Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

5

0fc6146c75...76.exe

windows7-x64

10

0fc6146c75...76.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    151s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    24/12/2023, 20:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0fc6146c753eb2f799f0dcdb920b0076.exe

  • Size

    512KB

  • MD5

    0fc6146c753eb2f799f0dcdb920b0076

  • SHA1

    9022e455da04667f417fea82517ff8eb8929ef20

  • SHA256

    baac8dd78ec97ae7e15bd328dd6540d3d6f64a101af3d1b4c59c2844f6cab944

  • SHA512

    12ac8f8d8ec2bbf812153d33d38b6c0a301e041cd2b743c4d8f22281717276bac43652ba1d81972e323283cebce3aa05e2b151f280693f6d7d35b30564761026

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6V:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5Y

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 7 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0fc6146c753eb2f799f0dcdb920b0076.exe
    "C:\Users\Admin\AppData\Local\Temp\0fc6146c753eb2f799f0dcdb920b0076.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1860
    • C:\Windows\SysWOW64\cldamogrhc.exe
      cldamogrhc.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2560
      • C:\Windows\SysWOW64\fbxbdsri.exe
        C:\Windows\system32\fbxbdsri.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2600
    • C:\Windows\SysWOW64\nlzzkfmpyksazol.exe
      nlzzkfmpyksazol.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3020
    • C:\Windows\SysWOW64\fbxbdsri.exe
      fbxbdsri.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2820
    • C:\Windows\SysWOW64\yzafvhvqbnynd.exe
      yzafvhvqbnynd.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2472
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2460
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:2128

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe
      Filesize

      512KB

      MD5

      8869d7693afdaffcc63c71d9563cc583

      SHA1

      066ad6d1103f7ef7fee9db636dfe678b997c04d4

      SHA256

      f20a5440e6f6d2e9d3c6fd81e758acc77a712b30c367b2f6ac84a4b87b5887f2

      SHA512

      6e2ba93e0b0ffaf66bfb68b330b97a21e0855056ff42cb9f84f744d70c383efc95619d58619205745bec781015e2d4b73e3ee131ac7e5272c7b88b2a49892cbe

      Download Submit

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
      Filesize

      512KB

      MD5

      71afaf7a16b6f4da81cbcad5b44b9e6c

      SHA1

      990dc1936965fc87cbf6a237f8617ee033ad0e86

      SHA256

      462dc5a3598500dd2bdf366df2ff7828b40de39f2e8819a40ef169bf7466ac0d

      SHA512

      d899c24aaf3710bc6982a041ecd0c68c25744ca3da8fddc818e6f0fd8fdadc33c243331b64b687ed51cc1db855a45637c946be6a0490812065447e4268a80eda

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
      Filesize

      20KB

      MD5

      13a557c6598b2e0c7a1bf685aa118d78

      SHA1

      d9916a597305b1bc5948c3ab5a67ef29ae96185b

      SHA256

      1e0f6296d022b09261a00e70f3f92685887a3ca81ddf11fdae1560b00dbd30a6

      SHA512

      eded6c973b38c5e13acc85c5b728edc64fd89c8483becb7d0e8ccce06789cad08e77eea24679474391cc96c124b55628ebffdd3348187bb8bef3938415cab8be

      Download Submit

    • C:\Windows\SysWOW64\fbxbdsri.exe
      Filesize

      512KB

      MD5

      24d4a4a4cddfaf6ce6bead04c6a5bd51

      SHA1

      05d948ddf778e0c91bd470ad9f6daf51737023fe

      SHA256

      77843853ccd793e99b316a0e6ca31b179bb5af3077903ce4a91422b872c746e3

      SHA512

      25670be8b9c4336d130b1d8b44a524c94ec11bbbd150d749aff280371850b33da3f79d6d4a67acec727a8af1aee9c86436097cccd095c5b3c2b60d964f4b6d12

      Download Submit

    • C:\Windows\SysWOW64\nlzzkfmpyksazol.exe
      Filesize

      512KB

      MD5

      ace4b692fbc26c24afc6589f1fad293d

      SHA1

      7111a5602f44b9813d774c7b55e7aa4970af38f4

      SHA256

      8933f7c302e390bdf457a785dd99df0eb0078b01b57b4f80a20b276c48b883cd

      SHA512

      337802ca804e65c3d33c5ef2e36f5822fd4e2a773c0bdb4f4f3ace95870fad8808275900b0f7a02d9175a02db9220796eff9092d2b385cee22fe6942adb71369

      Download Submit

    • C:\Windows\mydoc.rtf
      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

      Download Submit

    • \Windows\SysWOW64\cldamogrhc.exe
      Filesize

      512KB

      MD5

      7d88ebc3f08cbcbc71b0899a1590d2fe

      SHA1

      b1df75e80b1d51433a39fb99e5c9d09b2c3e1b90

      SHA256

      46b41e172e4e67916f1aceeb0ddab6aa9ea4e8781bfa450ddc5f11c907e07792

      SHA512

      5ac8dd1a0b4d4e4caac7afdc9b57164dcc96d0678e0742fcd1f65c55aa8d17e1a0d5533f501cd9966461a87fe237349f86eefa43927e95c47b0b402ebe74b194

      Download Submit

    • \Windows\SysWOW64\yzafvhvqbnynd.exe
      Filesize

      512KB

      MD5

      0a5ab839b3979140983a44c1255a949b

      SHA1

      7de8398b548b3c130e084062d94f4a0fbe75d843

      SHA256

      79bd127596056738fb788d99cd249bc7e6e34ee15da86714db881976075db293

      SHA512

      8d0fbecd641cb0eb54dd814914965f09a899899418924600b55ffb92bd453975e6062c5fdcb44dc74d1c94086a5fae20422816bd9279ef07d0747e6f93abcb5c

      Download Submit

    • memory/1860-0-0x0000000000400000-0x0000000000496000-memory.dmp

      Filesize

      600KB

      Download

    • memory/2460-45-0x000000002F811000-0x000000002F812000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2460-46-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2460-47-0x0000000070F7D000-0x0000000070F88000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2460-79-0x0000000070F7D000-0x0000000070F88000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2460-100-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download