Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    15/10/2023, 19:40

General

  • Target

    84909bc817ee332341e8f9c1352333c0_exe32.exe

  • Size

    376KB

  • MD5

    84909bc817ee332341e8f9c1352333c0

  • SHA1

    1cb6de0adcde5ffcb6afc1df9e008db79849ce90

  • SHA256

    57bbb78700ffee2399d780585d09c76f9c66eae44cf1c5d3d8765dd2b20cd287

  • SHA512

    ccd73768a59ca8439bcbfbdb4eba8cf3702991257009a6dc30bd14a975c618233b85f8abfc361edb829afcf564e9f70cea436caa14221f4daff055ca948f84af

  • SSDEEP

    6144:OaNc//////zIwTBXQ+y6WZQAxwni1NalRFQQwrD9vucACjWkhC/qlluyKoC5U:O8c//////UwTd3i1NaxErD9mcAWWxH9U

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies Installed Components in the registry 2 TTPs 3 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 10 IoCs
  • UPX packed file 30 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 47 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\84909bc817ee332341e8f9c1352333c0_exe32.exe
    "C:\Users\Admin\AppData\Local\Temp\84909bc817ee332341e8f9c1352333c0_exe32.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3064
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c "C:\Users\Admin\AppData\Local\Temp\Qvodpppp.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2480
      • C:\Users\Admin\AppData\Local\Temp\Qvodpppp.exe
        C:\Users\Admin\AppData\Local\Temp\Qvodpppp.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2952
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c "C:\Users\Admin\AppData\Local\Temp\down.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2684
      • C:\Users\Admin\AppData\Local\Temp\down.exe
        C:\Users\Admin\AppData\Local\Temp\down.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2752
        • C:\Users\Admin\AppData\Local\Temp\down.exe
          C:\Users\Admin\AppData\Local\Temp\down.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:2744
          • C:\WINDOWS\Qedie\conime.exe
            C:\WINDOWS\Qedie\conime.exe
            5⤵
            • Modifies Installed Components in the registry
            • Executes dropped EXE
            PID:2964
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c "C:\Users\Admin\AppData\Local\Temp\888xi.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2584
      • C:\Users\Admin\AppData\Local\Temp\888xi.exe
        C:\Users\Admin\AppData\Local\Temp\888xi.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2576
        • C:\ProgramData\DownloadSave\wyhmbsc.exe
          "C:\ProgramData\DownloadSave\wyhmbsc.exe"
          4⤵
          • Modifies WinLogon for persistence
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2164
          • C:\ProgramData\DownloadSave\ wyhmbsc.exe
            "C:\ProgramData\DownloadSave\ wyhmbsc.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:1648
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c erase /F "C:\Users\Admin\AppData\Local\Temp\84909bc817ee332341e8f9c1352333c0_exe32.exe"
      2⤵
      • Deletes itself
      PID:2680

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\DownloadSave\ wyhmbsc.exe

    Filesize

    129KB

    MD5

    a50d4d35f9fbf3eefefc0a4ee8b082a5

    SHA1

    b52d0af01bec86b11a1ba2ac6f04ff5c79caf909

    SHA256

    9c17d21d58bbb2b431df0636758343e0b296de878549317b8b2a1d24adbb4648

    SHA512

    1415e3a95764214185ebaddb3c02d7a72a93192b25371eaeaf36b84a3939124bdc6c3db58c9e3f4fc96f47cbe240338b37845ee752bcc9ec4e2266ac81214057

  • C:\ProgramData\DownloadSave\RecordPath

    Filesize

    260B

    MD5

    b08b8d758962efc14172eecc9a266ba9

    SHA1

    419ae812006ec27a3d362646142b5fe97fb4c26e

    SHA256

    3ef8f93d2cc1951a990b86eb2c9065d340d60c6ac9bdcd5e3a3ec1134e6e95fb

    SHA512

    128078f964e30166f83615d72117f4273b7c754f80a49b7001a2d79456fde1b360cb0014c3a943dde52ce8191e0263fc8a67525f706494d02c203bbf71849271

