Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/07/2023, 07:40

General

  • Target

    e91236dbc7e72ad1ad2dee71cdc90a012de5189e21aab743966c77cc61b9e770.exe

  • Size

    444KB

  • MD5

    6f1525f32f3c9535cccad0a1e39b13c1

  • SHA1

    fbc9740a84f1077417fa0cef55af0ab1de5080a8

  • SHA256

    e91236dbc7e72ad1ad2dee71cdc90a012de5189e21aab743966c77cc61b9e770

  • SHA512

    539f173caf8892eb843bdb6bc4ada14e1c198b228cdadf528c06d91031056b99d80a52cf1f2d6b6753195ef3680878a4c8e3ddc1333c0c4902d9663994ddc52b

  • SSDEEP

    6144:jTUVEeqrNJ/wMjkQeCLbamE95OqjE5xPEQij60X0UBUaNtB:jT1rNJ4MjmMGjoxPLimSUal

Score
7/10

Malware Config

Signatures

  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
  • Modifies registry class 32 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e91236dbc7e72ad1ad2dee71cdc90a012de5189e21aab743966c77cc61b9e770.exe
    "C:\Users\Admin\AppData\Local\Temp\e91236dbc7e72ad1ad2dee71cdc90a012de5189e21aab743966c77cc61b9e770.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1216
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe C:\Users\Public\Music\2SMCwp
      2⤵
        PID:4692
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5088
      • C:\Users\Admin\AppData\Roaming\Vf9_S\q6NG.exe
        "C:\Users\Admin\AppData\Roaming\Vf9_S\q6NG.exe" -n C:\Users\Admin\AppData\Roaming\Vf9_S\60T.zip -d C:\Users\Admin\AppData\Roaming
        2⤵
        • Drops startup file
        • Executes dropped EXE
        PID:1664
      • C:\Users\Public\Documents\etvc\Iyslb5\wc2WPG.exe
        "C:\Users\Public\Documents\etvc\Iyslb5\wc2WPG.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Enumerates connected drives
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:4588
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:2308

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\Vf9_S\60T.zip

        Filesize

        1KB

        MD5

        77e2e3847369d485d2c41483206bd468

        SHA1

        4a20afcf4a1ff65d8948fb36044350d6363b2f13

        SHA256

        c528457ee083f39fb9a506c5ec9b11680f50cf4bde66a8b9498a334a89b4dc2d

        SHA512

        746356cc6477e87d03ea23c1dd7f9354447af7085d14dd55e2d9cdeb6fe5ee452d84527cb8c7de3d8c00e9944e16df81e0164d636cd2105e227a95e1de75dcad

      • C:\Users\Admin\AppData\Roaming\Vf9_S\VCsite_ingcure.lnk

        Filesize

        1KB

        MD5

        6eb2aa66913b439af94d2d09585ad101

        SHA1

        675e8dc94c955bca3a391baca88c760c635e634a

        SHA256

        494df97a52a4fcff3a77b493c94321ba473adaf97f95a1041d152b1b439498bb

        SHA512

        d9005c02d3b5bd777936c78e17c38f7b5baa2de3eeb8423ef35c76f941ea8a6eaf386ae5dbc77b144ba10beade6fc444fdadbe64b4eb05865acea1b0dc1c5ce8

      • C:\Users\Admin\AppData\Roaming\Vf9_S\q6NG.exe

        Filesize

        123KB

        MD5

        d45ac76aff1438925578bbaeff0a07a9

        SHA1

        d2def1fdbe2e8fe91055ef8defdda431a01c80dc

        SHA256

        bf9eea98236e80d7726473a7cde8d9c780d5f055186934b5932c16390be711cb

        SHA512

        4fac746faadb83f5b96eda6e9f513b5c2f8f2c91e7d9f4666927222a9385f81a52bd52ae738644d944f7f7b9f4c30c35299593630a94807119f830db26992fb3

