Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/12/2023, 20:48

General

  • Target

    3c415d5af2c85fde8f34cbc488575884.exe

  • Size

    512KB

  • MD5

    3c415d5af2c85fde8f34cbc488575884

  • SHA1

    09d9590db6103bf7c6ef4a703633549573836932

  • SHA256

    64987c5eda9958d49fd547d39cc9e55b991d6495f7ac70144db2da9ed6c863c1

  • SHA512

    7f0aaa6213c284f49a168887921ee87603748153462e60872b8b6efa6d500e008eea4a4467a92413bf0681f7fb763cc0820610437d71abdb00d599e92449fc1b

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6Z:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5M

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 5 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 6 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
  • AutoIT Executable 15 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 13 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3c415d5af2c85fde8f34cbc488575884.exe
    "C:\Users\Admin\AppData\Local\Temp\3c415d5af2c85fde8f34cbc488575884.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3732
    • C:\Windows\SysWOW64\uyqfmeoetegkccm.exe
      uyqfmeoetegkccm.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3536
    • C:\Windows\SysWOW64\gykdrhcdfhkjs.exe
      gykdrhcdfhkjs.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4572
    • C:\Windows\SysWOW64\tntptsdx.exe
      tntptsdx.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3376
    • C:\Windows\SysWOW64\ydlpgmlyhz.exe
      ydlpgmlyhz.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3740
      • C:\Windows\SysWOW64\tntptsdx.exe
        C:\Windows\system32\tntptsdx.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1564
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:428

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe

    Filesize

    34KB

    MD5

    4dd6a4084af3ca5a5e57fd135151cc8a

    SHA1

    7c40d1f77c722dc6b0c0dbcf068d962fb84f0240

    SHA256

    beb11be169f617ecb22f069d76a8f0e0d1099e115b01836d0d71c923e09ba7af

    SHA512

    cf94b294c2e984597ce87fc9b9817221a70ea4724715008adaa51c6d8275131c6c126910eb7a3c2126ff2dfd0a884871dc7430bc3ce5517cb35023c9b9f98896

  • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

    Filesize

    239B

    MD5

    12b138a5a40ffb88d1850866bf2959cd

    SHA1

    57001ba2de61329118440de3e9f8a81074cb28a2

    SHA256

    9def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf

    SHA512

    9f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

    Filesize

    3KB

    MD5

    631a5c44f7cd4ed4c5b117ac53f7ea6b

    SHA1

    ea47e88b596dd25f7ddc7e3ee7082657e179dc9d

    SHA256

    523e27f5d08dfacc85c4664a81af3ce7eff3302b338b6f6de3217e73acb1d7b5

    SHA512

    8bd1533529f58542151392a1c901659ef3c9d6d63cea53edb3f569832cd8846f19ef2a0a4834de8542e4cf42f2de87fbcedfc7ddc15f0c293e81758cfd2899b6

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

    Filesize

    3KB

    MD5

    fb37f50455f56e226fd1b26d0d75a863

    SHA1

    fed093068c75a6ce3c23e2ec3231728402daf8df

    SHA256

    978e2fab28f16a3c9605698daba3812e7eb312475ee752d62db99a4c2db35595

    SHA512

    84085a7d04cbe4ab1571ab8220c3e7753240118ea958e20c78a4b9e6652456a7e2df79c6451b2f25858fc417775125dd9a8aec1bc6edfdf62713f62d1790f594

  • C:\Windows\SysWOW64\gykdrhcdfhkjs.exe

    Filesize

    72KB

    MD5

    bd338c1fc516a9f78f0576d7d45cd28b

    SHA1

    2f4003c7a0dd8713de2141809f5ec94777a57589

    SHA256

    43a0042acb661c3e73885a10e456447be817764c2018d7464c2192c4dfcfcadc

    SHA512

    e0e10ab6d8eea09a65e9183ade013760835f4c4680496c8cf3a9f1bc8055258237c640c5319a27f577812b4f51effa59f89ccdbe6cf3a619d41217733a0c106b

  • C:\Windows\SysWOW64\gykdrhcdfhkjs.exe

    Filesize

    23KB

    MD5

    316565bbb1ad5865f7a398f923100bba

    SHA1

    3b920a705b75bacceef1ada1a8cec6a8a9ac8b70

    SHA256

    b403a992e6393e85f2290ed34c68123cac57db3d59ee01b6445179eb44825607

    SHA512

    4444713b1da2338ba5dc672b4a9f188495efec81d9e577da1d94d66400c8d551229fc4548527aa408ed53200d14e227e840b9ca587127af345bd047c88210906

  • C:\Windows\SysWOW64\tntptsdx.exe

    Filesize

    37KB

    MD5

    ee0532ed354e9400e6c1b97f1afe24b6

    SHA1

    b401a5846fcc92984367ff21fd1d476ce9582c20

    SHA256

    471486e7495e6889dbc1bb493f79ec9b835f8514a3a18e2a274361dc7efc881d

    SHA512

    7dfc7ee74d0eb05a077d816254525cd78613e3c03243681e52c1a5c69ed61b5cdd87c40b807271da6f3b6d6ad8540b038a6810740648633cc1b2d8cc1238b7a2

