Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

5

076a7a2545...54.exe

windows7-x64

10

076a7a2545...54.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    138s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    25/12/2023, 05:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    076a7a25450e61549269d16ae8852e54.exe

  • Size

    512KB

  • MD5

    076a7a25450e61549269d16ae8852e54

  • SHA1

    2ab3a5e83a3850884a34085d387634c6e800bad4

  • SHA256

    265b40bc475243edad303405c47d59a87f670bda0ff21b8672b2023afc2fcaaf

  • SHA512

    fc64b38306c574e53ecc632fc0fd7853c60fd36a1e481505438d622e595daa0bb4a7bf197f4bab870311ef0db16919e533641993a15cea3a55fe5947cd78010a

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6O:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5D

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 10 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 21 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\076a7a25450e61549269d16ae8852e54.exe
    "C:\Users\Admin\AppData\Local\Temp\076a7a25450e61549269d16ae8852e54.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2440
    • C:\Windows\SysWOW64\urfcoumpmm.exe
      urfcoumpmm.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2300
      • C:\Windows\SysWOW64\kjxwowfm.exe
        C:\Windows\system32\kjxwowfm.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2904
    • C:\Windows\SysWOW64\gxluswknuzyanjg.exe
      gxluswknuzyanjg.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1356
    • C:\Windows\SysWOW64\kjxwowfm.exe
      kjxwowfm.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2932
    • C:\Windows\SysWOW64\ycrxkupwcfjpl.exe
      ycrxkupwcfjpl.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2504
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2924
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:1068

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe
      Filesize

      512KB

      MD5

      05cf46e2b2195f0f44d9bab6e62aa761

      SHA1

      97ba6f1c31751ee8fe2f3f8d92bfcc3fc0e23d85

      SHA256

      7318fbdb0ca1aa57524a597d3c1fbbab3729ed5150f7fa7b9d15ae191f667b46

      SHA512

      b406b3349015f3a0b61ec9cee95d5c3d0123fe76afbb487ad9ee7a86e14938cca41cc9de1ca38c85bcd5d7ce5a7b6eec7bea4bfd7e893e159956c80d28666e49

      Download Submit

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
      Filesize

      512KB

      MD5

      6fd2c9d8f31d54d2f5fe64dc5b9df936

      SHA1

      31e4f319168f63bef64c63a74f3d0913acd9279d

      SHA256

      d37a7df1de6efdab745f678e63804ea2968547d2a230d2dcb065fcdc02ac8db0

      SHA512

      f86c9ae0678ce74ea4d5aafd28ca17d7c1cff2bba92e7f9beb79c6d5e8eb4516fb3f7b520fa3478da57105ca7b8788273e9a120885b3ff8207abc678047aa7ed

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
      Filesize

      20KB

      MD5

      1eff1428f513f088a8fe0fc739645335

      SHA1

      134cd255e1543216fec59e31c118bafeddcda01f

      SHA256

      1a8d0929fa7f9314b3cde41f34843df191e669a0219eda5f48620a6438e5e1aa

      SHA512

      c32ecd0ed721958f9b9fb29cec1064c9810c81473b9ddffdfc15f67df564e2a9156209ffd5b3e6f7b8f4a3896da9f7ff33d3715c853c72e05c683dca2f46b4c5

      Download Submit

    • C:\Windows\SysWOW64\kjxwowfm.exe
      Filesize

      382KB

      MD5

      badd716c7c48a8241873d9251da496d1

      SHA1

      6bd2a072c8f64a1780fe75d983cb7b6584985c6d

      SHA256

      ad4373bfa026f66380b8ce44d6bc300d146770114fb10087019af7c616dc11d7

      SHA512

      7bf3f09216e2ba376053e668963797cd78f91119467917a84f467dd3110d6bd26592784cdf7cefd293413ff5b6dbe10a996d89627177235d9f109732c05f36c5