  • C:\ProgramData\DownloadSave\wyhmbsc.exe

    Filesize

    129KB

    MD5

    a50d4d35f9fbf3eefefc0a4ee8b082a5

    SHA1

    b52d0af01bec86b11a1ba2ac6f04ff5c79caf909

    SHA256

    9c17d21d58bbb2b431df0636758343e0b296de878549317b8b2a1d24adbb4648

    SHA512

    1415e3a95764214185ebaddb3c02d7a72a93192b25371eaeaf36b84a3939124bdc6c3db58c9e3f4fc96f47cbe240338b37845ee752bcc9ec4e2266ac81214057

  • C:\ProgramData\DownloadSave\wyhmbsc.exe

    Filesize

    129KB

    MD5

    a50d4d35f9fbf3eefefc0a4ee8b082a5

    SHA1

    b52d0af01bec86b11a1ba2ac6f04ff5c79caf909

    SHA256

    9c17d21d58bbb2b431df0636758343e0b296de878549317b8b2a1d24adbb4648

    SHA512

    1415e3a95764214185ebaddb3c02d7a72a93192b25371eaeaf36b84a3939124bdc6c3db58c9e3f4fc96f47cbe240338b37845ee752bcc9ec4e2266ac81214057

  • C:\ProgramData\DownloadSave\wyhmbsc.exe

    Filesize

    129KB

    MD5

    a50d4d35f9fbf3eefefc0a4ee8b082a5

    SHA1

    b52d0af01bec86b11a1ba2ac6f04ff5c79caf909

    SHA256

    9c17d21d58bbb2b431df0636758343e0b296de878549317b8b2a1d24adbb4648

    SHA512

    1415e3a95764214185ebaddb3c02d7a72a93192b25371eaeaf36b84a3939124bdc6c3db58c9e3f4fc96f47cbe240338b37845ee752bcc9ec4e2266ac81214057

  • C:\Users\Admin\AppData\Local\Temp\888xi.exe

    Filesize

    129KB

    MD5

    a50d4d35f9fbf3eefefc0a4ee8b082a5

    SHA1

    b52d0af01bec86b11a1ba2ac6f04ff5c79caf909

    SHA256

    9c17d21d58bbb2b431df0636758343e0b296de878549317b8b2a1d24adbb4648

    SHA512

    1415e3a95764214185ebaddb3c02d7a72a93192b25371eaeaf36b84a3939124bdc6c3db58c9e3f4fc96f47cbe240338b37845ee752bcc9ec4e2266ac81214057

  • C:\Users\Admin\AppData\Local\Temp\888xi.exe

    Filesize

    129KB

    MD5

    a50d4d35f9fbf3eefefc0a4ee8b082a5

    SHA1

    b52d0af01bec86b11a1ba2ac6f04ff5c79caf909

    SHA256

    9c17d21d58bbb2b431df0636758343e0b296de878549317b8b2a1d24adbb4648

    SHA512

    1415e3a95764214185ebaddb3c02d7a72a93192b25371eaeaf36b84a3939124bdc6c3db58c9e3f4fc96f47cbe240338b37845ee752bcc9ec4e2266ac81214057

  • C:\Users\Admin\AppData\Local\Temp\Qvodpppp.exe

    Filesize

    143KB

    MD5

    2987cc45d528ff2aa8b1e79e3e1c0740

    SHA1

    6cf95062963e72289954d5ac43f869ad7fc2c502

    SHA256

    93e6eee272e3f5e2f12247781c4787a5e7428b27b6afb371eb0cf3e7361a0c89

    SHA512

    72c5004b4735f4f974a164fdc86f5457788868d756491e3d7c4fa2c43864bc79e48861d9db0d59efe29d72c6518a7ee935759600ce04a38a08239d433ec0b04c

