Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
25/04/2023, 16:11
230425-tmxqwsdc6w 725/04/2023, 15:53
230425-tbzq4sbc64 725/04/2023, 14:27
230425-rsv35sag93 725/04/2023, 14:26
230425-rrwchsag87 7Analysis
-
max time kernel
79s -
max time network
77s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
25/04/2023, 14:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
877_de.exe
Resource
win10-20230220-en
windows10-1703-x64
7 signatures
1200 seconds
General
-
Target
877_de.exe
-
Size
45KB
-
MD5
6cda54d3bc470583ac95532119570ffe
-
SHA1
37bb75119cf20d775265fc56dd9843e9a57fb205
-
SHA256
923e95b7ca5559b47d2c12a4c75a540943266aa39cde60c3a629a95a6b85a0a3
-
SHA512
65cc0e85931d237f92261be586a31e1e75963267ba6c518fbf55e6d5fa35c72f94fff5107e2d54c8d34dbf576a52861042e93601e1a136844ade5f98ad2089f2
-
SSDEEP
768:3KHHfuj+ZHaIQB9uz7SXnJHw+NVTGzxpHWilnSFIy1DYVugsTTm8oZrzqJIEo1iN:aHK+ZHaTXNZOxpZTy1IsTTm84rzr1lNY
Score
7/10
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x000500000001a2b4-122.dat acprotect -
Loads dropped DLL 1 IoCs
pid Process 2556 877_de.exe -
resource yara_rule behavioral1/files/0x000500000001a2b4-122.dat upx behavioral1/memory/2556-129-0x0000000075000000-0x0000000075007000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\owjjtcuu = "C:\\Windows\\system32\\xpfpnwws.exe" 877_de.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\lcrxd.dll 877_de.exe File opened for modification C:\Windows\SysWOW64\xpfpnwws.exe 877_de.exe File created C:\Windows\SysWOW64\xpfpnwws.exe 877_de.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\VSTO\nyncpiwkmilg.zip 877_de.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\nqdoeinuan.zip 877_de.exe File created C:\Program Files\Common Files\microsoft shared\ink\ko-KR\wupy.zip 877_de.exe File created C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\dtzxplxomm.zip 877_de.exe File created C:\Program Files\Common Files\microsoft shared\TextConv\qlzcpbztwnjp.zip 877_de.exe File created C:\Program Files\Common Files\microsoft shared\Triedit\en-US\qydxmywqub.zip 877_de.exe File created C:\Program Files\Common Files\microsoft shared\VGX\fgrkjyh.zip 877_de.exe File created C:\Program Files\Common Files\microsoft shared\ink\hr-HR\ogtg.zip 877_de.exe File created C:\Program Files\Common Files\microsoft shared\ink\zh-CN\nzpilil.zip 877_de.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\zvuidy.exe 877_de.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\wlgshlipxnzk.zip 877_de.exe File created C:\Program Files\Common Files\microsoft shared\ink\ro-RO\lvjcvalolvuv.zip 877_de.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\ptjijxxwczj.zip 877_de.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\de-DE\yimjbkzixtj.zip 877_de.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-CA\uhctx.zip 877_de.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\tedlvkmro.zip 877_de.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\xqdjato.zip 877_de.exe File created C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\dpxoro.zip 877_de.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\skbp.exe 877_de.exe File created C:\Program Files\Common Files\microsoft shared\ink\hu-HU\glfhfxxvbpetl.zip 877_de.exe File created C:\Program Files\Common Files\microsoft shared\ink\achnyy.zip 877_de.exe File created C:\Program Files\Common Files\microsoft shared\ink\et-EE\vhxvpa.zip 877_de.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\cmm\pcexevsi.zip 877_de.exe File created C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\ngtax.exe 877_de.exe File created C:\Program Files\Common Files\microsoft shared\ink\bg-BG\wrlduxgqxnkl.zip 877_de.exe File created C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\sfxleezowes.zip 877_de.exe File created C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\ttpflqamhckve.zip 877_de.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\durhbokoclis.zip 877_de.exe File created C:\Program Files\Common Files\System\msadc\dhrrm.zip 877_de.exe File created C:\Program Files\VideoLAN\VLC\locale\ia\tmcg.exe 877_de.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\zcmgissghbfyw.zip 877_de.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\zvycmaue.zip 877_de.exe File created C:\Program Files\Common Files\microsoft shared\ink\el-GR\ikrdomnlxou.zip 877_de.