Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
64s -
max time network
43s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
09/03/2023, 02:11
General
-
Target
CLodop_Setup_for_Win32NT.exe
-
Size
4.6MB
-
MD5
9a942a2401351f3909fc3f0d94f749fc
-
SHA1
9ca251da1724008388ee672c232a03027b33dfff
-
SHA256
27be7d68516c66d8e3554d116bfe0add4a6dac42c3fb2484da025fccbc963601
-
SHA512
b8f07ffa81bcff1f9684ab1ebe9136517425162c4dd9d12fb7b958629355a49cd75b457972d6858fc23e30f130bf7bfcb515884db496e608dfb01a856d15ffe7
-
SSDEEP
98304:B1e0+EBg+69MH5UCumgFgyOy5V2N+R0G72Lcl+pYP4N/KpC:/eaUBCXDG6BpUHC
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
-
Loads dropped DLL 14 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies Internet Explorer settings 1 TTPs 7 IoCs
-
Modifies registry class 28 IoCs
-
Suspicious behavior: EnumeratesProcesses 33 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 27 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\CLodop_Setup_for_Win32NT.exe"C:\Users\Admin\AppData\Local\Temp\CLodop_Setup_for_Win32NT.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-2F21M.tmp\is-KNI2R.tmp"C:\Users\Admin\AppData\Local\Temp\is-2F21M.tmp\is-KNI2R.tmp" /SL4 $90152 "C:\Users\Admin\AppData\Local\Temp\CLodop_Setup_for_Win32NT.exe" 4509903 512002⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\MountTaiSoftware\CLodop32\CLodopPrint32.exe"C:\Program Files (x86)\MountTaiSoftware\CLodop32\CLodopPrint32.exe" setup_noauto3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122884⤵
-
-
C:\Program Files (x86)\MountTaiSoftware\CLodop32\CLodopService32.exe"C:\Program Files (x86)\MountTaiSoftware\CLodop32\CLodopService32.exe" -INSTALL -SILENT4⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\MountTaiSoftware\CLodop32\CLodopPrint32_backup.exe"C:\Program Files (x86)\MountTaiSoftware\CLodop32\CLodopPrint32_backup.exe"4⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\MountTaiSoftware\CLodop32\CLodopPrint32_backup.exe"C:\Program Files (x86)\MountTaiSoftware\CLodop32\CLodopPrint32_backup.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Program Files (x86)\MountTaiSoftware\CLodop32\CLodopService32.exe"C:\Program Files (x86)\MountTaiSoftware\CLodop32\CLodopService32.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\MountTaiSoftware\CLodop32\CLodopPrint32.exe"C:\Program Files (x86)\MountTaiSoftware\CLodop32\CLodopPrint32.exe" setup1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10.6MB
MD5b71d09b2545fa9762ac55d968d6ae6da
SHA1d0a5b5f6f03011ad81a1e9b82cc1af1fe39bc117
SHA25670b60f9121bef419757a6d35def1ebe836f5cc2be2ee0e3b43940179a534522a