  • C:\Windows\SysWOW64\tntptsdx.exe

    Filesize

    26KB

    MD5

    cd88893713d169f06be990ff0777b0df

    SHA1

    4e73ab6393c6976bcfb968754d328e9776dc80a2

    SHA256

    2cbb1ab6bed314274bfe29a50425679e23b9367efc9d092bbf5b13f70a8a5efa

    SHA512

    f6b2c7ea14076ef04c42face863f0ea65f1780d3d5c28733e9bb4ff866a4c8d1a7e2b6f3469a30b540064e0d00cdc295d03efbe6d003e13d17555d704ee047a9

  • C:\Windows\SysWOW64\tntptsdx.exe

    Filesize

    271KB

    MD5

    fca644f7da793b8b351a6af06393e1df

    SHA1

    1eb582249d1dd159f972b09c98d432f83e63ad9a

    SHA256

    cab194846bd7c5cb443bf75b16edc4f7ebd476a966c30469e306364d09de365b

    SHA512

    4c2f4fda8594b786caf10ba16aba634ae46cc0225813fbe07daf5b244ab8646ce106d3bd99eb0a317991803a971317d623949eeeb39995c526803787e662b74d

  • C:\Windows\SysWOW64\uyqfmeoetegkccm.exe

    Filesize

    69KB

    MD5

    275aa25f1191b6b2fb875b064ae48795

    SHA1

    c4800cff7d9e682dcf0a8149fd1d06c58932153f

    SHA256

    9ea124f2ee84215afa7e2cb8d4789f09dc2f98cdb0341b6994e3924b22e1164e

    SHA512

    5445a22ce49774baf14a9c1d4a8eeb4ae2fcd25548d1670536b10f531343048013a8434bc1487ab6dec8d10f1fa9328847db95f6f8b0acd8a31bb175167db547

  • C:\Windows\SysWOW64\uyqfmeoetegkccm.exe

    Filesize

    26KB

    MD5

    997852b3c88fb34e1ec134994da133ce

    SHA1

    169c32e49cf9b096d0f14591c6f338bbe35dbe08

    SHA256

    9ac09ae90133631efaf7b2eadb1f5ac0431d7af761ca94a25b38c38c89396cb0

    SHA512

    5e12f9969633dceb5fa925436f17ea1d8afcf8443ad498a0ab48620b3d945bfb0b934b2ecbd920554801672535b872699edfb728b8a8764f411c5bf07ecc8746

  • C:\Windows\SysWOW64\uyqfmeoetegkccm.exe

    Filesize

    83KB

    MD5

    2a54e303aee0c0e8ab3d8bce62e06ba8

    SHA1

    7c61cc4a29d18271f3dd2809d0d128f55088227f

    SHA256

    c6db71fd523c9cfc0bd9f8e84bb7b498d64776519a265ecbb4538ac6d0ff2f75

    SHA512

    0a2205d67492078779bcbfd3ff460d04dd5acaffff60ba653494ebb19a3f95173bf592602cebe0393c263ee5705a1919cb2533b67ff59638dd8a35d48d35b56e

  • C:\Windows\SysWOW64\ydlpgmlyhz.exe

    Filesize

    103KB

    MD5

    b61aed70af76d9533feb23645a6d363b

    SHA1

    6f82f16cc93901e48a17b7e60c92111458b5fd82

    SHA256

    cfe30755a9064faf72b6ed612a05da2bf41e198be44dae6330d5e56eac9f760a

    SHA512

    f73f78f8466ebac1331139f6e9390df4dae1bc0b9f664a2bfcdc24953f9d227b33e8da32b6e795b20f6f221f070a3ffca0d9efc00ed19abd79fb2420dfd3af2a

  • C:\Windows\SysWOW64\ydlpgmlyhz.exe

    Filesize

    77KB

    MD5

    5bebab637634352d84ad4f939100741b

    SHA1

    a1e8442bd9e9b9d90ad284e3689429ebb34f8b90

    SHA256

    fb58fa0939023feff2c58748dc67a4f46c5dbc4d68d542747a02ccfc919b74ab

    SHA512

    0785689502ef5fedfe3efe3407a06247debf4dc9f1853f00d1ad4af1b9610ce125e0116930d160c249ca2a33dd825243ca141e3b96183fb9b90e7371dde3da00

  • C:\Windows\mydoc.rtf

    Filesize

    223B

    MD5

    06604e5941c126e2e7be02c5cd9f62ec

    SHA1

    4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

    SHA256

    85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

    SHA512

    803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

    Filesize

    156KB

    MD5

    039a3b388dfd0983d63fc143b96e58c3

    SHA1

    5619436bb567b9a4e019a5727b39761ffbc1c7d4

    SHA256

    7f34b7eb72e97457f4b56efd5a2f312f81603c08a600199ce5e238d21a67fc3a

    SHA512

    f224fc6947d4ccccbb7a6a9c5ecad35b19878427b5820b3004842c9295da6faefb0c131c91b8c503937a5c7d89fc3e259a1a41b94a8e4367439c0c9215187fec