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\bmbptgnbi.exe 877_de.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\orsbygzehzta.zip 877_de.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\gycxxiouxs.zip 877_de.exe File created C:\Program Files\Common Files\microsoft shared\ink\nl-NL\usgvoklbxxnii.exe 877_de.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\svgmoxwafa.zip 877_de.exe File created C:\Program Files\Common Files\System\ado\ja-JP\bqzuqdzyluahd.zip 877_de.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\uvpwi.exe 877_de.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Help\kisitboayxmf.zip 877_de.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\zlnynjpkkrynd.exe 877_de.exe File created C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\vcqskleh.zip 877_de.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\ghsgyqhij.zip 877_de.exe File created C:\Program Files\Common Files\microsoft shared\ink\pt-BR\hzdj.zip 877_de.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\tmpzdnipp.zip 877_de.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\rtxutltltxt.zip 877_de.exe File created C:\Program Files\Common Files\microsoft shared\ink\da-DK\oksunle.zip 877_de.exe File created C:\Program Files\Common Files\microsoft shared\ink\lv-LV\xjzmww.zip 877_de.exe File created C:\Program Files\Common Files\microsoft shared\ink\tr-TR\zkyaefnivgi.exe 877_de.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-BA\tyszsgoagfw.exe 877_de.exe File created C:\Program Files\VideoLAN\VLC\locale\lt\buushgoplibxg.zip 877_de.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\mmla.exe 877_de.exe File created C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\epeoges.zip 877_de.exe File created C:\Program Files\VideoLAN\VLC\locale\eu\qwrrdnamtxf.zip 877_de.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-GB\psctwo.zip 877_de.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\golwr.zip 877_de.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\ukoglwumlni.zip 877_de.exe File created C:\Program Files\Microsoft Office\root\Office16\STARTUP\hdsdphnurpfc.zip 877_de.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\rrgsdslvcs.zip 877_de.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-MX\hhbk.zip 877_de.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\jheejdlun.zip 877_de.exe File created C:\Program Files\Common Files\microsoft shared\tkkxzyzjdfpl.exe 877_de.exe File created C:\Program Files\Common Files\microsoft shared\Triedit\cznyquji.zip 877_de.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2556 877_de.exe 2556 877_de.exe 2556 877_de.exe 2556 877_de.exe 2556 877_de.exe 2556 877_de.exe 2556 877_de.exe 2556 877_de.exe 2556 877_de.exe 2556 877_de.exe 2556 877_de.exe 2556 877_de.exe 2556 877_de.exe 2556 877_de.exe 2556 877_de.exe 2556 877_de.exe 2556 877_de.exe 2556 877_de.exe 2556 877_de.exe 2556 877_de.exe 2556 877_de.exe 2556 877_de.exe 2556 877_de.exe 2556 877_de.exe 2556 877_de.exe 2556 877_de.exe 2556 877_de.exe 2556 877_de.exe 2556 877_de.exe 2556 877_de.exe 2556 877_de.exe 2556 877_de.exe 2556 877_de.exe 2556 877_de.exe 2556 877_de.exe 2556 877_de.exe 2556 877_de.exe 2556 877_de.exe 2556 877_de.exe 2556 877_de.exe 2556 877_de.exe 2556 877_de.exe 2556 877_de.exe 2556 877_de.exe 2556 877_de.exe 2556 877_de.exe 2556 877_de.exe 2556 877_de.exe 2556 877_de.exe 2556 877_de.exe 2556 877_de.exe 2556 877_de.exe 2556 877_de.exe 2556 877_de.exe 2556 877_de.exe 2556 877_de.exe 2556 877_de.exe 2556 877_de.exe 2556 877_de.exe 2556 877_de.exe 2556 877_de.exe 2556 877_de.exe 2556 877_de.exe 2556 877_de.exe
Processes
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
45KB
MD56cda54d3bc470583ac95532119570ffe
SHA137bb75119cf20d775265fc56dd9843e9a57fb205
SHA256923e95b7ca5559b47d2c12a4c75a540943266aa39cde60c3a629a95a6b85a0a3
SHA51265cc0e85931d237f92261be586a31e1e75963267ba6c518fbf55e6d5fa35c72f94fff5107e2d54c8d34dbf576a52861042e93601e1a136844ade5f98ad2089f2
-
Filesize
9KB
MD54436d9f8aca143ff228687e2b40c016f
SHA197cc0ca7d2c21bef453f68fa0d4562d0c058ad0d
SHA2560c40a3e9477df00f32ef032aa7bb6473842c0f8459914d9313718cf95f96f880
SHA512ad1f22d056a9edbbe4476273667c67710be8ea98408c842880c79f4787ef80233915aa7df59da7bd6d500e772f1c0f1be30229c7cd415228dfd89287b8663fb9