Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    159s
  • max time network
    165s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/12/2023, 03:17

General

  • Target

    0276f65dff093433bc35b40d852e5825.exe

  • Size

    512KB

  • MD5

    0276f65dff093433bc35b40d852e5825

  • SHA1

    77bb0c664fc7515d461e43558aaebb76fb154d91

  • SHA256

    4af568f0576b3ec963aeaed7bf5f0887adc3381128cff58964b19b58a86a1f6f

  • SHA512

    dff66347db146d9ba8bc02376bad874c921de1e340666798269af2d5395ac43e2b8e0a656cd6bbbab6c4353f67887a7f7183dd46f32182dbe72ba5a978083524

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6f:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm52

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 5 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Windows security modification 2 TTPs 6 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
  • AutoIT Executable 7 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0276f65dff093433bc35b40d852e5825.exe
    "C:\Users\Admin\AppData\Local\Temp\0276f65dff093433bc35b40d852e5825.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1636
    • C:\Windows\SysWOW64\epdrtjyygx.exe
      epdrtjyygx.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2876
      • C:\Windows\SysWOW64\nolsmydj.exe
        C:\Windows\system32\nolsmydj.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:412
    • C:\Windows\SysWOW64\wacbhyrifjtbill.exe
      wacbhyrifjtbill.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2696
    • C:\Windows\SysWOW64\nolsmydj.exe
      nolsmydj.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1296
    • C:\Windows\SysWOW64\qscfufmqjwygx.exe
      qscfufmqjwygx.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3240
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:3764

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe

    Filesize

    512KB

    MD5

    b37798be1c9ae0ba851fc1eaa5e1e343

    SHA1

    38ea6d68f116fd2f2976b14d865d5b1ae4d667e8

    SHA256

    21b3b0971a13293f00302784f8155988a2690274cf5a8be63c1350cef890349a

    SHA512

    7183a950126b572908f8b70f384202d17b4295b9ac4b4d0467fd7411a48f5775ee53fd1d51a6341ea4f7df180422db14d438119307dbb30a95c19591e0459854

  • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

    Filesize

    239B

    MD5

    12b138a5a40ffb88d1850866bf2959cd

    SHA1

    57001ba2de61329118440de3e9f8a81074cb28a2

    SHA256

    9def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf

    SHA512

    9f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

    Filesize

    3KB

    MD5

    ab6cf1fe89f7b33720fb6cbe44e298e8

    SHA1

    2b08c6047f5db6cc8525821c3e3f3cdb9475cba4

    SHA256

    74f10859ba7c1282956c7cd91e2273f0b783d4d8e5080b0c961182bbe13650ee

    SHA512

    2ebb7607c1985cc7163ea29bd7a04125fa465732d4b03b1c21415e2f0faf414838297873e94140b3c75c7a36730f20993a427a748c35449624013f4fb71c2880

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

    Filesize

    3KB

    MD5

    e0cce5056a809c658a3c5447f04de30d

    SHA1

    165c4917c4e7248cdf5b9778aa8dd34c433808fc

    SHA256

    97908110021c7e967df169e3cf005fd8f8b9acbad135f6122ba62cc9ff314658

    SHA512

    9194b0464bccd40c01c7d88efe549168b363aa6130bcbe6a4e950c4c7ad1d0103fecd3dd535212010efbc56ce994d8681013f179f2bff07792c76ad9885111a6

  • C:\Windows\SysWOW64\epdrtjyygx.exe

    Filesize

    512KB

    MD5

    44ac2f90901907df828d660f972a1f9b

    SHA1

    229b98c0b1b4c1bd98057453c9c763119b092414

    SHA256

    2194de18587705c4bd58d58b0dd7d3ae2cc6a8fd8146853e1759d7b44bda9ef6

    SHA512

    e40b473b87d72193db77275e125d42fc22a01615d1170084bd184c4a77b55368b3c92d706e4ad5f322dab3357af1b7bbe3e651e6fb7178fa6c1a93e10e3dfbee

  • C:\Windows\SysWOW64\nolsmydj.exe

    Filesize

    512KB

    MD5

    51ef67ca115883dc8f4714ff39b14daf

    SHA1

    12cf9c4828eb817ad2723115306afa5f804b3afd

    SHA256

    baf499bd49acb4fd9d35376880c5777ee401da2df85971a4ad38c76d0743ae73

    SHA512

    56760b1326a1e5c99feffbc2c9089fe45d36ad1df77d85ccaa98fe838bb2ca785ba7ab53f497bbec4121b6e355ae4e24476d052cef653cf6d90b6f0a634d171d

