Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

5

26b55565d8...5f.exe

windows7-x64

10

26b55565d8...5f.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    145s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    25/12/2023, 14:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    26b55565d8b141f716191d5fcbbdaf5f.exe

  • Size

    512KB

  • MD5

    26b55565d8b141f716191d5fcbbdaf5f

  • SHA1

    406719021ae9f4ebf58cc4df5a6cebdd32e3bf46

  • SHA256

    1592771df224158a190193c4ef0f5bc196874c38edc1eb67974a740144add4a4

  • SHA512

    ff92f2c5cc32fd3e4d323a66204a0bc27268af3ef8ea7dc908df6dfc7e1af9028352642ca0fadbbb9b9b83488303b04ea1085f93c6836ed12a45a873b8bdfb35

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6j:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm50

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 13 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 50 IoCs
  • Suspicious use of SendNotifyMessage 34 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\26b55565d8b141f716191d5fcbbdaf5f.exe
    "C:\Users\Admin\AppData\Local\Temp\26b55565d8b141f716191d5fcbbdaf5f.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2060
    • C:\Windows\SysWOW64\mlvmmiihwk.exe
      mlvmmiihwk.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2300
      • C:\Windows\SysWOW64\mdjtoagn.exe
        C:\Windows\system32\mdjtoagn.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        PID:2588
    • C:\Windows\SysWOW64\ffvodmprmcdfrni.exe
      ffvodmprmcdfrni.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2816
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c bizwsrtbjudyx.exe
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2840
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2160
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:1032
      • C:\Windows\SysWOW64\bizwsrtbjudyx.exe
        bizwsrtbjudyx.exe
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2888
      • C:\Windows\SysWOW64\mdjtoagn.exe
        mdjtoagn.exe
        2⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2680
    • C:\Windows\SysWOW64\bizwsrtbjudyx.exe
      bizwsrtbjudyx.exe
      1⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      PID:2612
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2040

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe
      Filesize

      512KB

      MD5

      11eea816fb3b7d35dccb2e02fd40156d

      SHA1

      51ab2b86e6a48fabd25e8ded9eeab3c3336d65c0

      SHA256

      2f477d27f4c60e2248d28a1bcc2645f2caf47faf42b0b351b5361645a0dfac7e

      SHA512

      1f8c4f8f45806d42953adb4cb3401d98d548b8a9ad4c6c1abb236a1ce028737c622a408f6a2c05c38bce62cc3ac05b4d6366d3feb88bc2f89da2156d2024833b

      Download Submit

    • C:\Users\Admin\AppData\Roaming\TestPush.doc.exe
      Filesize

      512KB

      MD5

      a969c53cc14560bc92bb67c8230a1d6a

      SHA1

      0dd69092cca4e4145109893fc3b95a5d1d8a86da

      SHA256

      44b09886156d75f70a8ae48b439dd53337c12e52f4a547cb04306c446179f121

      SHA512

      4f8271989aff9784f23f6681520c81c06652a685cec76b1a9ebbcd3e50da798533d1a63efba7fd5a959f01eb66a1a1e72bdde98420f1cd65579eb8dd3ba0518a

      Download Submit

    • C:\Windows\SysWOW64\ffvodmprmcdfrni.exe
      Filesize

      182KB

      MD5

      81db2eb2aa07023f886ebea438bb61dd

      SHA1

      f6ce6b7500d309e21ed5491519a9c33df376b24b

      SHA256

      227ebe6d3652cf09d361daddfbd2d66c357652f55a7804c32e31d434b7d93ec1

      SHA512

      b66a4a323ce3a744c31f78af3dd26bcb253aa090cb13d8f88f5ff7a1dde444c53725b9adee03c70db67900ecaba171d92ccaee96f929e52246cbd6bfdffaaeae

      Download Submit

    • C:\Windows\SysWOW64\ffvodmprmcdfrni.exe
      Filesize

      92KB

      MD5

      6662b185f19fbf697c56a25c92de7961

      SHA1

      0df0c0df0de3724258df2549c583e3c934aca726

      SHA256

      c11edb9e97848e20319fba876d9382c7193f68323eff1f7ed805bb04303bdc86

      SHA512

      c6e2cb83f68a63ca299dae843d2697d41dab8b565fb4005755b0d255b388779b6c1dad97375009c995f0a3d2e0acb4cc820090ca5dc24ee11e1a3de5b1a4921f

      Download Submit

    • C:\Windows\SysWOW64\ffvodmprmcdfrni.exe
      Filesize

      438KB

      MD5

      baf570ad3e15b01f98209f60d6ae17d3

      SHA1

      ed6dbcd42fe9465409095c9b28ed96f8acb8c5d0

      SHA256

      f8f5654d829d829a07baec2055799c469ae92eb6b0b9b406d82cb9bb0f9282dd

      SHA512

      4883a3369d7774a4490c797c0121954832dbdaca958d03f8dc764bae187d6ad1e8dd753de1602b54f8e508f5be07f840c7f2d3e5ab2be12218ed3026c3189e06

