Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/12/2023, 00:12

General

  • Target

    4583dc20ee9c673bfcd517fab7d88bbf.exe

  • Size

    512KB

  • MD5

    4583dc20ee9c673bfcd517fab7d88bbf

  • SHA1

    cc4fdf65702ff682b9e1692ce83aa9d3e2828111

  • SHA256

    478e070b3f86342ff2fc22562142633932121d6244bb55160ae4713159580cb1

  • SHA512

    d06f549136eb15f83001f405a3005594b1544e9944c14c1c85eaf57079fe701ef03a729c29a5365321a63fd909f51b889a152ec16fd01f89c257056edd7c9d97

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6E:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5R

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 5 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 6 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
  • AutoIT Executable 10 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4583dc20ee9c673bfcd517fab7d88bbf.exe
    "C:\Users\Admin\AppData\Local\Temp\4583dc20ee9c673bfcd517fab7d88bbf.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:680
    • C:\Windows\SysWOW64\duqqdysuwz.exe
      duqqdysuwz.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:5016
      • C:\Windows\SysWOW64\mlonvgzl.exe
        C:\Windows\system32\mlonvgzl.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:404
    • C:\Windows\SysWOW64\obmokcsqkdlmosx.exe
      obmokcsqkdlmosx.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3000
    • C:\Windows\SysWOW64\zpkkoajaskbtc.exe
      zpkkoajaskbtc.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2192
    • C:\Windows\SysWOW64\mlonvgzl.exe
      mlonvgzl.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1204
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:4488

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

    Filesize

    3KB

    MD5

    a4944b1c5d5c5840e557842437ef9208

    SHA1

    898136b71930a24f0cf9de57509a25990d80d090

    SHA256

    d6a89a53bc69fc865b3a01c758d8734f26db78314bc6707630cb090046a33aaf

    SHA512

    efb4027afe5c2fd9f980641d6d292623adefdb1ed6eb2d8022a4de29000bac5b640662f0cf94dac20922c8f2c75f12eb2a01a7bde9cf7d17cd2389e377f18e01

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

    Filesize

    3KB

    MD5

    537a467d27abe78d4a7b4e01c7ca7ea4

    SHA1

    479d59c7998944bcfd4c4a6932ded5c2d8ee05e2

    SHA256

    317b01f799954c115892be4b0bbcc6482dc9b8b732545630934487715910b0bd

    SHA512

    687b6e5ce9a96dc0f6a5b76087c6530ac83cdde235b719632fb29927705542fd592f91c7f84c805ea10d23f13e621e3f224e343fe40fb44c102030ed5f8f5509

  • C:\Users\Admin\Documents\MergeSkip.doc.exe

    Filesize

    93KB

    MD5

    257f28bd5bdc2b725434b7ab570814e7

    SHA1

    972446e0f8d210c5d6f42a57a921391a236d564d

    SHA256

    d80f45a5995ba038d69dbe87f7c12827ffa2b53e79beedb0bc6ee91c10a61688

    SHA512

    c27aa91c3c3605941a1a121021c840fc7886cf27d43e9d6b2c371888a276d9dfd39135600a4f933f62dfa3d46cb6e12de6e31b3f8b939676701ff37f8cc61575

  • C:\Windows\SysWOW64\duqqdysuwz.exe

    Filesize

    385KB

    MD5

    279a2620e67ba2860803639715d616fb

    SHA1

    2d61471cafcc1c2fb06dd6ac75396f9e7c856f52

    SHA256

    399ca40a278578c7b9ec69d047c914ea58fcd007d6703c4fcd3db2a892a016f1

    SHA512

    bd2c40f12ad56957ec0c184c0f84fcaeed8bf39efd985fe14130e93f0ac568fc578d215defa208a168b171a5947dd0d0de5b5c46f304b5e9c3b6d377e5438a69

  • C:\Windows\SysWOW64\duqqdysuwz.exe

    Filesize

    193KB

    MD5

    a31008e1bf36948c5790f46d6a5b364b

    SHA1

    53e1bd64f986806dc72e3343c87b65f8afed897a

    SHA256

    0fe3f5e6e9138cafa7435072ebda5646c80f646add2cc306b55a468cd10c4886

    SHA512

    1474fa94a858054307521aa2fc7d0880d9ea131693643bf113304ee32d9a7b731a14668d2a2944bcc7e8b7644408bd98ac2bb7f305b0d74447cc13630fa63538

  • C:\Windows\SysWOW64\mlonvgzl.exe

    Filesize

    381KB

    MD5

    30aec9e0b33fbd99234328357879f812

    SHA1

    3c9d37139d4ccfe2b694afba9633170d0f510a92

    SHA256

    15aad0daaaeea2f1eb8d19a8999f42844b2885d6bef949f6787feba7dad46563

    SHA512

    2060f2cc8c90181dd0a9965f0ff3a94aece08c82c4a68454846f66778bc60dade3ba5ddc38be57311ff4a7bd78217b89a9cd09837eee4b5d9893277299dad415

  • C:\Windows\SysWOW64\obmokcsqkdlmosx.exe

    Filesize

    79KB

    MD5

    23d80d6c0f188b47e51f974a0b802708

    SHA1

    5b510e857b46de80c83e904a670f22db4c06ba4d

    SHA256

    a068be9b5cc41de25f043a1f42d6a9b3a126c1b3062db6a5612299b8519da527

    SHA512

    a09d83298f2d15fef3bb9699878a40d07ecb69b13d340709a32423b56edcc79e97cc398cba7b6915bf5b0e186a239e1d800c59e04c9fa4b82e45c042d94a3799