SHA51260ef542aac7e85b062cdef5c25cd1456bc4dc1d71b215a2c738e5d5377089c3d9b8d7d3cf078fd14a5dcc9feda25e8699a90e907faee368f6733499ac7709449
-
Filesize
10.6MB
MD5b71d09b2545fa9762ac55d968d6ae6da
SHA1d0a5b5f6f03011ad81a1e9b82cc1af1fe39bc117
SHA25670b60f9121bef419757a6d35def1ebe836f5cc2be2ee0e3b43940179a534522a
SHA51260ef542aac7e85b062cdef5c25cd1456bc4dc1d71b215a2c738e5d5377089c3d9b8d7d3cf078fd14a5dcc9feda25e8699a90e907faee368f6733499ac7709449
-
Filesize
10.6MB
MD5b71d09b2545fa9762ac55d968d6ae6da
SHA1d0a5b5f6f03011ad81a1e9b82cc1af1fe39bc117
SHA25670b60f9121bef419757a6d35def1ebe836f5cc2be2ee0e3b43940179a534522a
SHA51260ef542aac7e85b062cdef5c25cd1456bc4dc1d71b215a2c738e5d5377089c3d9b8d7d3cf078fd14a5dcc9feda25e8699a90e907faee368f6733499ac7709449
-
Filesize
10.6MB
MD5b71d09b2545fa9762ac55d968d6ae6da
SHA1d0a5b5f6f03011ad81a1e9b82cc1af1fe39bc117
SHA25670b60f9121bef419757a6d35def1ebe836f5cc2be2ee0e3b43940179a534522a
SHA51260ef542aac7e85b062cdef5c25cd1456bc4dc1d71b215a2c738e5d5377089c3d9b8d7d3cf078fd14a5dcc9feda25e8699a90e907faee368f6733499ac7709449
-
Filesize
10.6MB
MD5b71d09b2545fa9762ac55d968d6ae6da
SHA1d0a5b5f6f03011ad81a1e9b82cc1af1fe39bc117
SHA25670b60f9121bef419757a6d35def1ebe836f5cc2be2ee0e3b43940179a534522a
SHA51260ef542aac7e85b062cdef5c25cd1456bc4dc1d71b215a2c738e5d5377089c3d9b8d7d3cf078fd14a5dcc9feda25e8699a90e907faee368f6733499ac7709449
-
Filesize
10.6MB
MD5b71d09b2545fa9762ac55d968d6ae6da
SHA1d0a5b5f6f03011ad81a1e9b82cc1af1fe39bc117
SHA25670b60f9121bef419757a6d35def1ebe836f5cc2be2ee0e3b43940179a534522a
SHA51260ef542aac7e85b062cdef5c25cd1456bc4dc1d71b215a2c738e5d5377089c3d9b8d7d3cf078fd14a5dcc9feda25e8699a90e907faee368f6733499ac7709449
-
Filesize
1.8MB
MD568144ded3bb3229ab3c9202a84fe37d9
SHA14dd57154b2b6e243e7ddef6dab9387ebe18203c2
SHA256da2b744a2cd2c5ae9de074ac75ec7c60e3f5122fac1ded934f918093d91efa96
SHA5128b0aa6d839d763fb6ab479cadf7910a0c825f4cad4ccef70fadc7602b7de6785da85149af2958f1d4c51b29d85194a9d2add31b508ef5fc4172d38f26228fdde
-
Filesize
1.8MB
MD568144ded3bb3229ab3c9202a84fe37d9
SHA14dd57154b2b6e243e7ddef6dab9387ebe18203c2
SHA256da2b744a2cd2c5ae9de074ac75ec7c60e3f5122fac1ded934f918093d91efa96
SHA5128b0aa6d839d763fb6ab479cadf7910a0c825f4cad4ccef70fadc7602b7de6785da85149af2958f1d4c51b29d85194a9d2add31b508ef5fc4172d38f26228fdde
-
Filesize
1.8MB
MD568144ded3bb3229ab3c9202a84fe37d9
SHA14dd57154b2b6e243e7ddef6dab9387ebe18203c2
SHA256da2b744a2cd2c5ae9de074ac75ec7c60e3f5122fac1ded934f918093d91efa96
SHA5128b0aa6d839d763fb6ab479cadf7910a0c825f4cad4ccef70fadc7602b7de6785da85149af2958f1d4c51b29d85194a9d2add31b508ef5fc4172d38f26228fdde
