Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

5

4e6932d087...fe.exe

windows7-x64

10

4e6932d087...fe.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    26/12/2023, 02:59

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4e6932d087ea67cc04844599c9ab1efe.exe

  • Size

    512KB

  • MD5

    4e6932d087ea67cc04844599c9ab1efe

  • SHA1

    f96a9dfb0eb8a0e16412fbd38e2dca3ec7d69a3a

  • SHA256

    aa7a29bcfdbcaf4b1ea6ba3dd0bcc1b9576b8062b4ad99e2f4249c46a49ba08e

  • SHA512

    0ba78a9de9f949528e86e6fabf2cd2baf81ee0a4fbb4e43f8a52c710f94125f3c853f633eeb87cd8fda8642c8bf0e043249b03942f9e54ea8af3a74e8e65b1c8

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6Z:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5m

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 11 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4e6932d087ea67cc04844599c9ab1efe.exe
    "C:\Users\Admin\AppData\Local\Temp\4e6932d087ea67cc04844599c9ab1efe.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2016
    • C:\Windows\SysWOW64\gsxbmrygid.exe
      gsxbmrygid.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2752
      • C:\Windows\SysWOW64\uismzhyj.exe
        C:\Windows\system32\uismzhyj.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2500
    • C:\Windows\SysWOW64\nepqnbsriwejnlf.exe
      nepqnbsriwejnlf.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2788
    • C:\Windows\SysWOW64\uismzhyj.exe
      uismzhyj.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2808
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2624
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:2208
      • C:\Windows\SysWOW64\ccbsdzwxeycrq.exe
        ccbsdzwxeycrq.exe
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2812

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe
      Filesize

      129KB

      MD5

      72c717bda8d4788d97fdc2113ac32abf

      SHA1

      60746eb84f5c57cd6dd1b154c730e11064fc5364

      SHA256

      66f715d2e6489426ddd3d4dfe65e97da80ea70dabf3320316b811c23ef130a54

      SHA512

      c6c0c628e04d96e514cec0d9851e135993b9d92222f9e3aaad662be75a5d40faa0575d6400dc7e5a7ce92d97f3922e20eb2542f002a673ebe81d04c41e3d0ac7

      Download Submit

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
      Filesize

      398KB

      MD5

      af149ec55666a759dbb45928138eb193

      SHA1

      ec8e11a09d5b5a4f625b98bc588d0e9f8aaf3b6d

      SHA256

      123c81e97f2ea8b4173b177a377ed4325fc18ecb820cafd2e2d5463f605ee672

      SHA512

      2eaee382b52d81d5a44f6fe988b7e25944821292160bc58abd975bc9d6e179cb1f900ac9996098829bd03b2eafd46ba8b9e63ceb9f96e071a7d94da115ef594c

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
      Filesize

      20KB

      MD5

      115058c5a41302f080d204cac6cc409d

      SHA1

      e8ac00d962ceb2cf22231afffa9ade815685074e

      SHA256

      00f0efa4ff36f9e6d9470477ed8e8c614a72473afecd6aa228cf1dcaf4cd3cab

      SHA512

      39829df1f0768359679a06bd930e5e718c2625d83994502e7c9aed232e76916dc47fa57bf3d01207753b613c29df7c3f200ae3cce9b9ac3924df9a19d1505043

      Download Submit

    • C:\Windows\SysWOW64\ccbsdzwxeycrq.exe
      Filesize

      382KB

      MD5

      badd716c7c48a8241873d9251da496d1

      SHA1

      6bd2a072c8f64a1780fe75d983cb7b6584985c6d

      SHA256

      ad4373bfa026f66380b8ce44d6bc300d146770114fb10087019af7c616dc11d7

      SHA512

      7bf3f09216e2ba376053e668963797cd78f91119467917a84f467dd3110d6bd26592784cdf7cefd293413ff5b6dbe10a996d89627177235d9f109732c05f36c5

      Download Submit

    • C:\Windows\SysWOW64\ccbsdzwxeycrq.exe
      Filesize

      93KB

      MD5

      257f28bd5bdc2b725434b7ab570814e7

      SHA1

      972446e0f8d210c5d6f42a57a921391a236d564d

      SHA256

      d80f45a5995ba038d69dbe87f7c12827ffa2b53e79beedb0bc6ee91c10a61688

      SHA512

      c27aa91c3c3605941a1a121021c840fc7886cf27d43e9d6b2c371888a276d9dfd39135600a4f933f62dfa3d46cb6e12de6e31b3f8b939676701ff37f8cc61575

