D000-memory.dmp

        Filesize

        308KB

      • memory/4900-151-0x0000000000400000-0x00000000005F3000-memory.dmp

        Filesize

        1.9MB

      • memory/4900-166-0x0000000000720000-0x000000000076D000-memory.dmp

        Filesize

        308KB