-
Filesize
752KB
MD567ec459e42d3081dd8fd34356f7cafc1
SHA11738050616169d5b17b5adac3ff0370b8c642734
SHA2561221a09484964a6f38af5e34ee292b9afefccb3dc6e55435fd3aaf7c235d9067
SHA5129ed1c106df217e0b4e4fbd1f4275486ceba1d8a225d6c7e47b854b0b5e6158135b81be926f51db0ad5c624f9bd1d09282332cf064680dc9f7d287073b9686d33
-
Filesize
1KB
MD5e080f7a49dd47d4d0897098ed34add97
SHA17cfd14ae2f2e623873c27b7abfb640494222af36
SHA256bfaae886653a9d5e3fc5c3e00ca65575c0acfbea716b3d37edbe0df5524e144d
SHA5124cf77e0dca55e042bf8a8ee37861c44aefa485ce3ebf37a0d7328d069cb4a1070ea6309fea712fee9e26f2675bbe7472b1bb8ef37d11fd6cea51cf3153657dad
-
Filesize
4KB
MD551a124ab18b6b415847c05be10b4597c
SHA1d8550f884403a1260ac90b69b7570e50cec07f89
SHA256b415372c3bfa1729304c4b14f026036a30988d282987408ede33e4380ba47a5b
SHA512641619d8d6e98ff93b81d9dd8a8d8e2db4b6887f1599658068e60c065e3a1e11abc1900b399ce2b138fc54c8aacd70adf0fe55ebe33261f4f82d97aabd125f09
-
Filesize
36B
MD5c00d20589a3389b1bde66fd0c6437115
SHA1e5cd92bc2a71349ecd4c5ea8889467e5f2be40a2
SHA256685241fde998e68163f241ea42edefd032007ce56acb525d49e11242c54b6e3a
SHA512f6c73ea717e6a1bcda9a08ae4f760ca2d45a89063d0f8b9ad946ec265bd61bbf6b23dfe330283bd12e9fe4526cdb292f68f81e1958f07d3ab4f41b78b8c9fb99
-
Filesize
274B
MD58e345cfeb4c496d94e02a7ef22d94ee4
SHA168585f49e2625c1ef45cbf8ed5d20c602382f16b
SHA2565cf28ee360e177fc94c33f5b00f58e41272740ec5f41a454b0ba00619799460c
SHA5123534f360340c8150727e190d72ddee83e318d821ee39542518b41a7e87c7928e046c5dd5c4602b464a142800d1021614b6150e7a9141d4d627dfe3f5da1b2106
-
Filesize
298B
MD5f9694778e38d8c013735f507bd06e8c1
SHA1790b2c3c631eb79805463d58cabce55f7214ff5d
SHA256d04dc027bb0af8ca7bbe8374e7f01cc1fd7543bfa3903fdf79546b0747aae775
SHA51281c4179f7e9ae6bd2763ad03a5f3d9a08422b60df73d089c19f9bf4eb6562dd70d55980cb97650b74dc9ba297da23b29fc86b2241a80c858ddeee47f2d2280f9
-
Filesize
174B
MD59a16c9cf4e9f758ff3b8e0432a5aa8d9
SHA1667dad940cf81f354e137da162acb15f6615b9d8
SHA25696707575ed4c716b93e9e475ec99089fd4bab3f59cf674093a2f4a9dfa96849e
SHA51218cec4bbbd28e4a2223de2ba5ca2bd3a03296594bb6897cabd91b71aeaf054f45f3082adffb095271d2b43b9577d5d1117965f38786a4b474f7724839e30934b
-
Filesize
1.2MB
MD5e479394a699363d869db4b12e135fa4b
SHA1a1f7611ebc485ae8acf74d49731d81cdaba1b907
SHA25636c6757a0277a98e1e07e52065a67cf8b06c75e109eab509533290d79c929df5
SHA512ba9ce2b6107622dfe5dfe9cbf81ba6e8dea9f4e83e5bc70fa8eea71d41deed7132e1c118e2b9842e8f54ca7246a28da5863a038b40fe80ebdaa6fee91f3cd19d
-
Filesize
264KB
MD52976c5ebbfd55691cce2527b7e6c8308
SHA1fef9d06d825a7a25a3c53fb70327473705c12d8d