  • C:\Users\Admin\AppData\Local\Temp\Qvodpppp.exe

    Filesize

    143KB

    MD5

    2987cc45d528ff2aa8b1e79e3e1c0740

    SHA1

    6cf95062963e72289954d5ac43f869ad7fc2c502

    SHA256

    93e6eee272e3f5e2f12247781c4787a5e7428b27b6afb371eb0cf3e7361a0c89

    SHA512

    72c5004b4735f4f974a164fdc86f5457788868d756491e3d7c4fa2c43864bc79e48861d9db0d59efe29d72c6518a7ee935759600ce04a38a08239d433ec0b04c

  • C:\Users\Admin\AppData\Local\Temp\down.exe

    Filesize

    8KB

    MD5

    1820084a044728818d133372da8d57f6

    SHA1

    8274ff35d8bbfe97004930f95a6d8c6aa72c8f1c

    SHA256

    7b68bf1fcc6e84a35b1ae18b4de1e7f0036df174bbdd5a3818df76cab4ae7029

    SHA512

    7a1d22c4c8e71e741b6df8def51cfc9d19558e52349e5dab0be08d6c7ce3077527e26aca64de6e22b28dc5b10d57c2fc3add3ae0d82c0bbc77db1f98c3149711

  • C:\Users\Admin\AppData\Local\Temp\down.exe

    Filesize

    8KB

    MD5

    1820084a044728818d133372da8d57f6

    SHA1

    8274ff35d8bbfe97004930f95a6d8c6aa72c8f1c

    SHA256

    7b68bf1fcc6e84a35b1ae18b4de1e7f0036df174bbdd5a3818df76cab4ae7029

    SHA512

    7a1d22c4c8e71e741b6df8def51cfc9d19558e52349e5dab0be08d6c7ce3077527e26aca64de6e22b28dc5b10d57c2fc3add3ae0d82c0bbc77db1f98c3149711

  • C:\Users\Admin\AppData\Local\Temp\down.exe

    Filesize

    8KB

    MD5

    1820084a044728818d133372da8d57f6

    SHA1

    8274ff35d8bbfe97004930f95a6d8c6aa72c8f1c

    SHA256

    7b68bf1fcc6e84a35b1ae18b4de1e7f0036df174bbdd5a3818df76cab4ae7029

    SHA512

    7a1d22c4c8e71e741b6df8def51cfc9d19558e52349e5dab0be08d6c7ce3077527e26aca64de6e22b28dc5b10d57c2fc3add3ae0d82c0bbc77db1f98c3149711

  • C:\Windows\Qedie\conime.exe

    Filesize

    19KB

    MD5

    a4ffc7615609bc3ce2fda7b1e048f407

    SHA1

    1ddd680906a2c3dd86b0a60d347f87464d0ce137

    SHA256

    8313ed836d8547560bce5c20cc61f159f14ef0303b65327b75a8a5831f89e17a

    SHA512

    5c0f05215828899be02a1b4191cbaa32c09861cafffffe642c6cabb40a190c3783961962c31ccb9a878214cecaeb59d43370d10d9651ec137e01b17af3efdca8

  • C:\Windows\Qedie\conime.exe

    Filesize

    19KB

    MD5

    a4ffc7615609bc3ce2fda7b1e048f407

    SHA1

    1ddd680906a2c3dd86b0a60d347f87464d0ce137

    SHA256

    8313ed836d8547560bce5c20cc61f159f14ef0303b65327b75a8a5831f89e17a

    SHA512

    5c0f05215828899be02a1b4191cbaa32c09861cafffffe642c6cabb40a190c3783961962c31ccb9a878214cecaeb59d43370d10d9651ec137e01b17af3efdca8