  • C:\Windows\SysWOW64\qscfufmqjwygx.exe

    Filesize

    512KB

    MD5

    a19d6c7448fe227bd67d6a1d43ebc703

    SHA1

    4c069caa38975b430c0ee88cc051b8860b3387d4

    SHA256

    9aaa3e590b94e958755a72810c79acd156c375606f3a5c7fae1d5041267fd725

    SHA512

    a0771eb40be2a0a55756af7e4c992a134c3061d14c1530ebab1a0615859eb1cbf0324c69a5679f55e3475a147b826ce16964946d4bf6e3b8cafe5ebbfb684006

  • C:\Windows\SysWOW64\wacbhyrifjtbill.exe

    Filesize

    512KB

    MD5

    2f72a74e9b6a917a034007412c16e97a

    SHA1

    5ddb0f06debafe7b7cd659e0b0f6959c2040e526

    SHA256

    572324a1a0dccf87df2434ada6926e3a0473e76d24d4f346c8f0c724a05cab51

    SHA512

    ea8049c557de2d63d36c9d72d3c7d8641fdc6ee64ac557389fe1f765468759ba520cd306492b1f8523390c06f3675e634cbb1a6b5df3e899747cc104292fc5bc

  • C:\Windows\mydoc.rtf

    Filesize

    223B

    MD5

    06604e5941c126e2e7be02c5cd9f62ec

    SHA1

    4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

    SHA256

    85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

    SHA512

    803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

  • \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe

    Filesize

    512KB

    MD5

    50ce631d87e75ae2e51c0cbacc9a4b68

    SHA1

    ccba8ac55f4fab62a76348fdd69141ef0c3adb47

    SHA256

    a983ee36f9be2ac61f3a89bba7b67f7e5d41a4c1c4b0f58257c58d6e742e9564

    SHA512

    6b56dccc922b2f4fc8c177d207c3ae9981a4b57517d5cba79dba70352189d61e576ad5fe3e765d39d32611a243fcfbfae9ae123b9eab3ca835c636455da0b83f

  • memory/1636-0-0x0000000000400000-0x0000000000496000-memory.dmp

    Filesize

    600KB

  • memory/3764-46-0x00007FFDE4700000-0x00007FFDE4710000-memory.dmp

    Filesize

    64KB

  • memory/3764-37-0x00007FFDE6D50000-0x00007FFDE6D60000-memory.dmp

    Filesize

    64KB

  • memory/3764-45-0x00007FFDE4700000-0x00007FFDE4710000-memory.dmp

    Filesize

    64KB

  • memory/3764-41-0x00007FFDE6D50000-0x00007FFDE6D60000-memory.dmp

    Filesize

    64KB

  • memory/3764-36-0x00007FFDE6D50000-0x00007FFDE6D60000-memory.dmp

    Filesize

    64KB

  • memory/3764-40-0x00007FFE26CD0000-0x00007FFE26EC5000-memory.dmp

    Filesize

    2.0MB

  • memory/3764-38-0x00007FFE26CD0000-0x00007FFE26EC5000-memory.dmp

    Filesize

    2.0MB

  • memory/3764-39-0x00007FFDE6D50000-0x00007FFDE6D60000-memory.dmp

    Filesize

    64KB

  • memory/3764-81-0x00007FFE26CD0000-0x00007FFE26EC5000-memory.dmp

    Filesize

    2.0MB

  • memory/3764-42-0x00007FFE26CD0000-0x00007FFE26EC5000-memory.dmp

    Filesize

    2.0MB

  • memory/3764-88-0x00007FFE26CD0000-0x00007FFE26EC5000-memory.dmp

    Filesize

    2.0MB

  • memory/3764-89-0x00007FFE26CD0000-0x00007FFE26EC5000-memory.dmp

    Filesize

    2.0MB

  • memory/3764-35-0x00007FFDE6D50000-0x00007FFDE6D60000-memory.dmp

    Filesize

    64KB

  • memory/3764-93-0x00007FFE26CD0000-0x00007FFE26EC5000-memory.dmp

    Filesize

    2.0MB

  • memory/3764-118-0x00007FFDE6D50000-0x00007FFDE6D60000-memory.dmp

    Filesize

    64KB

  • memory/3764-119-0x00007FFDE6D50000-0x00007FFDE6D60000-memory.dmp

    Filesize

    64KB

  • memory/3764-121-0x00007FFDE6D50000-0x00007FFDE6D60000-memory.dmp

    Filesize

    64KB

  • memory/3764-120-0x00007FFDE6D50000-0x00007FFDE6D60000-memory.dmp

    Filesize

    64KB

  • memory/3764-122-0x00007FFE26CD0000-0x00007FFE26EC5000-memory.dmp

    Filesize

    2.0MB

  • memory/3764-123-0x00007FFE26CD0000-0x00007FFE26EC5000-memory.dmp

    Filesize

    2.0MB