      • C:\Users\Admin\AppData\Roaming\Vf9_S\q6NG.exe

        Filesize

        123KB

        MD5

        d45ac76aff1438925578bbaeff0a07a9

        SHA1

        d2def1fdbe2e8fe91055ef8defdda431a01c80dc

        SHA256

        bf9eea98236e80d7726473a7cde8d9c780d5f055186934b5932c16390be711cb

        SHA512

        4fac746faadb83f5b96eda6e9f513b5c2f8f2c91e7d9f4666927222a9385f81a52bd52ae738644d944f7f7b9f4c30c35299593630a94807119f830db26992fb3

      • C:\Users\Admin\AppData\Roaming\Vf9_S\q6NG.exe

        Filesize

        123KB

        MD5

        d45ac76aff1438925578bbaeff0a07a9

        SHA1

        d2def1fdbe2e8fe91055ef8defdda431a01c80dc

        SHA256

        bf9eea98236e80d7726473a7cde8d9c780d5f055186934b5932c16390be711cb

        SHA512

        4fac746faadb83f5b96eda6e9f513b5c2f8f2c91e7d9f4666927222a9385f81a52bd52ae738644d944f7f7b9f4c30c35299593630a94807119f830db26992fb3

      • C:\Users\Public\Documents\etvc\Iyslb5\PBVM125.dll

        Filesize

        1.3MB

        MD5

        4dfb5fe0d0ee7d8593978c1334786935

        SHA1

        6ec48e2e9b2c6d7d52da7672ca3b745055a9e7f4

        SHA256

        ebbcd546051445c20e295f4e8a13bc530a43673f794020b8e5ace8b3961c7abd

        SHA512

        e2c19e2ee710122d238c82445c8defd67cc0b1352f4d1d73d9b546806482e0c2923da9a6a0c34201a5137e1d4400abc9b218b1ab3fa6b721eb8b08cd4ad740dc

      • C:\Users\Public\Documents\etvc\Iyslb5\PBVM125.dll

        Filesize

        1.3MB

        MD5

        4dfb5fe0d0ee7d8593978c1334786935

        SHA1

        6ec48e2e9b2c6d7d52da7672ca3b745055a9e7f4

        SHA256

        ebbcd546051445c20e295f4e8a13bc530a43673f794020b8e5ace8b3961c7abd

        SHA512

        e2c19e2ee710122d238c82445c8defd67cc0b1352f4d1d73d9b546806482e0c2923da9a6a0c34201a5137e1d4400abc9b218b1ab3fa6b721eb8b08cd4ad740dc

      • C:\Users\Public\Documents\etvc\Iyslb5\PBVM125.dll

        Filesize

        1.3MB

        MD5

        4dfb5fe0d0ee7d8593978c1334786935

        SHA1

        6ec48e2e9b2c6d7d52da7672ca3b745055a9e7f4

        SHA256

        ebbcd546051445c20e295f4e8a13bc530a43673f794020b8e5ace8b3961c7abd

        SHA512

        e2c19e2ee710122d238c82445c8defd67cc0b1352f4d1d73d9b546806482e0c2923da9a6a0c34201a5137e1d4400abc9b218b1ab3fa6b721eb8b08cd4ad740dc

      • C:\Users\Public\Documents\etvc\Iyslb5\info.txt

        Filesize

        761KB

        MD5

        0ebd229d4e00a9fbfd263d52377fb3a6

        SHA1

        bedab8bd4497de269492c6c4895a929f026165c8

        SHA256

        2b1b96acd9459c16c9c7ed42320f4df295aa6d6f909acf1e216a70907a6cf788

        SHA512

        448a1b2c840ec7af7d1c5e1ce2f780fab256129f7022dd166f1a878751b975f1ab41a6f6668a4b8a6bd37c791fac2f0273fa25d8c1d1691b325158377d3d5b3f

