Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/10/2023, 19:40

General

  • Target

    84909bc817ee332341e8f9c1352333c0_exe32.exe

  • Size

    376KB

  • MD5

    84909bc817ee332341e8f9c1352333c0

  • SHA1

    1cb6de0adcde5ffcb6afc1df9e008db79849ce90

  • SHA256

    57bbb78700ffee2399d780585d09c76f9c66eae44cf1c5d3d8765dd2b20cd287

  • SHA512

    ccd73768a59ca8439bcbfbdb4eba8cf3702991257009a6dc30bd14a975c618233b85f8abfc361edb829afcf564e9f70cea436caa14221f4daff055ca948f84af

  • SSDEEP

    6144:OaNc//////zIwTBXQ+y6WZQAxwni1NalRFQQwrD9vucACjWkhC/qlluyKoC5U:O8c//////UwTd3i1NaxErD9mcAWWxH9U

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies Installed Components in the registry 2 TTPs 3 IoCs
  • Executes dropped EXE 7 IoCs
  • UPX packed file 24 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\84909bc817ee332341e8f9c1352333c0_exe32.exe
    "C:\Users\Admin\AppData\Local\Temp\84909bc817ee332341e8f9c1352333c0_exe32.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3184
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c "C:\Users\Admin\AppData\Local\Temp\Qvodpppp.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2212
      • C:\Users\Admin\AppData\Local\Temp\Qvodpppp.exe
        C:\Users\Admin\AppData\Local\Temp\Qvodpppp.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4760
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c "C:\Users\Admin\AppData\Local\Temp\down.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3368
      • C:\Users\Admin\AppData\Local\Temp\down.exe
        C:\Users\Admin\AppData\Local\Temp\down.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4008
        • C:\Users\Admin\AppData\Local\Temp\down.exe
          C:\Users\Admin\AppData\Local\Temp\down.exe
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:1240
          • C:\WINDOWS\Qedie\conime.exe
            C:\WINDOWS\Qedie\conime.exe
            5⤵
            • Modifies Installed Components in the registry
            • Executes dropped EXE
            PID:3824
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c "C:\Users\Admin\AppData\Local\Temp\888xi.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2016
      • C:\Users\Admin\AppData\Local\Temp\888xi.exe
        C:\Users\Admin\AppData\Local\Temp\888xi.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4392
        • C:\ProgramData\DownloadSave\gcugeqt.exe
          "C:\ProgramData\DownloadSave\gcugeqt.exe"
          4⤵
          • Modifies WinLogon for persistence
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1836
          • C:\ProgramData\DownloadSave\ gcugeqt.exe
            "C:\ProgramData\DownloadSave\ gcugeqt.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:2768
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c erase /F "C:\Users\Admin\AppData\Local\Temp\84909bc817ee332341e8f9c1352333c0_exe32.exe"
      2⤵
        PID:1176

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\DownloadSave\ gcugeqt.exe

      Filesize

      129KB

      MD5

      a50d4d35f9fbf3eefefc0a4ee8b082a5

      SHA1

      b52d0af01bec86b11a1ba2ac6f04ff5c79caf909

      SHA256

      9c17d21d58bbb2b431df0636758343e0b296de878549317b8b2a1d24adbb4648

      SHA512

      1415e3a95764214185ebaddb3c02d7a72a93192b25371eaeaf36b84a3939124bdc6c3db58c9e3f4fc96f47cbe240338b37845ee752bcc9ec4e2266ac81214057

    • C:\ProgramData\DownloadSave\ gcugeqt.exe

      Filesize

      129KB

      MD5

      a50d4d35f9fbf3eefefc0a4ee8b082a5

      SHA1

      b52d0af01bec86b11a1ba2ac6f04ff5c79caf909

      SHA256

      9c17d21d58bbb2b431df0636758343e0b296de878549317b8b2a1d24adbb4648

      SHA512

      1415e3a95764214185ebaddb3c02d7a72a93192b25371eaeaf36b84a3939124bdc6c3db58c9e3f4fc96f47cbe240338b37845ee752bcc9ec4e2266ac81214057

    • C:\ProgramData\DownloadSave\RecordPath

      Filesize

      260B

      MD5

      b08b8d758962efc14172eecc9a266ba9

      SHA1

      419ae812006ec27a3d362646142b5fe97fb4c26e

      SHA256

      3ef8f93d2cc1951a990b86eb2c9065d340d60c6ac9bdcd5e3a3ec1134e6e95fb

      SHA512

      128078f964e30166f83615d72117f4273b7c754f80a49b7001a2d79456fde1b360cb0014c3a943dde52ce8191e0263fc8a67525f706494d02c203bbf71849271

    • C:\ProgramData\DownloadSave\gcugeqt.exe

      Filesize

      129KB

      MD5

      a50d4d35f9fbf3eefefc0a4ee8b082a5

      SHA1

      b52d0af01bec86b11a1ba2ac6f04ff5c79caf909

      SHA256

      9c17d21d58bbb2b431df0636758343e0b296de878549317b8b2a1d24adbb4648

      SHA512

      1415e3a95764214185ebaddb3c02d7a72a93192b25371eaeaf36b84a3939124bdc6c3db58c9e3f4fc96f47cbe240338b37845ee752bcc9ec4e2266ac81214057

    • C:\ProgramData\DownloadSave\gcugeqt.exe

      Filesize

      129KB

      MD5

      a50d4d35f9fbf3eefefc0a4ee8b082a5

      SHA1

      b52d0af01bec86b11a1ba2ac6f04ff5c79caf909

      SHA256

      9c17d21d58bbb2b431df0636758343e0b296de878549317b8b2a1d24adbb4648

      SHA512

      1415e3a95764214185ebaddb3c02d7a72a93192b25371eaeaf36b84a3939124bdc6c3db58c9e3f4fc96f47cbe240338b37845ee752bcc9ec4e2266ac81214057

    • C:\ProgramData\DownloadSave\gcugeqt.exe

      Filesize

      129KB

      MD5

      a50d4d35f9fbf3eefefc0a4ee8b082a5

      SHA1

      b52d0af01bec86b11a1ba2ac6f04ff5c79caf909

      SHA256

      9c17d21d58bbb2b431df0636758343e0b296de878549317b8b2a1d24adbb4648

      SHA512

      1415e3a95764214185ebaddb3c02d7a72a93192b25371eaeaf36b84a3939124bdc6c3db58c9e3f4fc96f47cbe240338b37845ee752bcc9ec4e2266ac81214057

    • C:\Users\Admin\AppData\Local\Temp\888xi.exe

      Filesize

      129KB

      MD5

      a50d4d35f9fbf3eefefc0a4ee8b082a5

      SHA1

      b52d0af01bec86b11a1ba2ac6f04ff5c79caf909

      SHA256

      9c17d21d58bbb2b431df0636758343e0b296de878549317b8b2a1d24adbb4648

      SHA512

      1415e3a95764214185ebaddb3c02d7a72a93192b25371eaeaf36b84a3939124bdc6c3db58c9e3f4fc96f47cbe240338b37845ee752bcc9ec4e2266ac81214057

    • C:\Users\Admin\AppData\Local\Temp\888xi.exe

      Filesize

      129KB

      MD5

      a50d4d35f9fbf3eefefc0a4ee8b082a5

      SHA1

      b52d0af01bec86b11a1ba2ac6f04ff5c79caf909

      SHA256

      9c17d21d58bbb2b431df0636758343e0b296de878549317b8b2a1d24adbb4648

      SHA512

      1415e3a95764214185ebaddb3c02d7a72a93192b25371eaeaf36b84a3939124bdc6c3db58c9e3f4fc96f47cbe240338b37845ee752bcc9ec4e2266ac81214057

    • C:\Users\Admin\AppData\Local\Temp\Qvodpppp.exe

      Filesize

      143KB

      MD5

      2987cc45d528ff2aa8b1e79e3e1c0740

      SHA1

      6cf95062963e72289954d5ac43f869ad7fc2c502

      SHA256

      93e6eee272e3f5e2f12247781c4787a5e7428b27b6afb371eb0cf3e7361a0c89

      SHA512

      72c5004b4735f4f974a164fdc86f5457788868d756491e3d7c4fa2c43864bc79e48861d9db0d59efe29d72c6518a7ee935759600ce04a38a08239d433ec0b04c

    • C:\Users\Admin\AppData\Local\Temp\Qvodpppp.exe

      Filesize

      143KB

      MD5

      2987cc45d528ff2aa8b1e79e3e1c0740

      SHA1

      6cf95062963e72289954d5ac43f869ad7fc2c502

      SHA256

      93e6eee272e3f5e2f12247781c4787a5e7428b27b6afb371eb0cf3e7361a0c89

      SHA512

      72c5004b4735f4f974a164fdc86f5457788868d756491e3d7c4fa2c43864bc79e48861d9db0d59efe29d72c6518a7ee935759600ce04a38a08239d433ec0b04c

    • C:\Users\Admin\AppData\Local\Temp\down.exe

      Filesize

      8KB

      MD5

      1820084a044728818d133372da8d57f6

      SHA1

      8274ff35d8bbfe97004930f95a6d8c6aa72c8f1c

      SHA256

      7b68bf1fcc6e84a35b1ae18b4de1e7f0036df174bbdd5a3818df76cab4ae7029

      SHA512

      7a1d22c4c8e71e741b6df8def51cfc9d19558e52349e5dab0be08d6c7ce3077527e26aca64de6e22b28dc5b10d57c2fc3add3ae0d82c0bbc77db1f98c3149711

    • C:\Users\Admin\AppData\Local\Temp\down.exe

      Filesize

      8KB

      MD5

      1820084a044728818d133372da8d57f6

      SHA1

      8274ff35d8bbfe97004930f95a6d8c6aa72c8f1c

      SHA256

      7b68bf1fcc6e84a35b1ae18b4de1e7f0036df174bbdd5a3818df76cab4ae7029

      SHA512

      7a1d22c4c8e71e741b6df8def51cfc9d19558e52349e5dab0be08d6c7ce3077527e26aca64de6e22b28dc5b10d57c2fc3add3ae0d82c0bbc77db1f98c3149711

    • C:\Users\Admin\AppData\Local\Temp\down.exe

      Filesize

      8KB

      MD5

      1820084a044728818d133372da8d57f6

      SHA1

      8274ff35d8bbfe97004930f95a6d8c6aa72c8f1c

      SHA256

      7b68bf1fcc6e84a35b1ae18b4de1e7f0036df174bbdd5a3818df76cab4ae7029

      SHA512

      7a1d22c4c8e71e741b6df8def51cfc9d19558e52349e5dab0be08d6c7ce3077527e26aca64de6e22b28dc5b10d57c2fc3add3ae0d82c0bbc77db1f98c3149711

    • C:\WINDOWS\Qedie\conime.exe

      Filesize

      19KB

      MD5

      a4ffc7615609bc3ce2fda7b1e048f407

      SHA1

      1ddd680906a2c3dd86b0a60d347f87464d0ce137

      SHA256

      8313ed836d8547560bce5c20cc61f159f14ef0303b65327b75a8a5831f89e17a

      SHA512

      5c0f05215828899be02a1b4191cbaa32c09861cafffffe642c6cabb40a190c3783961962c31ccb9a878214cecaeb59d43370d10d9651ec137e01b17af3efdca8

    • C:\Windows\Qedie\conime.exe

      Filesize

      19KB

      MD5

      a4ffc7615609bc3ce2fda7b1e048f407

      SHA1

      1ddd680906a2c3dd86b0a60d347f87464d0ce137

      SHA256

      8313ed836d8547560bce5c20cc61f159f14ef0303b65327b75a8a5831f89e17a

      SHA512

      5c0f05215828899be02a1b4191cbaa32c09861cafffffe642c6cabb40a190c3783961962c31ccb9a878214cecaeb59d43370d10d9651ec137e01b17af3efdca8

    • C:\Windows\Qedie\conime.exe

      Filesize

      19KB

      MD5

      a4ffc7615609bc3ce2fda7b1e048f407

      SHA1

      1ddd680906a2c3dd86b0a60d347f87464d0ce137

      SHA256

      8313ed836d8547560bce5c20cc61f159f14ef0303b65327b75a8a5831f89e17a

      SHA512

      5c0f05215828899be02a1b4191cbaa32c09861cafffffe642c6cabb40a190c3783961962c31ccb9a878214cecaeb59d43370d10d9651ec137e01b17af3efdca8

    • \??\c:\Program Files\abc.txt

      Filesize

      42B

      MD5

      f33be8c8213c81375eae4be8ffb73314

      SHA1

      5897222faaf3488fc7d03347ca0877c32f80444f

      SHA256

      e21ff3cdfed512e75a40a07346dd7d606cdfbe8f8f7f1664b168bd512785986d

      SHA512

      b13a5c29380c70a602aa88f919b96092762cb53ca1517c09f8a8995a59b2fefdfae2bff995845ddfdf50a0028940f55ac263a28a846017b8bf7ab13cc3355a30

    • memory/1240-20-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/3184-25-0x0000000000400000-0x0000000000463000-memory.dmp

      Filesize

      396KB

    • memory/3184-22-0x0000000000400000-0x0000000000463000-memory.dmp

      Filesize

      396KB

    • memory/3824-18-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/4008-8-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/4760-46-0x0000000000400000-0x0000000000458000-memory.dmp

      Filesize

      352KB

    • memory/4760-3-0x0000000000400000-0x0000000000458000-memory.dmp

      Filesize

      352KB

    • memory/4760-23-0x0000000000400000-0x0000000000458000-memory.dmp

      Filesize

      352KB

    • memory/4760-48-0x0000000000400000-0x0000000000458000-memory.dmp

      Filesize

      352KB

    • memory/4760-50-0x0000000000400000-0x0000000000458000-memory.dmp

      Filesize

      352KB

    • memory/4760-52-0x0000000000400000-0x0000000000458000-memory.dmp

      Filesize

      352KB

    • memory/4760-54-0x0000000000400000-0x0000000000458000-memory.dmp

      Filesize

      352KB

    • memory/4760-56-0x0000000000400000-0x0000000000458000-memory.dmp

      Filesize

      352KB

    • memory/4760-60-0x0000000000400000-0x0000000000458000-memory.dmp

      Filesize

      352KB

    • memory/4760-62-0x0000000000400000-0x0000000000458000-memory.dmp

      Filesize

      352KB

    • memory/4760-66-0x0000000000400000-0x0000000000458000-memory.dmp

      Filesize

      352KB

    • memory/4760-68-0x0000000000400000-0x0000000000458000-memory.dmp

      Filesize

      352KB

    • memory/4760-70-0x0000000000400000-0x0000000000458000-memory.dmp

      Filesize

      352KB