Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
08/02/2023, 04:17
230208-ewg98shb88 108/02/2023, 04:10
230208-ervprsge81 702/02/2023, 17:55
230202-whhsaagf32 10Analysis
-
max time kernel
128s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
08/02/2023, 04:10
General
-
Target
WinTroyBuilder.exe
-
Size
2.8MB
-
MD5
3d46955ab2275455a983c1c327835366
-
SHA1
c18655daaaa564c2f4f2932f561f885cb1aff36b
-
SHA256
9bf03a8f81f0c51e9f1a9cd6016ecccf7443c1559e4e4b44547b8a13521b152a
-
SHA512
8d28dbc134d78b3ae21bf125a1eab81e6c9ab7d57c5148b3e0ac10dd40b76fe24b6846131f0224fb13d84cb0fe16f8d88cc5c97c5bbea5ec9e00960205c04332
-
SSDEEP
49152:fOPSa4ZImzdAxZmKLEb+T+VY07d7AidLAbbtwSjugkKNJxeWsoDjLX:fraitzdAfBEa0AiLAbbO0ugk8V
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
-
Loads dropped DLL 5 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 1 IoCs
-
Modifies Internet Explorer settings 1 TTPs 29 IoCs
-
Modifies registry class 64 IoCs
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Suspicious behavior: CmdExeWriteProcessMemorySpam 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 5 IoCs
-
Suspicious use of WriteProcessMemory 43 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\WinTroyBuilder.exe"C:\Users\Admin\AppData\Local\Temp\WinTroyBuilder.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Resources\b2e.exe"C:\Users\Admin\AppData\Local\Temp\Resources\b2e.exe" /bat C:\Users\Admin\AppData\Local\Temp\Resources\inst.bat /exe C:\Users\Admin\Desktop\WinTryo.exe /overwrite /invisible /icon "" /fileversion 1.0.0.0 /description "Made with WinTroyBuilder v1.3" /originalfilename "FreeVBucks.html" /copyright "Copyright © 2023" /productname "WinTroy" /productversion 1.0.0.0 /include "C:\Users\Admin\AppData\Local\Temp\Resources\\git"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Bat To Exe Converter\GoRC.exe"C:\Users\Admin\AppData\Roaming\Bat To Exe Converter\GoRC.exe" /r resource.rc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\Bat To Exe Converter\GoLink.exe"C:\Users\Admin\AppData\Roaming\Bat To Exe Converter\GoLink.exe" resource.res3⤵
- Executes dropped EXE
-
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" C:\Users\Admin\Desktop2⤵
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Users\Admin\Desktop\WinTryo.exe"C:\Users\Admin\Desktop\WinTryo.exe"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\D569.tmp\D56A.tmp\D56B.bat C:\Users\Admin\Desktop\WinTryo.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Desktop\git\git.exegit.exe C:\Users\Admin\AppData\Roaming/WINT\3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im git.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\reg.exereg.exe ADD HKEY_CURRENT_USER\SOFTWARE\Wint /v inst /t REG_SZ /d C:\Users\Admin\Desktop\WinTryo.exe /f3⤵