      • C:\Users\Public\Documents\etvc\Iyslb5\wc2WPG.exe

        Filesize

        259KB

        MD5

        ec51f860f3aeab9c4da949b36f27c5bb

        SHA1

        73b6912da75c6c38ba2b229bf9633f4a30c21e1a

        SHA256

        7178075c87dea1655c800fa153a706a44ad2774e1d9accf24c2b8efa6400d725

        SHA512

        c6684f1e7be2b3bb2650419bd400e6a19c5358993ab63c26516a4d2d5d65365cb18357340f27ebf2312c5e68f018b4e5d1352931e0d2d1477d195f49b620c31a

      • C:\Users\Public\Documents\etvc\Iyslb5\wc2WPG.exe

        Filesize

        259KB

        MD5

        ec51f860f3aeab9c4da949b36f27c5bb

        SHA1

        73b6912da75c6c38ba2b229bf9633f4a30c21e1a

        SHA256

        7178075c87dea1655c800fa153a706a44ad2774e1d9accf24c2b8efa6400d725

        SHA512

        c6684f1e7be2b3bb2650419bd400e6a19c5358993ab63c26516a4d2d5d65365cb18357340f27ebf2312c5e68f018b4e5d1352931e0d2d1477d195f49b620c31a

      • C:\Users\Public\Documents\etvc\Iyslb5\wc2WPG.exe

        Filesize

        259KB

        MD5

        ec51f860f3aeab9c4da949b36f27c5bb

        SHA1

        73b6912da75c6c38ba2b229bf9633f4a30c21e1a

        SHA256

        7178075c87dea1655c800fa153a706a44ad2774e1d9accf24c2b8efa6400d725

        SHA512

        c6684f1e7be2b3bb2650419bd400e6a19c5358993ab63c26516a4d2d5d65365cb18357340f27ebf2312c5e68f018b4e5d1352931e0d2d1477d195f49b620c31a

      • C:\Users\Public\Fvpf82

        Filesize

        547KB

        MD5

        0699c5a5b0960ac1ed425921a4ae0efd

        SHA1

        42358554cea3e9ddc9c84b0b1e4cc96c008c478f

        SHA256

        d6fd1c77fb0bc2d7aa4b6a04c7f0b07f70cf898281b9cb7a6d509ecce5ff838f

        SHA512

        3c6e87d3c303f4e716fe25b3b5296958a2ce33cdb536315d6b2f9fa48aff14d63eb3dba016cdcd9578bca240e371dc92a09053b0e905c9ce0f653f88bd8559cc

      • C:\Users\Public\Music\2SMCwp\3JDtmg.lnk

        Filesize

        1006B

        MD5

        08597070866d722e853747abddb82950

        SHA1

        00acf4aca3f30f45afd4fec6df732c5dc86ffdff

        SHA256

        04060cf2342a1d2d6feb1f5d2ef79b3519cae54194ed2a5102c3bd21b42814a1

        SHA512

        06d376f6cbe1216edb62e46cdfa2dbe14dc6b7b6726c93b8644b2c4e02b91df2f760722fdff2e474dd161d5c80c10669b665cc277bc84eab7e1e74efb660d45b

      • C:\Users\Public\Music\2SMCwp\3KAtnd.lnk

        Filesize

        1006B

        MD5

        9a53e61f4e7a788f95b7b4d83d91bcb0

        SHA1

        3746c8bcd4b8951538f9325f879850a9524358e9

        SHA256

        e294d0fe63d4c4ae0b4247a24b395aba15d00f88f277966464b0a52922c76ee2

        SHA512

        fea2cb3c5b3691f96bf84b417db39cbb8aea5c65acb3aaeac37306231ec47e1373b2161be1befc559afffff3db8403572a1f7b5950fe17d0ea7ce0bea68707e8

      • C:\Users\Public\Music\2SMCwp\Cmc6MG.lnk

        Filesize

        1006B

        MD5

        c19abbf860d403c0eab124efe928f906

        SHA1

        23de1a9c35a78c369440d04255935818207f106d

        SHA256

        c5cfdf3a0cb1652a5999df0e8322f3a89b758c202b5b2a59a67f88612c017a01

        SHA512

        3efd7d0bb54aa638e3f30e638690c395f45e3db8b6e82fe46b468a5a06d73660c9e058bdd6c6f8946ad30bcb95be341f17fe43e2d08c5f57e6f5b581817b9076