  • \??\c:\Program Files\abc.txt

    Filesize

    42B

    MD5

    f33be8c8213c81375eae4be8ffb73314

    SHA1

    5897222faaf3488fc7d03347ca0877c32f80444f

    SHA256

    e21ff3cdfed512e75a40a07346dd7d606cdfbe8f8f7f1664b168bd512785986d

    SHA512

    b13a5c29380c70a602aa88f919b96092762cb53ca1517c09f8a8995a59b2fefdfae2bff995845ddfdf50a0028940f55ac263a28a846017b8bf7ab13cc3355a30

  • \ProgramData\DownloadSave\ wyhmbsc.exe

    Filesize

    129KB

    MD5

    a50d4d35f9fbf3eefefc0a4ee8b082a5

    SHA1

    b52d0af01bec86b11a1ba2ac6f04ff5c79caf909

    SHA256

    9c17d21d58bbb2b431df0636758343e0b296de878549317b8b2a1d24adbb4648

    SHA512

    1415e3a95764214185ebaddb3c02d7a72a93192b25371eaeaf36b84a3939124bdc6c3db58c9e3f4fc96f47cbe240338b37845ee752bcc9ec4e2266ac81214057

  • \ProgramData\DownloadSave\wyhmbsc.exe

    Filesize

    129KB

    MD5

    a50d4d35f9fbf3eefefc0a4ee8b082a5

    SHA1

    b52d0af01bec86b11a1ba2ac6f04ff5c79caf909

    SHA256

    9c17d21d58bbb2b431df0636758343e0b296de878549317b8b2a1d24adbb4648

    SHA512

    1415e3a95764214185ebaddb3c02d7a72a93192b25371eaeaf36b84a3939124bdc6c3db58c9e3f4fc96f47cbe240338b37845ee752bcc9ec4e2266ac81214057

  • \Users\Admin\AppData\Local\Temp\888xi.exe

    Filesize

    129KB

    MD5

    a50d4d35f9fbf3eefefc0a4ee8b082a5

    SHA1

    b52d0af01bec86b11a1ba2ac6f04ff5c79caf909

    SHA256

    9c17d21d58bbb2b431df0636758343e0b296de878549317b8b2a1d24adbb4648

    SHA512

    1415e3a95764214185ebaddb3c02d7a72a93192b25371eaeaf36b84a3939124bdc6c3db58c9e3f4fc96f47cbe240338b37845ee752bcc9ec4e2266ac81214057

  • \Users\Admin\AppData\Local\Temp\Qvodpppp.exe

    Filesize

    143KB

    MD5

    2987cc45d528ff2aa8b1e79e3e1c0740

    SHA1

    6cf95062963e72289954d5ac43f869ad7fc2c502

    SHA256

    93e6eee272e3f5e2f12247781c4787a5e7428b27b6afb371eb0cf3e7361a0c89

    SHA512

    72c5004b4735f4f974a164fdc86f5457788868d756491e3d7c4fa2c43864bc79e48861d9db0d59efe29d72c6518a7ee935759600ce04a38a08239d433ec0b04c

  • \Users\Admin\AppData\Local\Temp\Qvodpppp.exe

    Filesize

    143KB

    MD5

    2987cc45d528ff2aa8b1e79e3e1c0740

    SHA1

    6cf95062963e72289954d5ac43f869ad7fc2c502

    SHA256

    93e6eee272e3f5e2f12247781c4787a5e7428b27b6afb371eb0cf3e7361a0c89

    SHA512

    72c5004b4735f4f974a164fdc86f5457788868d756491e3d7c4fa2c43864bc79e48861d9db0d59efe29d72c6518a7ee935759600ce04a38a08239d433ec0b04c

  • \Users\Admin\AppData\Local\Temp\Qvodpppp.exe

    Filesize

    143KB

    MD5

    2987cc45d528ff2aa8b1e79e3e1c0740

    SHA1

    6cf95062963e72289954d5ac43f869ad7fc2c502

    SHA256

    93e6eee272e3f5e2f12247781c4787a5e7428b27b6afb371eb0cf3e7361a0c89

    SHA512

    72c5004b4735f4f974a164fdc86f5457788868d756491e3d7c4fa2c43864bc79e48861d9db0d59efe29d72c6518a7ee935759600ce04a38a08239d433ec0b04c