-
-
C:\Windows\system32\reg.exereg.exe ADD HKEY_CURRENT_USER\SOFTWARE\Wint /v dcbt /t REG_SZ /d wUF+EPAgre4= /f3⤵
-
-
C:\Users\Admin\AppData\Roaming\WINT\invrun.exeC:\Users\Admin\AppData\Roaming/WINT\invrun.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
C:\Users\Admin\AppData\Roaming\WINT\WinTroy.exe"C:\Users\Admin\AppData\Roaming\WINT\WinTroy.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch&plcid=0x409&o1=.NETFramework,Version=v4.8&processName=WinTroy.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.05⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1616 CREDAT:275457 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD51af34cb75d0d5b5d4e74451848ae1970
SHA18850e575e39e5906560f941e2c0114ab495e5777
SHA2566c9e9ebd0dd809c4dfd4fc79609d3f33f94380496a2bebd9d82cce63323a48c8
SHA5120f4562e23e59c044f9913dff023fdf6ae3d8d54b2b5187c1524f5a7ea59196ecadb670e04942c427bd91c4b174a70e660b664960c690e5d0aec974d9e646871c
-
Filesize
1KB
MD5aba402635f108196a7799b8b803b4f70
SHA132be7c62a6aea256629408a6c975f4ff004e1d96
SHA2565e35634e1f5610087b46d291db42e7ca391d07203e7f154a13d12abedc94fad7
SHA5124bd60dd17bd558e58e4893f8b3f7a50b94c117ef65afc3d850fffdf3dd58425251031ab31ac0c2f397e719618b947a46bc65de7fd15e1c8be071a727d5f33bc2
-
Filesize
676B
MD5f23b20b1d7ae577e2ca9915da2617362
SHA11a4acd32ffb7e1c19e2e49b39846013702f7babb
SHA256d88d18bafa364b10963ec58c57e2881d3993a1a53f2cb47016d4f46c9146bfd8
SHA51236a960715ef9550cab8744cd5f4f48707abcea1ff42bdb6ffd4eeef05148794e46cb63b2f968b61ad7cb9af93f40d4def88da0cc532623fa44fe109bf7973090
-
Filesize
332B
MD5d210300d1a9cafb44e30bc87468c4d5f
SHA17f837d9027a3a21afed2949e2d1271612162f244
SHA25698464a41bdddc06dba9bb9586b4bf080290e51ebed84eb5ac2c51b3f6eca706f
SHA5121d0aa41b79ab5ab8b7dd67c9c9a75897cde8d922a80e389ec86931439626a7db9cbd8cf9105d160109d5089e2406c7c479e84d3fe9cee5bd0fa34dcc5c14663a
-
Filesize
2.0MB
MD5e3d6b93e861feefa47cceeae03e99094
SHA194ac369ea396c6a4c23ddcfb41cfdfe81ce0b3da
SHA25655df60e09826469e543c090198ac6a12e1269047a88ed698e25e6e62d83ff4c7
SHA5122c00287925dcb22b4babd7c49e9035ccb92b895f123791ef361ff495b08d74fe1e9add54c1fcabd4de3cd396faafeccbae0c750913d911dba6531f51ab126402
-
Filesize
268KB
MD5f47adb7404aa61efe87cd1fd3a003161
SHA156a605b594a5e480afd3fa06f57b5e31e612ad17
SHA256ea3282590067b5b803e5658a54234fb8597471a675e7d86a2fd0d099774f81a0
SHA5129af1827103b334b82c11a6f50c34cf84bc29955572499b6ffe7ff7ea1cd99c4f0aa55ac742d91040d1eac06c06fd4c8f941cce35bb6d5ecaacb9670c8d0df83a
-
Filesize
918KB
MD51e96035a0fdd3783414000b12a0c4515
SHA1368bda48b76c08f26a3d7c3521b3a9e8ebb17ed2