      Download Submit

    • C:\Windows\SysWOW64\mdjtoagn.exe
      Filesize

      397KB

      MD5

      c619ba1640c1201ead375b4cd8c6cf91

      SHA1

      d9925acd812b7d29e4b60e3a7bba6da0867d9784

      SHA256

      608761584b55f93736e5a3e3e9865bf7fbb83ed27c513f1be83b9a24c0b99aa3

      SHA512

      5785839ddd9b54783bf1a4e523262bb651ccbb9f9b476ef0ce3537f01290cacb6c982fd87d9420449f33f1275c43b83bc4e83c97c73d93d19544ca16776e47a2

      Download Submit

    • C:\Windows\SysWOW64\mlvmmiihwk.exe
      Filesize

      414KB

      MD5

      b2a50a129e3360d168f7856792b4f099

      SHA1

      4a6d36d5bd0b83a1e207601c165e9de2644031fb

      SHA256

      841fbb2c27bfc61c86c85779f32480b874d9b027626dabc4da2bb87ac65ad1f3

      SHA512

      1b63e39c5aa3c8ec97d5cbbc59706ceb571dcd10b1a87bcbd387ec498d4d21a6a378190744866cc9e3809d05fbc748f19970a6b6683924302ced592df92d7ce4

      Download Submit

    • C:\Windows\mydoc.rtf
      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

      Download Submit

    • \Windows\SysWOW64\bizwsrtbjudyx.exe
      Filesize

      169KB

      MD5

      029e578f06d48a7a26e16ac4e9918bfc

      SHA1

      b59d5cbae9e6175f1b233b28d84b785908746145

      SHA256

      1f7608aff3b20dab0634f1e21e2e75ad24f1fe1c4f5f5afe6c06f56c7bc95548

      SHA512

      b77712c48f9e253faf2bb921d34f059624bb20ba0cc639be21d4645126b8963f7cbf8d88ba777028aa53453d0e74d922fce266ec1d247ef8d4e1236a48eb68f4

      Download Submit

    • \Windows\SysWOW64\bizwsrtbjudyx.exe
      Filesize

      63KB

      MD5

      48fcfc393a3d624bd016140255418455

      SHA1

      4da40b40bd11a08e1706d58e690b8640b0da3e41

      SHA256

      b2042741d162c37228cf5e3b20de65acc721502107ffc9f5b30b244b2829b370

      SHA512

      ce9e6e1b4e19f4f8adc7ca8f23d127caae7cc5472d138c0daad109360a3226c7006db92b3e1a41cc40f6a7739b650ec8821829859ba9f3ada1cf840581406869

      Download Submit

    • \Windows\SysWOW64\mdjtoagn.exe
      Filesize

      512KB

      MD5

      816db3bdc9c4509105e15b39684fc5c3

      SHA1

      f7b4a8ad8ca31ba7981746aaa94e274a9fa0ff99

      SHA256

      2a4cd0abcb50421e5d05d0d7dc2321308e9915b32d2df3ba7dc7a51dae67dc29

      SHA512

      eea7a7ec8ef58b1694f50260362254d9b79e4eabb82efb165563dc4d5173c6d84c8dc4f622515c76921397f28c36370c25a07ed71914b1a8deadbb8c5200abe0

      Download Submit

    • \Windows\SysWOW64\mlvmmiihwk.exe
      Filesize

      3KB

      MD5

      62722c53a274ad62bd1cc813eade1bad

      SHA1

      9083359c8d90daf567f32ae33ed34866bb3d782d

      SHA256

      f9f7153d1e55103b92e5fc04a77719ff0672235af7d454cfe0688a47c1d71ab9

      SHA512

      03be089eeddf2dba672c87e647a35ee5159c34cb7203843e3f216fa86ca533ee57dc5a8a166ba15c0003756602a6641ad9fd646f651500b49f4437494bb933a0

      Download Submit

    • memory/2040-68-0x0000000004120000-0x0000000004121000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2040-93-0x0000000004120000-0x0000000004121000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2040-98-0x0000000002660000-0x0000000002670000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2060-0-0x0000000000400000-0x0000000000496000-memory.dmp

      Filesize

      600KB

      Download

    • memory/2160-49-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2160-50-0x0000000070C4D000-0x0000000070C58000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2160-48-0x000000002FF91000-0x000000002FF92000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2160-70-0x0000000070C4D000-0x0000000070C58000-memory.dmp

      Filesize

      44KB

      Download