Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    184s
  • max time network
    188s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/12/2023, 23:35

General

  • Target

    439808b3bfd56a270b6744063badf090.exe

  • Size

    512KB

  • MD5

    439808b3bfd56a270b6744063badf090

  • SHA1

    24c2201f7589f6bdde410aacde3ab5f9b4f2ffe4

  • SHA256

    2e1510d673833018d11c82a31f01dc18c408ea701be8c097d2fa9a97287d83fb

  • SHA512

    76bdca7cf45657fd03058fecf89b4a7d080d9fd65c9b952fd2cc3b00c1b179ee13f17a6cb901daf2d58999b8c3dc0daaef148f7c19292580662e7b8631f1a61c

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6g:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5Z

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 5 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 6 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
  • AutoIT Executable 11 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 13 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\439808b3bfd56a270b6744063badf090.exe
    "C:\Users\Admin\AppData\Local\Temp\439808b3bfd56a270b6744063badf090.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2300
    • C:\Windows\SysWOW64\eifsiednon.exe
      eifsiednon.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:400
      • C:\Windows\SysWOW64\fyxcuypj.exe
        C:\Windows\system32\fyxcuypj.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1608
    • C:\Windows\SysWOW64\rlwjhoaslatoubp.exe
      rlwjhoaslatoubp.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:380
    • C:\Windows\SysWOW64\fyxcuypj.exe
      fyxcuypj.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2388
    • C:\Windows\SysWOW64\zonnkmvzublmx.exe
      zonnkmvzublmx.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1820
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:4272

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe

    Filesize

    3KB

    MD5

    22094413abd5a6b3c392ba7fd1f2fdd9

    SHA1

    943c5ab0c8bf5a8b0fcda730f0c77ef712000a48

    SHA256

    0b11f730ea7ad657e378d3af49be2c02a6d886961acde823643ce5d59bd28d13

    SHA512

    4a2bf4810c664009ed08a96949706b2c5e0e6f8e3bcd3846caf99ac3809194d325bbc9f8969eba24c998a14f5d1cda159cd30e89170b3bcc16f04c6d342c4890

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe

    Filesize

    7KB

    MD5

    8b7ed956287c0e3dccb549f773afa3bd

    SHA1

    c1f3db7f7277035cff2d51f678d53402a594fe10

    SHA256

    a802545031e7840efb9e08e99f7f371df113efa76f14a4c94fd2c4b4d70da3c7

    SHA512

    058270d6f7b0084f636d57ee96441e30c7b6e4382b56caa3b851a5b1f011756e9e0c2903f3156133bf91878a11b63486d97e37330b6dd7cb3f651acdfd2f1951

  • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

    Filesize

    239B

    MD5

    12b138a5a40ffb88d1850866bf2959cd

    SHA1

    57001ba2de61329118440de3e9f8a81074cb28a2

    SHA256

    9def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf

    SHA512

    9f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

    Filesize

    3KB

    MD5

    16e5228a862188207892a4c7b62f7a29

    SHA1

    4f8e6e3d8ae9d6aa37e8951686aadee174ddcae9

    SHA256

    d8c12ddd160633d604c0fdea7472ee94b0b98b41bfd56ef393cb42f80936647d

    SHA512

    a2630628c9f268aab424e9353d2ea388ac74f260a6787c1218e3f727e463c9d50c9976b70b67f0f9e8215dd97bbc9b821898f2434a57225a337d670b0b9faabf

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

    Filesize

    3KB

    MD5

    f0f8d941da777699e7598ccd4e8f5b75

    SHA1

    7fc10dec7d4986d12c70ad3e590852b8cdd318f7

    SHA256

    257a8d95e1d81e60ddbc49a55c4a15a950c75626e003c055c9fa7a935f75131e

    SHA512

    4418776b38a63a645adcea6150db0b348ba6380570f83050f6cd20b985f4511fe59712bf87c86e0b05864ae62a44348b39e3e3018ccd07846aea3d7cc1f3fd01

  • C:\Users\Admin\Documents\SkipGroup.doc.exe

    Filesize

    512KB

    MD5

    065c970cd772fa89c63ae571198739a0

    SHA1

    fa379d7709014b28d97b1e0916841b1cf922323a

    SHA256

    81aca1c91cc883b0c61bda1932885b020a47ec0ef9f21be7bebe9d780c6015c3

    SHA512

    cb047ae37c28963ff1c4c258063d5fc7c7dc2ea87e4c79865d4456fd541b04c732ee74c9c77457695d9401a5a1f85c47d8fa38ba2a4e71607806d51c7b3af30c