SHA2561237de47ec7149ebc8f7e9edc4589a8940a29f39d23f1337b9ed87a96677d6ab
SHA512884040892e89b2d874ffa436fefd6d6a4f998ca4f3044720b638703319b97533329e25fe222d5eb2e757ec12fd574d9d7b5018d54678c403f5fb46bf47283c30
-
Filesize
321B
MD5c0db1da7bfd074462f57611714c91ffb
SHA138dd66e17eb054da69b82207b9a4630761b7b1cf
SHA2566c28b511d5cbed46ffbf9c0868a2827f332456da367d99664f3c9c20429b45ce
SHA512bd30893911f684ea9375b41b287b55090f4cdde5548c027513f9f5feb0bd9e114083a02c0fcffe6a66a670ded5f7aa140a82a58a1dc3fbd1ff6d6593b9d1692d
-
Filesize
46KB
MD5cafc4eec8a4f05b8dfee4067fb5b9076
SHA138f4c66246636e187fe4bf2aa8cb1d9b2502a14c
SHA2561fa554d18490cb5e56d624cd97069f42e63800688136c6cf3c521e4ef6e83e28
SHA5123c3e7c874e6b182aef812a1b593c3b1a3ea6efd5ae99792b88009cb6e6e0cee13c46fc26a1dbb7d73899a2ed01f73779c06d85246fd23edc6bf04fe41e0e133b
-
Filesize
53KB
MD5f69b0e5f35b5dae1b11b950cff157fb3
SHA1f582f77d036c362f1ec5a0ab11707143cb0c9220
SHA256ed010c50a7ceb43b9666e7fbca13d8377d30b79203207bad77004a890adeea17
SHA512f0ac0b51a80d20148d069a231d50a581e6580ea45adc2d15c15182c9551363e204e119daac544c37ac6d9e93b75ab73e90e9947e7bf3cf86707a5c5645e2750c
-
Filesize
409KB
MD5f4d31e85d3f360dbe53c3ab8f8eecf7b
SHA1a9ee07a7cbbb7247b85e8abbf68afa854b603558
SHA25628983cc240a6ef392358b52aea7447cb1ee74966cc77a9248cbfd94c7c08ad70
SHA512c219e345446a3e575ee07700ae07fc33c597a1c0af186d79d9383c0915d35d3f2c38c27f17cf2cd815225816f08f1df8a7bc32d42d66d3fa7eb8be77a5fa111c
-
Filesize
1KB
MD59666cb460cdd044561b698c4ffaf7b4e
SHA1f76bdbb3bf4badede4030ccd57fdc054cf4d2757
SHA2568ce2d6a2f5857064267f11c82f9ef87ed6ae84d11968291ed209fdf880328089
SHA51245a278118830c6652a0fcaa695a52b344c132faeaff5d3515e689abba9cf69477c1b3ad5134471886b54f7758f855ab02b7dcbf23e1bbeb02f13ac18cd67db79
-
Filesize
9KB
MD5a28632fcacd4181d170f7eb27a4ae38b
SHA1b66de23dffa88a3d7263a179ee554f6ccaafb928
SHA2562be6375194f84adeec9668366e6a21271336527d1f8ac053947b880a4a9f5659
SHA51232597891d585492fc7bdc9582cb128affd98de20cabb1dc3832e336dee100a5d2a11c5d6681f07a11fe9cbda0b6f47040df4970b25c02355d6ef83b2fb2e2612
-
Filesize
9KB
MD5a28632fcacd4181d170f7eb27a4ae38b
SHA1b66de23dffa88a3d7263a179ee554f6ccaafb928
SHA2562be6375194f84adeec9668366e6a21271336527d1f8ac053947b880a4a9f5659
SHA51232597891d585492fc7bdc9582cb128affd98de20cabb1dc3832e336dee100a5d2a11c5d6681f07a11fe9cbda0b6f47040df4970b25c02355d6ef83b2fb2e2612
-
Filesize
828KB
MD5e33bf1034ad3edaf08d6732f449be96a
SHA109116e29da02fd0dc20773f91a2979291e3fe6dc
SHA25669c515c134dc7de1ebf3c1e9f278a84f929a126854adec8d7cd50f8445bb3996
SHA512cfd7b1047f1f4a0dc77102b01332f74ec58a7987468b91a46a2db153f29bcf64f7391a25972716271abf006922b2d14e6e7f7ebacdabed7adf7125b9941b3662
-