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

    Filesize

    200KB

    MD5

    e19818c1304195cc62cdf7a7fc16baaf

    SHA1

    b66a9b600cccb5de0fb5afbe7b6cf22c2e8a3027

    SHA256

    857b52ee8e690e1977c7f75b8c713903d7e25f6d38f84d3da82fefddda3e3e6a

    SHA512

    a719cd98af4942e443ec1e3b215c3a0ce4e8e192ea2844d2b04857659a023d644bbe6a466e11d0931a6cb9c18bd994a00dbf8710d036ca48b95ee43cf2632a5c

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

    Filesize

    96KB

    MD5

    df9870ea8cfacc4f1dfb288e74e5aeeb

    SHA1

    8f80db98344f2c99619f052d566a5f896d57e345

    SHA256

    cead622fd04ac0086d9b9c0fc4d4c26b79ce13f7faaf379c80e96993deaf682d

    SHA512

    44b4074107c680a5a8b5235f30333e46c84fc6fd62b5f065fecc8bc3911e729214bff12cdeca976aec83613cec9f00b5352c1ee947064185bb5122ce62ead8f9

  • memory/428-39-0x00007FFF289D0000-0x00007FFF289E0000-memory.dmp

    Filesize

    64KB

  • memory/428-47-0x00007FFF68950000-0x00007FFF68B45000-memory.dmp

    Filesize

    2.0MB

  • memory/428-55-0x00007FFF26770000-0x00007FFF26780000-memory.dmp

    Filesize

    64KB

  • memory/428-51-0x00007FFF26770000-0x00007FFF26780000-memory.dmp

    Filesize

    64KB

  • memory/428-50-0x00007FFF68950000-0x00007FFF68B45000-memory.dmp

    Filesize

    2.0MB

  • memory/428-48-0x00007FFF68950000-0x00007FFF68B45000-memory.dmp

    Filesize

    2.0MB

  • memory/428-45-0x00007FFF68950000-0x00007FFF68B45000-memory.dmp

    Filesize

    2.0MB

  • memory/428-43-0x00007FFF68950000-0x00007FFF68B45000-memory.dmp

    Filesize

    2.0MB

  • memory/428-42-0x00007FFF289D0000-0x00007FFF289E0000-memory.dmp

    Filesize

    64KB

  • memory/428-40-0x00007FFF289D0000-0x00007FFF289E0000-memory.dmp

    Filesize

    64KB

  • memory/428-38-0x00007FFF68950000-0x00007FFF68B45000-memory.dmp

    Filesize

    2.0MB

  • memory/428-52-0x00007FFF68950000-0x00007FFF68B45000-memory.dmp

    Filesize

    2.0MB

  • memory/428-36-0x00007FFF289D0000-0x00007FFF289E0000-memory.dmp

    Filesize

    64KB

  • memory/428-53-0x00007FFF68950000-0x00007FFF68B45000-memory.dmp

    Filesize

    2.0MB

  • memory/428-49-0x00007FFF68950000-0x00007FFF68B45000-memory.dmp

    Filesize

    2.0MB

  • memory/428-54-0x00007FFF68950000-0x00007FFF68B45000-memory.dmp

    Filesize

    2.0MB

  • memory/428-46-0x00007FFF68950000-0x00007FFF68B45000-memory.dmp

    Filesize

    2.0MB

  • memory/428-44-0x00007FFF289D0000-0x00007FFF289E0000-memory.dmp

    Filesize

    64KB

  • memory/428-41-0x00007FFF68950000-0x00007FFF68B45000-memory.dmp

    Filesize

    2.0MB

  • memory/428-132-0x00007FFF68950000-0x00007FFF68B45000-memory.dmp

    Filesize

    2.0MB

  • memory/428-103-0x00007FFF68950000-0x00007FFF68B45000-memory.dmp

    Filesize

    2.0MB

  • memory/428-104-0x00007FFF68950000-0x00007FFF68B45000-memory.dmp

    Filesize

    2.0MB

  • memory/428-105-0x00007FFF68950000-0x00007FFF68B45000-memory.dmp

    Filesize

    2.0MB

  • memory/428-128-0x00007FFF289D0000-0x00007FFF289E0000-memory.dmp

    Filesize

    64KB

  • memory/428-129-0x00007FFF289D0000-0x00007FFF289E0000-memory.dmp

    Filesize

    64KB

  • memory/428-130-0x00007FFF289D0000-0x00007FFF289E0000-memory.dmp

    Filesize

    64KB

  • memory/428-131-0x00007FFF289D0000-0x00007FFF289E0000-memory.dmp

    Filesize

    64KB

  • memory/428-133-0x00007FFF68950000-0x00007FFF68B45000-memory.dmp

    Filesize

    2.0MB

  • memory/3732-0-0x0000000000400000-0x0000000000496000-memory.dmp

    Filesize

    600KB