      Download Submit

    • C:\Windows\SysWOW64\kjxwowfm.exe
      Filesize

      384KB

      MD5

      0e151ec3919b72f9a6c7fe60d10f4ea0

      SHA1

      91fb01badc6db9808233ff95abf39c37982a8c85

      SHA256

      f644299fe8f10c5f3e24c1943fc808270b5d4f853e2316abf091c8d18344193c

      SHA512

      41d25f82ce04a14c21d19a9ad2d12663714221b6ecb1c3ee579a4a134949de0bfb3e6212e9acf97d0659d50e7a034dcdc103ecbedd8a71fbfefdc30f5728c12b

      Download Submit

    • C:\Windows\SysWOW64\kjxwowfm.exe
      Filesize

      512KB

      MD5

      fa4db5a711a4ae7805309db987cd13dd

      SHA1

      11d117b9e0e06fe413fd19b785b280db20dcff55

      SHA256

      d437013deab6aead3359590d2c8105a873b5c66d8b81919be4b53c73e80030dd

      SHA512

      0aad015377d025126b00c23029927270831ab68aa8b11316441b13caa10e9de37b0671b03ed5be51a103389d0f96fa6a2cd2f2ad11fe178d7cbccc33f0132a2f

      Download Submit

    • C:\Windows\SysWOW64\ycrxkupwcfjpl.exe
      Filesize

      93KB

      MD5

      257f28bd5bdc2b725434b7ab570814e7

      SHA1

      972446e0f8d210c5d6f42a57a921391a236d564d

      SHA256

      d80f45a5995ba038d69dbe87f7c12827ffa2b53e79beedb0bc6ee91c10a61688

      SHA512

      c27aa91c3c3605941a1a121021c840fc7886cf27d43e9d6b2c371888a276d9dfd39135600a4f933f62dfa3d46cb6e12de6e31b3f8b939676701ff37f8cc61575

      Download Submit

    • \Windows\SysWOW64\gxluswknuzyanjg.exe
      Filesize

      512KB

      MD5

      a26ebba7e41f19dc4b97042174b2b055

      SHA1

      bf446e29a6d198c3fe2fffc8273ce2c66b8a4762

      SHA256

      89476ba196ee197aac7f266b437d76aaedacbec153c3fc6386ddb2c7e020d192

      SHA512

      107cff6766d6625e2c33a3c5d8eff00ba5b0467a213bef94871aa174f313d4d5784a811a33c20db1cd2e2976bf8351c5c47073da18432af77a35f9d5f67b2ae9

      Download Submit

    • \Windows\SysWOW64\urfcoumpmm.exe
      Filesize

      512KB

      MD5

      4805b2b5892cf07c83d5b510dec86883

      SHA1

      dc80422e16e25b7318c188530c9564aff1714a0c

      SHA256

      05c983aacab788a437289247090b5a4ad69f0737f9b3395f6b6f0c7365a8b539

      SHA512

      373b6605544c2dd99adf034b4258ed67a0278920251e72d514d3b471bb45231ad7dcf4f7d0d0060499814c53ca5aa4885e06278c59b2aa0dd894250975504c39

      Download Submit

    • \Windows\SysWOW64\ycrxkupwcfjpl.exe
      Filesize

      101KB

      MD5

      7a4f86ad5d3555e6adc2275a2126740e

      SHA1

      e51f12dfdca7e50f690a9178939a09da3b3faa47

      SHA256

      8747d5a2df7cf5abc8af56b81877f530781be1a23f9e1cb2170999aa5feda41d

      SHA512

      91a4cdeae47dcc80a2fd81100b58551b60ee5d4a01a6e05960486b2c678dd5eea2873d95fa5668da3777696baff14aa599a958547678dd499a5142f2c1c5867e

      Download Submit

    • memory/2440-0-0x0000000000400000-0x0000000000496000-memory.dmp

      Filesize

      600KB

      Download

    • memory/2924-45-0x000000002F2F1000-0x000000002F2F2000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2924-46-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2924-47-0x0000000070F6D000-0x0000000070F78000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2924-81-0x0000000070F6D000-0x0000000070F78000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2924-102-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download