SHA2566630790af959021af2c50405dd40fbf6bf283dd04e0622a8bfe5a69ca5bab496
SHA5128fec7754c330193cec728242574068b8d0fe6ba4914b6c7b63135e3ff2cb8a328ba700a9e0b441f5504849363e6014047adcd645e16d684928a904586dc51a14
-
Filesize
646KB
MD579551e7f460ce4a92b6c9c0f0b714108
SHA151c8cd3741482a00ee6137822f826c0f55d521c4
SHA25606ae7abcec424f92569cd67e55e27c7e91f84f6108f91876cd3f135262341bef
SHA5124e1d7bc491d21064d89414aa335915d306ea3e811d7fe237c9e111b0588189d8d37b238b7ff39159b05125eaee6637956a7f0f8e2ae51a7a5196765af62665a8
-
Filesize
646KB
MD579551e7f460ce4a92b6c9c0f0b714108
SHA151c8cd3741482a00ee6137822f826c0f55d521c4
SHA25606ae7abcec424f92569cd67e55e27c7e91f84f6108f91876cd3f135262341bef
SHA5124e1d7bc491d21064d89414aa335915d306ea3e811d7fe237c9e111b0588189d8d37b238b7ff39159b05125eaee6637956a7f0f8e2ae51a7a5196765af62665a8
-
Filesize
56KB
MD5bd72dcf1083b6e22ccbfa0e8e27fb1e0
SHA13fd23d4f14da768da7b8364d74c54932d704e74e
SHA25690f44f69950a796ab46ff09181585ac9dabf21271f16ebb9ea385c957e5955c1
SHA51272360ab4078ad5e0152324f9a856b3396e2d0247f7f95ac8a5a53a25126ac3cff567cc523849e28d92a99730ee8ffb30366f09c428258f93a5cca6d0c5905562
-
Filesize
10.6MB
MD5b71d09b2545fa9762ac55d968d6ae6da
SHA1d0a5b5f6f03011ad81a1e9b82cc1af1fe39bc117
SHA25670b60f9121bef419757a6d35def1ebe836f5cc2be2ee0e3b43940179a534522a
SHA51260ef542aac7e85b062cdef5c25cd1456bc4dc1d71b215a2c738e5d5377089c3d9b8d7d3cf078fd14a5dcc9feda25e8699a90e907faee368f6733499ac7709449
-
Filesize
10.6MB
MD5b71d09b2545fa9762ac55d968d6ae6da
SHA1d0a5b5f6f03011ad81a1e9b82cc1af1fe39bc117
SHA25670b60f9121bef419757a6d35def1ebe836f5cc2be2ee0e3b43940179a534522a
SHA51260ef542aac7e85b062cdef5c25cd1456bc4dc1d71b215a2c738e5d5377089c3d9b8d7d3cf078fd14a5dcc9feda25e8699a90e907faee368f6733499ac7709449
-
Filesize
10.6MB
MD5b71d09b2545fa9762ac55d968d6ae6da
SHA1d0a5b5f6f03011ad81a1e9b82cc1af1fe39bc117
SHA25670b60f9121bef419757a6d35def1ebe836f5cc2be2ee0e3b43940179a534522a
SHA51260ef542aac7e85b062cdef5c25cd1456bc4dc1d71b215a2c738e5d5377089c3d9b8d7d3cf078fd14a5dcc9feda25e8699a90e907faee368f6733499ac7709449
-
Filesize
10.6MB
MD5b71d09b2545fa9762ac55d968d6ae6da
SHA1d0a5b5f6f03011ad81a1e9b82cc1af1fe39bc117
SHA25670b60f9121bef419757a6d35def1ebe836f5cc2be2ee0e3b43940179a534522a
SHA51260ef542aac7e85b062cdef5c25cd1456bc4dc1d71b215a2c738e5d5377089c3d9b8d7d3cf078fd14a5dcc9feda25e8699a90e907faee368f6733499ac7709449
-
Filesize
10.6MB
MD5b71d09b2545fa9762ac55d968d6ae6da
SHA1d0a5b5f6f03011ad81a1e9b82cc1af1fe39bc117
SHA25670b60f9121bef419757a6d35def1ebe836f5cc2be2ee0e3b43940179a534522a
SHA51260ef542aac7e85b062cdef5c25cd1456bc4dc1d71b215a2c738e5d5377089c3d9b8d7d3cf078fd14a5dcc9feda25e8699a90e907faee368f6733499ac7709449