      • C:\Users\Public\Music\2SMCwp\Djd3XQ.lnk

        Filesize

        1006B

        MD5

        11d48895fd16f121d9701cc38314a3d0

        SHA1

        8d12c1d7d9529040ba90a6a2d0e56de93c60b230

        SHA256

        e9576ef191aef8172d25be599b3f2cc8674e825b10ac977ebd2d8528cc085b05

        SHA512

        6ebbdc9dfc2216f211a67a4a4de47f7bb9f62586deca2491880a3745e23019e2f73a184994a30c84eb865a19328cf2bf519945f5703e7fc4878251260e67c194

      • C:\Users\Public\Music\2SMCwp\Dka4XN.lnk

        Filesize

        1006B

        MD5

        48e0bfbc1e177a02769a4fc94db9b1d9

        SHA1

        090f126397fbac24bd64020a0de96f9b06d69132

        SHA256

        2fc3f6881840037695d59b523cda16bde63778bed601164eb7f4edb0b29d463e

        SHA512

        9b2518c426a3df0ab23f1c91bb9e355f720d07213e5adafe06b9971ec2de76509101f3126113cb7bab314332e829e2959c3e6b74884bfb0bacde468f1f543f3a

      • C:\Users\Public\Music\2SMCwp\Fwpj92.url

        Filesize

        82B

        MD5

        f0bf767382c397a8e8f0ed11f5526d7c

        SHA1

        cc115318408a1962fd20cdfbcc4143c99ab2b450

        SHA256

        662585435f8d7e44052d3efc5f519c322012f1386865ccd9c53363f479c73ac4

        SHA512

        e775557f87ba0996b29224c095ff5d8ba7a05a67b92c3925c0431dc112049bc71318d2ca286ca8d41bf0950eb1d208e34ef125cff55b510cd8c3fede867830aa

      • C:\Users\Public\Music\2SMCwp\Fwpj92.url

        Filesize

        82B

        MD5

        f0bf767382c397a8e8f0ed11f5526d7c

        SHA1

        cc115318408a1962fd20cdfbcc4143c99ab2b450

        SHA256

        662585435f8d7e44052d3efc5f519c322012f1386865ccd9c53363f479c73ac4

        SHA512

        e775557f87ba0996b29224c095ff5d8ba7a05a67b92c3925c0431dc112049bc71318d2ca286ca8d41bf0950eb1d208e34ef125cff55b510cd8c3fede867830aa

      • C:\Users\Public\Music\2SMCwp\ICsmc5.url

        Filesize

        82B

        MD5

        f0bf767382c397a8e8f0ed11f5526d7c

        SHA1

        cc115318408a1962fd20cdfbcc4143c99ab2b450

        SHA256

        662585435f8d7e44052d3efc5f519c322012f1386865ccd9c53363f479c73ac4

        SHA512

        e775557f87ba0996b29224c095ff5d8ba7a05a67b92c3925c0431dc112049bc71318d2ca286ca8d41bf0950eb1d208e34ef125cff55b510cd8c3fede867830aa

      • C:\Users\Public\Music\2SMCwp\LFvpi9.url

        Filesize

        82B

        MD5

        f0bf767382c397a8e8f0ed11f5526d7c

        SHA1

        cc115318408a1962fd20cdfbcc4143c99ab2b450

        SHA256

        662585435f8d7e44052d3efc5f519c322012f1386865ccd9c53363f479c73ac4

        SHA512

        e775557f87ba0996b29224c095ff5d8ba7a05a67b92c3925c0431dc112049bc71318d2ca286ca8d41bf0950eb1d208e34ef125cff55b510cd8c3fede867830aa