  • C:\Windows\SysWOW64\eifsiednon.exe

    Filesize

    512KB

    MD5

    132c9772a7e8c029a9870c5fd5079005

    SHA1

    5dc9ebf70aa44f631322137f38c4628e25a99d30

    SHA256

    36befa177bfecec97acc2a9c10ef851079ad11fb08d38919a67824ae524f1b41

    SHA512

    0d2a0030e82a84067e5ca08959a56e4042b8fc350253985b0ff0f77b65dbb0df3fff88b95e4564509c8110f6e8d60d1bbbb2970ce0d01a6290a45e8d589bbd78

  • C:\Windows\SysWOW64\fyxcuypj.exe

    Filesize

    512KB

    MD5

    3303371fb2542a47e1a3c0ba72759b8b

    SHA1

    2ca7d35e4f2ac5b12b3d590f637ab52f001ba963

    SHA256

    7d8acc9d0118b695f3b22b7bace66243dbb3bd060fa20c39070288d3d65c9178

    SHA512

    b8eaccbfbea223aaf2eda1f9c0771a007245c7da4a70ecd7f7895a2a20cd0199ac80e114e305660dc194cecc78654ab8963de02b2a400b1a160a73218dfa833d

  • C:\Windows\SysWOW64\rlwjhoaslatoubp.exe

    Filesize

    512KB

    MD5

    ef517ad0ad6e027e1ff69df0876f8163

    SHA1

    a01553ba220f4ccec70215d817426bf2ba7bc7bf

    SHA256

    b87930870c5b52e0fb88228af64af3d3273566e41b33b7a961bb9618163ec090

    SHA512

    290612fbf2f9533da272748caeb171989254a8d122d9a25f492076daa76f9938daf72f349930bcad526181511bfeaab82d2bc7c68d9d2e922816924c6ecabf1f

  • C:\Windows\SysWOW64\zonnkmvzublmx.exe

    Filesize

    512KB

    MD5

    72f2f4eea962d84f42078ebbd548527f

    SHA1

    b868572bf0db35c08e817b35f3f1087c48320270

    SHA256

    3c232693f3ac7c7e355a284634919f4d5def168e6d1c57448f8e8dc1053eeacc

    SHA512

    22631c6ac91e20ebc4b77c71d13e60ec250fb4108eb008c0f4eb73ea8560226104283de4a99c594aa991a11ed206328ba9a3e99d8d19759f1cca285507ec86dd

  • C:\Windows\mydoc.rtf

    Filesize

    223B

    MD5

    06604e5941c126e2e7be02c5cd9f62ec

    SHA1

    4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

    SHA256

    85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

    SHA512

    803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

    Filesize

    512KB

    MD5

    398b1c4808930e21bbb6ffe1b3caf4ce

    SHA1

    f36d14f109df3f272ca47814620497c82dcbafb7

    SHA256

    fd42d0fa77bb16c86a9f72ec2a7fdd70d09684159156a7810b9bc5e1b123078e

    SHA512

    a0fe400acdee785def9d1ee89bb79fd95f2d62ef7d1df403b9a74578724247b0f2fa4ba4e5b89b20d08e83fe6d0f121fec0297c5a361161aad8bef12494e9b27

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

    Filesize

    512KB

    MD5

    584f4194240cbf1fa97dd472c05912e5

    SHA1

    6372141358048b6168db044f8ec8cd28b19ffb18

    SHA256

    7ae9ae74838be6d07b9edbb79fa8d892661591aefbaa3a99e1c99d969c2bd6f1

    SHA512

    509636fa9c366acf6ea6f9e4fdefd065736b88d700ab7e658357a610cfcb0e92ecc8a7b7eeff9278dabc59bdff8952d32eea7c04c1ad9fc880ea88a6da2be64c

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

    Filesize

    512KB

    MD5

    d7feddb6f001cfc4b3aceaad1f5562f8

    SHA1

    09ed3b7a54fd893ce88b90f20938ff3ba9c51295

    SHA256

    a23d8119fc852719baae279b762e87b0df3f17e0bc98bd87b6370d9453b23416

    SHA512

    cba862d2a09c63fb1fe03352f7c77fb1cea13f7d3acc1deba9e7bf2c9cd9a3cf7f3247be90a433d7c656c108d999a40326b9fa1419a3ae957dde80e0d12567d3