-
Filesize
1.8MB
MD568144ded3bb3229ab3c9202a84fe37d9
SHA14dd57154b2b6e243e7ddef6dab9387ebe18203c2
SHA256da2b744a2cd2c5ae9de074ac75ec7c60e3f5122fac1ded934f918093d91efa96
SHA5128b0aa6d839d763fb6ab479cadf7910a0c825f4cad4ccef70fadc7602b7de6785da85149af2958f1d4c51b29d85194a9d2add31b508ef5fc4172d38f26228fdde
-
Filesize
752KB
MD567ec459e42d3081dd8fd34356f7cafc1
SHA11738050616169d5b17b5adac3ff0370b8c642734
SHA2561221a09484964a6f38af5e34ee292b9afefccb3dc6e55435fd3aaf7c235d9067
SHA5129ed1c106df217e0b4e4fbd1f4275486ceba1d8a225d6c7e47b854b0b5e6158135b81be926f51db0ad5c624f9bd1d09282332cf064680dc9f7d287073b9686d33
-
Filesize
1.2MB
MD5e479394a699363d869db4b12e135fa4b
SHA1a1f7611ebc485ae8acf74d49731d81cdaba1b907
SHA25636c6757a0277a98e1e07e52065a67cf8b06c75e109eab509533290d79c929df5
SHA512ba9ce2b6107622dfe5dfe9cbf81ba6e8dea9f4e83e5bc70fa8eea71d41deed7132e1c118e2b9842e8f54ca7246a28da5863a038b40fe80ebdaa6fee91f3cd19d
-
Filesize
264KB
MD52976c5ebbfd55691cce2527b7e6c8308
SHA1fef9d06d825a7a25a3c53fb70327473705c12d8d
SHA2566630790af959021af2c50405dd40fbf6bf283dd04e0622a8bfe5a69ca5bab496
SHA5128fec7754c330193cec728242574068b8d0fe6ba4914b6c7b63135e3ff2cb8a328ba700a9e0b441f5504849363e6014047adcd645e16d684928a904586dc51a14
-
Filesize
653KB
MD57a6d009bb8f758c5dce0830cc3ffd25b
SHA1aa666cc1f3a1c8693b0364df51785567fd81667d
SHA256a5e18aa27305328549d9606ba47417285527758f61ec9db494473cc8b1ac0bf7
SHA512747a868c61398734b16cd67d42dd7b36b50da744d0be7d9a6272c3527802ca071672c4d7714f51f0a3c103e003b9572f394ecdaf7c7f41d2d9469772c5188b97
-
Filesize
646KB
MD579551e7f460ce4a92b6c9c0f0b714108
SHA151c8cd3741482a00ee6137822f826c0f55d521c4
SHA25606ae7abcec424f92569cd67e55e27c7e91f84f6108f91876cd3f135262341bef
SHA5124e1d7bc491d21064d89414aa335915d306ea3e811d7fe237c9e111b0588189d8d37b238b7ff39159b05125eaee6637956a7f0f8e2ae51a7a5196765af62665a8
-
Filesize
130KB
MD53a57389802e43a5bc4f13e99742c218e
SHA1a070a8d60e85850d85ad650b90ff3afb8ebf6803
SHA25625cd485dd2a9e692637a6860ed3f75f810d8883781d169ee4954170fb800dca6
SHA512c131caed5786cbb4d1c3c31761314676eea6eda2daf42337edb306ea36ed791fc8ae6dff4a7f47eb5182dd1db0c5f30c66a1ca5dadf98d5337c340e8137bff20
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
4KB
-
Filesize
10.7MB
-
Filesize
4KB
-
Filesize
10.7MB
-
Filesize
4KB
-
Filesize
10.7MB
-
Filesize
10.7MB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
1.9MB
-
Filesize
4KB
-
Filesize
1.9MB
-
Filesize
4KB
-
Filesize
1.9MB
-
Filesize
4KB
-
Filesize
10.7MB
-
Filesize
704KB
-
Filesize
176KB
-
Filesize
4KB
-
Filesize
704KB
-
Filesize
176KB
-
Filesize
704KB