      • C:\Users\Public\Music\2SMCwp\PICslf.url

        Filesize

        82B

        MD5

        f0bf767382c397a8e8f0ed11f5526d7c

        SHA1

        cc115318408a1962fd20cdfbcc4143c99ab2b450

        SHA256

        662585435f8d7e44052d3efc5f519c322012f1386865ccd9c53363f479c73ac4

        SHA512

        e775557f87ba0996b29224c095ff5d8ba7a05a67b92c3925c0431dc112049bc71318d2ca286ca8d41bf0950eb1d208e34ef125cff55b510cd8c3fede867830aa

      • C:\Users\Public\Music\2SMCwp\VLFyoi.url

        Filesize

        82B

        MD5

        f0bf767382c397a8e8f0ed11f5526d7c

        SHA1

        cc115318408a1962fd20cdfbcc4143c99ab2b450

        SHA256

        662585435f8d7e44052d3efc5f519c322012f1386865ccd9c53363f479c73ac4

        SHA512

        e775557f87ba0996b29224c095ff5d8ba7a05a67b92c3925c0431dc112049bc71318d2ca286ca8d41bf0950eb1d208e34ef125cff55b510cd8c3fede867830aa

      • C:\Users\Public\Music\2SMCwp\bSLCvp.lnk

        Filesize

        1006B

        MD5

        6df2f060755bcb967a4042a8f4123dae

        SHA1

        a02297f4a7e1986f58db38e9cc5a37f61134ac2a

        SHA256

        ede8d253c0c2acc0d3a2b09ad057776f8751d1f34ccfb8c12d6f2c7636377c6d

        SHA512

        f3819500fc6f8c27046002a33b1b33cefe3fba48fccaf67d3733724a5cae20d6f848d77bc4e9adb481a1694fa52e6201faf5f9861d1f48caded1fb5ec2f9a402

      • C:\Users\Public\Music\2SMCwp\eUK81S.lnk

        Filesize

        1006B

        MD5

        14809c7136cae53a2fdd7ae056055903

        SHA1

        f71e0034c48ca6ef324e972ebc444231b593b9ac

        SHA256

        2c3370f63d4dac0931d4a87fa8ab3d6bbdcd490d089394ea2ccfd2238a357090

        SHA512

        1ceeb308f2fa3371a9015edc6f1cff853426f665a1a9bc04bfcfdd6b95fc8242e4bd185fee5fabdf70014e21e9b9b4d98b4d0a122c8b1525a4430c283913cb60

      • C:\Users\Public\Music\2SMCwp\wqg93T.url

        Filesize

        82B

        MD5

        f0bf767382c397a8e8f0ed11f5526d7c

        SHA1

        cc115318408a1962fd20cdfbcc4143c99ab2b450

        SHA256

        662585435f8d7e44052d3efc5f519c322012f1386865ccd9c53363f479c73ac4

        SHA512

        e775557f87ba0996b29224c095ff5d8ba7a05a67b92c3925c0431dc112049bc71318d2ca286ca8d41bf0950eb1d208e34ef125cff55b510cd8c3fede867830aa

      • C:\Users\Public\Music\2SMCwp\ztmc6_.url

        Filesize

        82B

        MD5

        f0bf767382c397a8e8f0ed11f5526d7c

        SHA1

        cc115318408a1962fd20cdfbcc4143c99ab2b450

        SHA256

        662585435f8d7e44052d3efc5f519c322012f1386865ccd9c53363f479c73ac4

        SHA512

        e775557f87ba0996b29224c095ff5d8ba7a05a67b92c3925c0431dc112049bc71318d2ca286ca8d41bf0950eb1d208e34ef125cff55b510cd8c3fede867830aa

      • memory/1216-151-0x0000000010000000-0x0000000010046000-memory.dmp

        Filesize

        280KB

      • memory/4588-242-0x0000000000870000-0x00000000009BC000-memory.dmp

        Filesize

        1.3MB

      • memory/4588-247-0x00000000028C0000-0x0000000002908000-memory.dmp

        Filesize

        288KB