  • C:\Windows\SysWOW64\obmokcsqkdlmosx.exe

    Filesize

    512KB

    MD5

    4daa3607e31fca67b398b1f1176fb57e

    SHA1

    a1b49c6edda15b30e6b97e5afad456e61c66f247

    SHA256

    f8fe772e9c350eca73958d3782001e5541a44600a13224660c213315b023314a

    SHA512

    2017b9605a70e2c7ab68a6b77b636f7fca5abf9f39e15a9866a693fd2206bffa1daeafb6150de0e00cac2515c3af8be8a59aa651c8252ea737e293fa39374ac2

  • C:\Windows\SysWOW64\zpkkoajaskbtc.exe

    Filesize

    92KB

    MD5

    6662b185f19fbf697c56a25c92de7961

    SHA1

    0df0c0df0de3724258df2549c583e3c934aca726

    SHA256

    c11edb9e97848e20319fba876d9382c7193f68323eff1f7ed805bb04303bdc86

    SHA512

    c6e2cb83f68a63ca299dae843d2697d41dab8b565fb4005755b0d255b388779b6c1dad97375009c995f0a3d2e0acb4cc820090ca5dc24ee11e1a3de5b1a4921f

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

    Filesize

    512KB

    MD5

    fb3648ab18a1337709071b816c52d595

    SHA1

    b018964b38e779a41939be9bf4d42ebaa46b526c

    SHA256

    1fe2174c568996251b181d16d3adbff657d4fb95636ed9b555f7d8752b14c01b

    SHA512

    0c6b1ee3c81e34d555136e0b8ad16d300f3aa3c35770012c303c9b207260b0331e44f2758d1fe3f3d8a6f95049f9856ca583a532e6fbfa98c624543a2a867ee4

  • memory/680-0-0x0000000000400000-0x0000000000496000-memory.dmp

    Filesize

    600KB

  • memory/4488-44-0x00007FF9F22D0000-0x00007FF9F24C5000-memory.dmp

    Filesize

    2.0MB

  • memory/4488-38-0x00007FF9B2350000-0x00007FF9B2360000-memory.dmp

    Filesize

    64KB

  • memory/4488-50-0x00007FF9F22D0000-0x00007FF9F24C5000-memory.dmp

    Filesize

    2.0MB

  • memory/4488-53-0x00007FF9F22D0000-0x00007FF9F24C5000-memory.dmp

    Filesize

    2.0MB

  • memory/4488-54-0x00007FF9F22D0000-0x00007FF9F24C5000-memory.dmp

    Filesize

    2.0MB

  • memory/4488-52-0x00007FF9AFCB0000-0x00007FF9AFCC0000-memory.dmp

    Filesize

    64KB

  • memory/4488-55-0x00007FF9F22D0000-0x00007FF9F24C5000-memory.dmp

    Filesize

    2.0MB

  • memory/4488-56-0x00007FF9F22D0000-0x00007FF9F24C5000-memory.dmp

    Filesize

    2.0MB

  • memory/4488-51-0x00007FF9F22D0000-0x00007FF9F24C5000-memory.dmp

    Filesize

    2.0MB

  • memory/4488-48-0x00007FF9F22D0000-0x00007FF9F24C5000-memory.dmp

    Filesize

    2.0MB

  • memory/4488-57-0x00007FF9AFCB0000-0x00007FF9AFCC0000-memory.dmp

    Filesize

    64KB

  • memory/4488-45-0x00007FF9F22D0000-0x00007FF9F24C5000-memory.dmp

    Filesize

    2.0MB

  • memory/4488-42-0x00007FF9B2350000-0x00007FF9B2360000-memory.dmp

    Filesize

    64KB

  • memory/4488-40-0x00007FF9B2350000-0x00007FF9B2360000-memory.dmp

    Filesize

    64KB

  • memory/4488-39-0x00007FF9B2350000-0x00007FF9B2360000-memory.dmp

    Filesize

    64KB

  • memory/4488-49-0x00007FF9F22D0000-0x00007FF9F24C5000-memory.dmp

    Filesize

    2.0MB

  • memory/4488-37-0x00007FF9B2350000-0x00007FF9B2360000-memory.dmp

    Filesize

    64KB

  • memory/4488-79-0x00007FF9F22D0000-0x00007FF9F24C5000-memory.dmp

    Filesize

    2.0MB

  • memory/4488-46-0x00007FF9F22D0000-0x00007FF9F24C5000-memory.dmp

    Filesize

    2.0MB

  • memory/4488-47-0x00007FF9F22D0000-0x00007FF9F24C5000-memory.dmp

    Filesize

    2.0MB

  • memory/4488-43-0x00007FF9F22D0000-0x00007FF9F24C5000-memory.dmp

    Filesize

    2.0MB

  • memory/4488-127-0x00007FF9B2350000-0x00007FF9B2360000-memory.dmp

    Filesize

    64KB

  • memory/4488-128-0x00007FF9B2350000-0x00007FF9B2360000-memory.dmp

    Filesize

    64KB

  • memory/4488-129-0x00007FF9B2350000-0x00007FF9B2360000-memory.dmp

    Filesize

    64KB

  • memory/4488-131-0x00007FF9F22D0000-0x00007FF9F24C5000-memory.dmp

    Filesize

    2.0MB

  • memory/4488-130-0x00007FF9B2350000-0x00007FF9B2360000-memory.dmp

    Filesize

    64KB

  • memory/4488-133-0x00007FF9F22D0000-0x00007FF9F24C5000-memory.dmp

    Filesize

    2.0MB

  • memory/4488-132-0x00007FF9F22D0000-0x00007FF9F24C5000-memory.dmp

    Filesize

    2.0MB

  • memory/4488-41-0x00007FF9F22D0000-0x00007FF9F24C5000-memory.dmp

    Filesize

    2.0MB