      Download Submit

    • C:\Windows\SysWOW64\gsxbmrygid.exe
      Filesize

      96KB

      MD5

      97ebe3e5294035e674d3a6df982e678e

      SHA1

      10bcf2334dfd7bbc1b2a61064b928c155a7ca3f9

      SHA256

      d7882b4cdbfa3b49c93cced26e1f896f01b7dc7b1b456933847a9acf837360a6

      SHA512

      162c51631007ab9549cb6868654d0f62c91d0e2711c0f744d5cebd06d52f34aa4ac0088d5cf2322566df7e29b4f610b93ad5b6dcf8090116b2657ac81045038f

      Download Submit

    • C:\Windows\SysWOW64\nepqnbsriwejnlf.exe
      Filesize

      512KB

      MD5

      656207f63d8f0de589a26a1c301d1c28

      SHA1

      5c934f984d657d7b357898706627a6d2174404f8

      SHA256

      607569cea421dd056e2b689eba34ccbc745f262f8b18e8df9e332d491f1f4f5b

      SHA512

      bdee4afb21d661205e57b9a965404e7adde1715082a85f49dee18eace92570d94a83ae380117836cf0a227facf7600ef6e506a92565aa229e7191ea5fe075a6c

      Download Submit

    • C:\Windows\SysWOW64\uismzhyj.exe
      Filesize

      92KB

      MD5

      6662b185f19fbf697c56a25c92de7961

      SHA1

      0df0c0df0de3724258df2549c583e3c934aca726

      SHA256

      c11edb9e97848e20319fba876d9382c7193f68323eff1f7ed805bb04303bdc86

      SHA512

      c6e2cb83f68a63ca299dae843d2697d41dab8b565fb4005755b0d255b388779b6c1dad97375009c995f0a3d2e0acb4cc820090ca5dc24ee11e1a3de5b1a4921f

      Download Submit

    • \Windows\SysWOW64\ccbsdzwxeycrq.exe
      Filesize

      512KB

      MD5

      4f23169d4d1ef9940d2548e8a0931cef

      SHA1

      46810b29873801fb120405e7f0edb9be15fb4073

      SHA256

      b040286c0f7fd575df7998bae73a6ad4096d123fcd5453b3e5175c67fe6602ea

      SHA512

      a3848559105d716e2deb8ed22e726c15891d023eeb85d61b65aba08ecd6921ea678e30565cbe6ccd024d3abe326ad089e499fa7f9bdde996fc60c4d068f2fc21

      Download Submit

    • \Windows\SysWOW64\gsxbmrygid.exe
      Filesize

      512KB

      MD5

      a5e9847965978d1d01aa7aa1698dddb0

      SHA1

      8fa26cc539551270a22b174f1e48950ee6451266

      SHA256

      42ceba2e3e433a1168ce588f6274508f72640dc5e6ca7877f43e3a31751efb16

      SHA512

      34bca2bf145a03795509cba29f8a7d10dbac615c4520f5acc15ea00694f7b50f3d094c1bc3a2e7a6350d329b76dbbf004e42f7c556736a9add3ff433a1885ad4

      Download Submit

    • \Windows\SysWOW64\uismzhyj.exe
      Filesize

      512KB

      MD5

      0811ff0456fb8697139480de9a276b17

      SHA1

      e410eff1ce93e415fda21b7ec04d5b088938480b

      SHA256

      ae4f57e41dd01b5901f953db40391acaa147acf4e440ef6298d6df5d235e878d

      SHA512

      56bad0e94dc7a382e4210e51c4da545a950f2ce5ee72f155891682adf10e3c243a6cf613816fd43c9f5ac7fbfd3993c643568ac76e6aad63c04c28704261f908

      Download Submit

    • memory/2016-0-0x0000000000400000-0x0000000000496000-memory.dmp

      Filesize

      600KB

      Download

    • memory/2624-45-0x000000002F581000-0x000000002F582000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2624-46-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2624-47-0x0000000070D8D000-0x0000000070D98000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2624-76-0x0000000070D8D000-0x0000000070D98000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2624-97-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download