  • \Users\Admin\AppData\Local\Temp\Qvodpppp.exe

    Filesize

    143KB

    MD5

    2987cc45d528ff2aa8b1e79e3e1c0740

    SHA1

    6cf95062963e72289954d5ac43f869ad7fc2c502

    SHA256

    93e6eee272e3f5e2f12247781c4787a5e7428b27b6afb371eb0cf3e7361a0c89

    SHA512

    72c5004b4735f4f974a164fdc86f5457788868d756491e3d7c4fa2c43864bc79e48861d9db0d59efe29d72c6518a7ee935759600ce04a38a08239d433ec0b04c

  • \Users\Admin\AppData\Local\Temp\down.exe

    Filesize

    8KB

    MD5

    1820084a044728818d133372da8d57f6

    SHA1

    8274ff35d8bbfe97004930f95a6d8c6aa72c8f1c

    SHA256

    7b68bf1fcc6e84a35b1ae18b4de1e7f0036df174bbdd5a3818df76cab4ae7029

    SHA512

    7a1d22c4c8e71e741b6df8def51cfc9d19558e52349e5dab0be08d6c7ce3077527e26aca64de6e22b28dc5b10d57c2fc3add3ae0d82c0bbc77db1f98c3149711

  • \Users\Admin\AppData\Local\Temp\down.exe

    Filesize

    8KB

    MD5

    1820084a044728818d133372da8d57f6

    SHA1

    8274ff35d8bbfe97004930f95a6d8c6aa72c8f1c

    SHA256

    7b68bf1fcc6e84a35b1ae18b4de1e7f0036df174bbdd5a3818df76cab4ae7029

    SHA512

    7a1d22c4c8e71e741b6df8def51cfc9d19558e52349e5dab0be08d6c7ce3077527e26aca64de6e22b28dc5b10d57c2fc3add3ae0d82c0bbc77db1f98c3149711

  • \Windows\Qedie\conime.exe

    Filesize

    19KB

    MD5

    a4ffc7615609bc3ce2fda7b1e048f407

    SHA1

    1ddd680906a2c3dd86b0a60d347f87464d0ce137

    SHA256

    8313ed836d8547560bce5c20cc61f159f14ef0303b65327b75a8a5831f89e17a

    SHA512

    5c0f05215828899be02a1b4191cbaa32c09861cafffffe642c6cabb40a190c3783961962c31ccb9a878214cecaeb59d43370d10d9651ec137e01b17af3efdca8

  • memory/2480-3-0x00000000001A0000-0x00000000001F8000-memory.dmp

    Filesize

    352KB

  • memory/2684-9-0x0000000000220000-0x0000000000229000-memory.dmp

    Filesize

    36KB

  • memory/2744-29-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/2744-26-0x0000000000230000-0x0000000000239000-memory.dmp

    Filesize

    36KB

  • memory/2752-10-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/2752-12-0x0000000000230000-0x0000000000239000-memory.dmp

    Filesize

    36KB

  • memory/2952-58-0x0000000002E10000-0x0000000003014000-memory.dmp

    Filesize

    2.0MB

  • memory/2952-62-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/2952-33-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/2952-22-0x0000000000850000-0x00000000008A8000-memory.dmp

    Filesize

    352KB

  • memory/2952-31-0x0000000002E10000-0x0000000003014000-memory.dmp

    Filesize

    2.0MB

  • memory/2952-30-0x0000000002E10000-0x0000000003014000-memory.dmp

    Filesize

    2.0MB

  • memory/2952-57-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/2952-84-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/2952-80-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/2952-64-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/2952-60-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/2952-68-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/2952-70-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/2952-74-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/2952-78-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/2964-28-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/3064-35-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB