Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
15/10/2023, 19:40
Static task
static1
Behavioral task
behavioral1
Sample
84909bc817ee332341e8f9c1352333c0_exe32.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
84909bc817ee332341e8f9c1352333c0_exe32.exe
Resource
win10v2004-20230915-en
General
-
Target
84909bc817ee332341e8f9c1352333c0_exe32.exe
-
Size
376KB
-
MD5
84909bc817ee332341e8f9c1352333c0
-
SHA1
1cb6de0adcde5ffcb6afc1df9e008db79849ce90
-
SHA256
57bbb78700ffee2399d780585d09c76f9c66eae44cf1c5d3d8765dd2b20cd287
-
SHA512
ccd73768a59ca8439bcbfbdb4eba8cf3702991257009a6dc30bd14a975c618233b85f8abfc361edb829afcf564e9f70cea436caa14221f4daff055ca948f84af
-
SSDEEP
6144:OaNc//////zIwTBXQ+y6WZQAxwni1NalRFQQwrD9vucACjWkhC/qlluyKoC5U:O8c//////UwTd3i1NaxErD9mcAWWxH9U
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\ProgramData\\DownloadSave\\gcugeqt.exe" gcugeqt.exe -
Modifies Installed Components in the registry 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AENGFU3AA-B933-11d2-9CBD-0000F87A369E} conime.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AENGFU3AA-B933-11d2-9CBD-0000F87A369E}\ = "Verabc" conime.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AENGFU3AA-B933-11d2-9CBD-0000F87A369E}\stubpath = "C:\\WINDOWS\\Qedie\\conime.exe" conime.exe -
Executes dropped EXE 7 IoCs
pid Process 4760 Qvodpppp.exe 4008 down.exe 1240 down.exe 3824 conime.exe 4392 888xi.exe 1836 gcugeqt.exe 2768 gcugeqt.exe -
resource yara_rule behavioral2/files/0x000b000000023138-2.dat upx behavioral2/files/0x000b000000023138-4.dat upx behavioral2/memory/4760-3-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/files/0x00080000000231f7-7.dat upx behavioral2/files/0x00080000000231f7-9.dat upx behavioral2/memory/4008-8-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/files/0x00080000000231f7-10.dat upx behavioral2/files/0x0007000000023206-14.dat upx behavioral2/files/0x0007000000023206-17.dat upx behavioral2/memory/3824-18-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/files/0x0007000000023206-16.dat upx behavioral2/memory/1240-20-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/4760-23-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/4760-46-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/4760-48-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/4760-50-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/4760-52-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/4760-54-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/4760-56-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/4760-60-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/4760-62-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/4760-66-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/4760-68-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/4760-70-0x0000000000400000-0x0000000000458000-memory.dmp upx -
Drops file in Program Files directory 1 IoCs
description ioc Process File created \??\c:\Program Files\abc.txt down.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\WINDOWS\Qedie\conime.exe down.exe File opened for modification C:\WINDOWS\Qedie\conime.exe down.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4392 888xi.exe 4392 888xi.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1836 gcugeqt.exe Token: SeIncBasePriorityPrivilege 2768 gcugeqt.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 4760 Qvodpppp.exe 4760 Qvodpppp.exe 4760 Qvodpppp.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 4760 Qvodpppp.exe 4760 Qvodpppp.exe 4760 Qvodpppp.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 4392 888xi.exe 1836 gcugeqt.exe 1836 gcugeqt.exe 1836 gcugeqt.exe 1836 gcugeqt.exe 1836 gcugeqt.exe 1836 gcugeqt.exe 2768 gcugeqt.exe 2768 gcugeqt.exe 1836 gcugeqt.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 3184 wrote to memory of 2212 3184 84909bc817ee332341e8f9c1352333c0_exe32.exe 86 PID 3184 wrote to memory of 2212 3184 84909bc817ee332341e8f9c1352333c0_exe32.exe 86 PID 3184 wrote to memory of 2212 3184 84909bc817ee332341e8f9c1352333c0_exe32.exe 86 PID 2212 wrote to memory of 4760 2212 cmd.exe 88 PID 2212 wrote to memory of 4760 2212 cmd.exe 88 PID 2212 wrote to memory of 4760 2212 cmd.exe 88 PID 3184 wrote to memory of 3368 3184 84909bc817ee332341e8f9c1352333c0_exe32.exe 92 PID 3184 wrote to memory of 3368 3184 84909bc817ee332341e8f9c1352333c0_exe32.exe 92 PID 3184 wrote to memory of 3368 3184 84909bc817ee332341e8f9c1352333c0_exe32.exe 92 PID 3368 wrote to memory of 4008 3368 cmd.exe 94 PID 3368 wrote to memory of 4008 3368 cmd.exe 94 PID 3368 wrote to memory of 4008 3368 cmd.exe 94 PID 4008 wrote to memory of 1240 4008 down.exe 95 PID 4008 wrote to memory of 1240 4008 down.exe 95 PID 4008 wrote to memory of 1240 4008 down.exe 95 PID 1240 wrote to memory of 3824 1240 down.exe 96 PID 1240 wrote to memory of 3824 1240 down.exe 96 PID 1240 wrote to memory of 3824 1240 down.exe 96 PID 3184 wrote to memory of 2016 3184 84909bc817ee332341e8f9c1352333c0_exe32.exe 100 PID 3184 wrote to memory of 2016 3184 84909bc817ee332341e8f9c1352333c0_exe32.exe 100 PID 3184 wrote to memory of 2016 3184 84909bc817ee332341e8f9c1352333c0_exe32.exe 100 PID 3184 wrote to memory of 1176 3184 84909bc817ee332341e8f9c1352333c0_exe32.exe 101 PID 3184 wrote to memory of 1176 3184 84909bc817ee332341e8f9c1352333c0_exe32.exe 101 PID 3184 wrote to memory of 1176 3184 84909bc817ee332341e8f9c1352333c0_exe32.exe 101 PID 2016 wrote to memory of 4392 2016 cmd.exe 104 PID 2016 wrote to memory of 4392 2016 cmd.exe 104 PID 2016 wrote to memory of 4392 2016 cmd.exe 104 PID 4392 wrote to memory of 1836 4392 888xi.exe 105 PID 4392 wrote to memory of 1836 4392 888xi.exe 105 PID 4392 wrote to memory of 1836 4392 888xi.exe 105 PID 1836 wrote to memory of 2768 1836 gcugeqt.exe 106 PID 1836 wrote to memory of 2768 1836 gcugeqt.exe 106 PID 1836 wrote to memory of 2768 1836 gcugeqt.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\84909bc817ee332341e8f9c1352333c0_exe32.exe"C:\Users\Admin\AppData\Local\Temp\84909bc817ee332341e8f9c1352333c0_exe32.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Qvodpppp.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\Qvodpppp.exeC:\Users\Admin\AppData\Local\Temp\Qvodpppp.exe3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4760
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\down.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\down.exeC:\Users\Admin\AppData\Local\Temp\down.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\down.exeC:\Users\Admin\AppData\Local\Temp\down.exe4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\WINDOWS\Qedie\conime.exeC:\WINDOWS\Qedie\conime.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
PID:3824
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\888xi.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\888xi.exeC:\Users\Admin\AppData\Local\Temp\888xi.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\ProgramData\DownloadSave\gcugeqt.exe"C:\ProgramData\DownloadSave\gcugeqt.exe"4⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\ProgramData\DownloadSave\ gcugeqt.exe"C:\ProgramData\DownloadSave\ gcugeqt.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2768
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c erase /F "C:\Users\Admin\AppData\Local\Temp\84909bc817ee332341e8f9c1352333c0_exe32.exe"2⤵PID:1176
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129KB
MD5a50d4d35f9fbf3eefefc0a4ee8b082a5
SHA1b52d0af01bec86b11a1ba2ac6f04ff5c79caf909
SHA2569c17d21d58bbb2b431df0636758343e0b296de878549317b8b2a1d24adbb4648
SHA5121415e3a95764214185ebaddb3c02d7a72a93192b25371eaeaf36b84a3939124bdc6c3db58c9e3f4fc96f47cbe240338b37845ee752bcc9ec4e2266ac81214057
-
Filesize
129KB
MD5a50d4d35f9fbf3eefefc0a4ee8b082a5
SHA1b52d0af01bec86b11a1ba2ac6f04ff5c79caf909
SHA2569c17d21d58bbb2b431df0636758343e0b296de878549317b8b2a1d24adbb4648
SHA5121415e3a95764214185ebaddb3c02d7a72a93192b25371eaeaf36b84a3939124bdc6c3db58c9e3f4fc96f47cbe240338b37845ee752bcc9ec4e2266ac81214057
-
Filesize
260B
MD5b08b8d758962efc14172eecc9a266ba9
SHA1419ae812006ec27a3d362646142b5fe97fb4c26e
SHA2563ef8f93d2cc1951a990b86eb2c9065d340d60c6ac9bdcd5e3a3ec1134e6e95fb
SHA512128078f964e30166f83615d72117f4273b7c754f80a49b7001a2d79456fde1b360cb0014c3a943dde52ce8191e0263fc8a67525f706494d02c203bbf71849271
-
Filesize
129KB
MD5a50d4d35f9fbf3eefefc0a4ee8b082a5
SHA1b52d0af01bec86b11a1ba2ac6f04ff5c79caf909
SHA2569c17d21d58bbb2b431df0636758343e0b296de878549317b8b2a1d24adbb4648
SHA5121415e3a95764214185ebaddb3c02d7a72a93192b25371eaeaf36b84a3939124bdc6c3db58c9e3f4fc96f47cbe240338b37845ee752bcc9ec4e2266ac81214057
-
Filesize
129KB
MD5a50d4d35f9fbf3eefefc0a4ee8b082a5
SHA1b52d0af01bec86b11a1ba2ac6f04ff5c79caf909
SHA2569c17d21d58bbb2b431df0636758343e0b296de878549317b8b2a1d24adbb4648
SHA5121415e3a95764214185ebaddb3c02d7a72a93192b25371eaeaf36b84a3939124bdc6c3db58c9e3f4fc96f47cbe240338b37845ee752bcc9ec4e2266ac81214057
-
Filesize
129KB
MD5a50d4d35f9fbf3eefefc0a4ee8b082a5
SHA1b52d0af01bec86b11a1ba2ac6f04ff5c79caf909
SHA2569c17d21d58bbb2b431df0636758343e0b296de878549317b8b2a1d24adbb4648
SHA5121415e3a95764214185ebaddb3c02d7a72a93192b25371eaeaf36b84a3939124bdc6c3db58c9e3f4fc96f47cbe240338b37845ee752bcc9ec4e2266ac81214057
-
Filesize
129KB
MD5a50d4d35f9fbf3eefefc0a4ee8b082a5
SHA1b52d0af01bec86b11a1ba2ac6f04ff5c79caf909
SHA2569c17d21d58bbb2b431df0636758343e0b296de878549317b8b2a1d24adbb4648
SHA5121415e3a95764214185ebaddb3c02d7a72a93192b25371eaeaf36b84a3939124bdc6c3db58c9e3f4fc96f47cbe240338b37845ee752bcc9ec4e2266ac81214057
-
Filesize
129KB
MD5a50d4d35f9fbf3eefefc0a4ee8b082a5
SHA1b52d0af01bec86b11a1ba2ac6f04ff5c79caf909
SHA2569c17d21d58bbb2b431df0636758343e0b296de878549317b8b2a1d24adbb4648
SHA5121415e3a95764214185ebaddb3c02d7a72a93192b25371eaeaf36b84a3939124bdc6c3db58c9e3f4fc96f47cbe240338b37845ee752bcc9ec4e2266ac81214057
-
Filesize
143KB
MD52987cc45d528ff2aa8b1e79e3e1c0740
SHA16cf95062963e72289954d5ac43f869ad7fc2c502
SHA25693e6eee272e3f5e2f12247781c4787a5e7428b27b6afb371eb0cf3e7361a0c89
SHA51272c5004b4735f4f974a164fdc86f5457788868d756491e3d7c4fa2c43864bc79e48861d9db0d59efe29d72c6518a7ee935759600ce04a38a08239d433ec0b04c
-
Filesize
143KB
MD52987cc45d528ff2aa8b1e79e3e1c0740
SHA16cf95062963e72289954d5ac43f869ad7fc2c502
SHA25693e6eee272e3f5e2f12247781c4787a5e7428b27b6afb371eb0cf3e7361a0c89
SHA51272c5004b4735f4f974a164fdc86f5457788868d756491e3d7c4fa2c43864bc79e48861d9db0d59efe29d72c6518a7ee935759600ce04a38a08239d433ec0b04c
-
Filesize
8KB
MD51820084a044728818d133372da8d57f6
SHA18274ff35d8bbfe97004930f95a6d8c6aa72c8f1c
SHA2567b68bf1fcc6e84a35b1ae18b4de1e7f0036df174bbdd5a3818df76cab4ae7029
SHA5127a1d22c4c8e71e741b6df8def51cfc9d19558e52349e5dab0be08d6c7ce3077527e26aca64de6e22b28dc5b10d57c2fc3add3ae0d82c0bbc77db1f98c3149711
-
Filesize
8KB
MD51820084a044728818d133372da8d57f6
SHA18274ff35d8bbfe97004930f95a6d8c6aa72c8f1c
SHA2567b68bf1fcc6e84a35b1ae18b4de1e7f0036df174bbdd5a3818df76cab4ae7029
SHA5127a1d22c4c8e71e741b6df8def51cfc9d19558e52349e5dab0be08d6c7ce3077527e26aca64de6e22b28dc5b10d57c2fc3add3ae0d82c0bbc77db1f98c3149711
-
Filesize
8KB
MD51820084a044728818d133372da8d57f6
SHA18274ff35d8bbfe97004930f95a6d8c6aa72c8f1c
SHA2567b68bf1fcc6e84a35b1ae18b4de1e7f0036df174bbdd5a3818df76cab4ae7029
SHA5127a1d22c4c8e71e741b6df8def51cfc9d19558e52349e5dab0be08d6c7ce3077527e26aca64de6e22b28dc5b10d57c2fc3add3ae0d82c0bbc77db1f98c3149711
-
Filesize
19KB
MD5a4ffc7615609bc3ce2fda7b1e048f407
SHA11ddd680906a2c3dd86b0a60d347f87464d0ce137
SHA2568313ed836d8547560bce5c20cc61f159f14ef0303b65327b75a8a5831f89e17a
SHA5125c0f05215828899be02a1b4191cbaa32c09861cafffffe642c6cabb40a190c3783961962c31ccb9a878214cecaeb59d43370d10d9651ec137e01b17af3efdca8
-
Filesize
19KB
MD5a4ffc7615609bc3ce2fda7b1e048f407
SHA11ddd680906a2c3dd86b0a60d347f87464d0ce137
SHA2568313ed836d8547560bce5c20cc61f159f14ef0303b65327b75a8a5831f89e17a
SHA5125c0f05215828899be02a1b4191cbaa32c09861cafffffe642c6cabb40a190c3783961962c31ccb9a878214cecaeb59d43370d10d9651ec137e01b17af3efdca8
-
Filesize
19KB
MD5a4ffc7615609bc3ce2fda7b1e048f407
SHA11ddd680906a2c3dd86b0a60d347f87464d0ce137
SHA2568313ed836d8547560bce5c20cc61f159f14ef0303b65327b75a8a5831f89e17a
SHA5125c0f05215828899be02a1b4191cbaa32c09861cafffffe642c6cabb40a190c3783961962c31ccb9a878214cecaeb59d43370d10d9651ec137e01b17af3efdca8
-
Filesize
42B
MD5f33be8c8213c81375eae4be8ffb73314
SHA15897222faaf3488fc7d03347ca0877c32f80444f
SHA256e21ff3cdfed512e75a40a07346dd7d606cdfbe8f8f7f1664b168bd512785986d
SHA512b13a5c29380c70a602aa88f919b96092762cb53ca1517c09f8a8995a59b2fefdfae2bff995845ddfdf50a0028940f55ac263a28a846017b8bf7ab13cc3355a30