Filesize
268KB
MD5f47adb7404aa61efe87cd1fd3a003161
SHA156a605b594a5e480afd3fa06f57b5e31e612ad17
SHA256ea3282590067b5b803e5658a54234fb8597471a675e7d86a2fd0d099774f81a0
SHA5129af1827103b334b82c11a6f50c34cf84bc29955572499b6ffe7ff7ea1cd99c4f0aa55ac742d91040d1eac06c06fd4c8f941cce35bb6d5ecaacb9670c8d0df83a
-
Filesize
268KB
MD5f47adb7404aa61efe87cd1fd3a003161
SHA156a605b594a5e480afd3fa06f57b5e31e612ad17
SHA256ea3282590067b5b803e5658a54234fb8597471a675e7d86a2fd0d099774f81a0
SHA5129af1827103b334b82c11a6f50c34cf84bc29955572499b6ffe7ff7ea1cd99c4f0aa55ac742d91040d1eac06c06fd4c8f941cce35bb6d5ecaacb9670c8d0df83a
-
Filesize
918KB
MD51e96035a0fdd3783414000b12a0c4515
SHA1368bda48b76c08f26a3d7c3521b3a9e8ebb17ed2
SHA2561237de47ec7149ebc8f7e9edc4589a8940a29f39d23f1337b9ed87a96677d6ab
SHA512884040892e89b2d874ffa436fefd6d6a4f998ca4f3044720b638703319b97533329e25fe222d5eb2e757ec12fd574d9d7b5018d54678c403f5fb46bf47283c30
-
Filesize
1KB
MD5aba402635f108196a7799b8b803b4f70
SHA132be7c62a6aea256629408a6c975f4ff004e1d96
SHA2565e35634e1f5610087b46d291db42e7ca391d07203e7f154a13d12abedc94fad7
SHA5124bd60dd17bd558e58e4893f8b3f7a50b94c117ef65afc3d850fffdf3dd58425251031ab31ac0c2f397e719618b947a46bc65de7fd15e1c8be071a727d5f33bc2
-
Filesize
2.0MB
MD5e3d6b93e861feefa47cceeae03e99094
SHA194ac369ea396c6a4c23ddcfb41cfdfe81ce0b3da
SHA25655df60e09826469e543c090198ac6a12e1269047a88ed698e25e6e62d83ff4c7
SHA5122c00287925dcb22b4babd7c49e9035ccb92b895f123791ef361ff495b08d74fe1e9add54c1fcabd4de3cd396faafeccbae0c750913d911dba6531f51ab126402
-
Filesize
2.0MB
MD5e3d6b93e861feefa47cceeae03e99094
SHA194ac369ea396c6a4c23ddcfb41cfdfe81ce0b3da
SHA25655df60e09826469e543c090198ac6a12e1269047a88ed698e25e6e62d83ff4c7
SHA5122c00287925dcb22b4babd7c49e9035ccb92b895f123791ef361ff495b08d74fe1e9add54c1fcabd4de3cd396faafeccbae0c750913d911dba6531f51ab126402
-
Filesize
409KB
MD5f4d31e85d3f360dbe53c3ab8f8eecf7b
SHA1a9ee07a7cbbb7247b85e8abbf68afa854b603558
SHA25628983cc240a6ef392358b52aea7447cb1ee74966cc77a9248cbfd94c7c08ad70
SHA512c219e345446a3e575ee07700ae07fc33c597a1c0af186d79d9383c0915d35d3f2c38c27f17cf2cd815225816f08f1df8a7bc32d42d66d3fa7eb8be77a5fa111c
-
Filesize
918KB
MD51e96035a0fdd3783414000b12a0c4515
SHA1368bda48b76c08f26a3d7c3521b3a9e8ebb17ed2
SHA2561237de47ec7149ebc8f7e9edc4589a8940a29f39d23f1337b9ed87a96677d6ab
SHA512884040892e89b2d874ffa436fefd6d6a4f998ca4f3044720b638703319b97533329e25fe222d5eb2e757ec12fd574d9d7b5018d54678c403f5fb46bf47283c30
-
Filesize
8KB
-
Filesize
3.9MB
-
Filesize
3.9MB
-
Filesize
3.9MB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
2.8MB
-
Filesize
8KB
-
Filesize
296KB
-
Filesize
440KB
-
Filesize
64KB
-
Filesize
3.9MB
-
Filesize
3.9MB