  • memory/2300-0-0x0000000000400000-0x0000000000496000-memory.dmp

    Filesize

    600KB

  • memory/4272-43-0x00007FFE39610000-0x00007FFE39805000-memory.dmp

    Filesize

    2.0MB

  • memory/4272-83-0x00007FFE39610000-0x00007FFE39805000-memory.dmp

    Filesize

    2.0MB

  • memory/4272-49-0x00007FFE39610000-0x00007FFE39805000-memory.dmp

    Filesize

    2.0MB

  • memory/4272-50-0x00007FFE39610000-0x00007FFE39805000-memory.dmp

    Filesize

    2.0MB

  • memory/4272-52-0x00007FFE39610000-0x00007FFE39805000-memory.dmp

    Filesize

    2.0MB

  • memory/4272-54-0x00007FFE39610000-0x00007FFE39805000-memory.dmp

    Filesize

    2.0MB

  • memory/4272-53-0x00007FFDF75D0000-0x00007FFDF75E0000-memory.dmp

    Filesize

    64KB

  • memory/4272-51-0x00007FFE39610000-0x00007FFE39805000-memory.dmp

    Filesize

    2.0MB

  • memory/4272-55-0x00007FFE39610000-0x00007FFE39805000-memory.dmp

    Filesize

    2.0MB

  • memory/4272-56-0x00007FFE39610000-0x00007FFE39805000-memory.dmp

    Filesize

    2.0MB

  • memory/4272-57-0x00007FFDF75D0000-0x00007FFDF75E0000-memory.dmp

    Filesize

    64KB

  • memory/4272-46-0x00007FFDF9690000-0x00007FFDF96A0000-memory.dmp

    Filesize

    64KB

  • memory/4272-47-0x00007FFE39610000-0x00007FFE39805000-memory.dmp

    Filesize

    2.0MB

  • memory/4272-45-0x00007FFE39610000-0x00007FFE39805000-memory.dmp

    Filesize

    2.0MB

  • memory/4272-44-0x00007FFDF9690000-0x00007FFDF96A0000-memory.dmp

    Filesize

    64KB

  • memory/4272-48-0x00007FFE39610000-0x00007FFE39805000-memory.dmp

    Filesize

    2.0MB

  • memory/4272-85-0x00007FFE39610000-0x00007FFE39805000-memory.dmp

    Filesize

    2.0MB

  • memory/4272-88-0x00007FFE39610000-0x00007FFE39805000-memory.dmp

    Filesize

    2.0MB

  • memory/4272-41-0x00007FFDF9690000-0x00007FFDF96A0000-memory.dmp

    Filesize

    64KB

  • memory/4272-42-0x00007FFE39610000-0x00007FFE39805000-memory.dmp

    Filesize

    2.0MB

  • memory/4272-40-0x00007FFDF9690000-0x00007FFDF96A0000-memory.dmp

    Filesize

    64KB

  • memory/4272-133-0x00007FFDF9690000-0x00007FFDF96A0000-memory.dmp

    Filesize

    64KB

  • memory/4272-134-0x00007FFDF9690000-0x00007FFDF96A0000-memory.dmp

    Filesize

    64KB

  • memory/4272-135-0x00007FFDF9690000-0x00007FFDF96A0000-memory.dmp

    Filesize

    64KB

  • memory/4272-136-0x00007FFDF9690000-0x00007FFDF96A0000-memory.dmp

    Filesize

    64KB

  • memory/4272-137-0x00007FFE39610000-0x00007FFE39805000-memory.dmp

    Filesize

    2.0MB

  • memory/4272-138-0x00007FFE39610000-0x00007FFE39805000-memory.dmp

    Filesize

    2.0MB

  • memory/4272-39-0x00007FFE39610000-0x00007FFE39805000-memory.dmp

    Filesize

    2.0MB

  • memory/4272-38-0x00007FFE39610000-0x00007FFE39805000-memory.dmp

    Filesize

    2.0MB

  • memory/4272-37-0x00007FFDF9690000-0x00007FFDF96A0000-memory.dmp

    Filesize

    64KB