Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

5

f6e2a68c30...de.exe

windows7-x64

10

f6e2a68c30...de.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    130s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    28/12/2023, 20:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f6e2a68c300b8d85d3531713c955a0de.exe

  • Size

    512KB

  • MD5

    f6e2a68c300b8d85d3531713c955a0de

  • SHA1

    229e3ded0c9574a893040b977f282674ea1a9266

  • SHA256

    6fe8861871a9f84e41e33485dc681dfc0a3f642dbba81e0abdaec789c1e2af31

  • SHA512

    9ac978188172bd9968a1c4afa334a5c7d50dfb6d0773b6e3c0e4a9889cac6054bdddb8780f7bed16cf0e07af0777317d0df71b97829512616592b2088086308a

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6A:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5V

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 8 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 47 IoCs
  • Suspicious use of SendNotifyMessage 34 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\f6e2a68c300b8d85d3531713c955a0de.exe
    "C:\Users\Admin\AppData\Local\Temp\f6e2a68c300b8d85d3531713c955a0de.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1700
    • C:\Windows\SysWOW64\xxrxrcrjhc.exe
      xxrxrcrjhc.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2752
      • C:\Windows\SysWOW64\tndqdtwk.exe
        C:\Windows\system32\tndqdtwk.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        PID:2620
    • C:\Windows\SysWOW64\rjdjjicbniawu.exe
      rjdjjicbniawu.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2904
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2628
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:2368
      • C:\Windows\SysWOW64\tndqdtwk.exe
        tndqdtwk.exe
        2⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2564
      • C:\Windows\SysWOW64\detpsfmhhdkbgpp.exe
        detpsfmhhdkbgpp.exe
        2⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2824
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2492

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
      Filesize

      95KB

      MD5

      325d35d16810bf2ca20f49e9369ceafc

      SHA1

      16a818972ea75b6656eba8b6ca090be9e0bc8f03

      SHA256

      8798efdb1d409d30daf09e596ff0a6875f2f9b89e08c16e891206ddf0771a645

      SHA512

      a0664efd0a950150ffa3b7f79d76038579f20835e4b99043db61586a475ca9f06f1907b7cbdc46e36feb556a8d4cbf473a7f8a5aa51872a41b997c8904284893

      Download Submit

    • C:\Windows\SysWOW64\detpsfmhhdkbgpp.exe
      Filesize

      512KB

      MD5

      f91e7d235a2d19e6f2d48b17c31b700d

      SHA1

      a3979af690d5ccc54a3caedf4fafa1e711b3ea19

      SHA256

      2b73bba64fb2e49f25590a5044290b9226bd274907355c9bc137defed9efeb2c

      SHA512

      40d6762f3cd3997a86d7cf933e224629fe816af65d80ed94c193f154a6d9eb54423be6ef44957416c296fa1a8577e58a9eb3df95b8643edb7184f769af0f3b8a

      Download Submit

    • C:\Windows\SysWOW64\tndqdtwk.exe
      Filesize

      512KB

      MD5

      a3219c96324d988e50728abf00479086

      SHA1

      670fbb5adc9d7f1d59bfb13db6d0ad486944a9b0

      SHA256

      9c806fef81b58bbb3790f6b01a5a0094f2f97d0649ec6dbca3f8bd31cd60e8e3

      SHA512

      b95d216f78fb95ed484396c0bb18e43d4b9f57ce6fa5769e914697428466d62dac5892c395c29283266e9ce60ae789c29e74744aeced99111cc038bc4a80a486

      Download Submit

    • C:\Windows\SysWOW64\tndqdtwk.exe
      Filesize

      92KB

      MD5

      6662b185f19fbf697c56a25c92de7961

      SHA1

      0df0c0df0de3724258df2549c583e3c934aca726

      SHA256

      c11edb9e97848e20319fba876d9382c7193f68323eff1f7ed805bb04303bdc86

      SHA512

      c6e2cb83f68a63ca299dae843d2697d41dab8b565fb4005755b0d255b388779b6c1dad97375009c995f0a3d2e0acb4cc820090ca5dc24ee11e1a3de5b1a4921f

      Download Submit

    • \Windows\SysWOW64\rjdjjicbniawu.exe
      Filesize

      512KB

      MD5

      0bbc364befc059fd48f47867b75196e8

      SHA1

      a4633d1029cb4d36b5d12888624321633bcc08a1

      SHA256

      34335dc22c4114e0025053a4dc8e3cb8ea0edfdbf2db2df0620fe255cb51b67e

      SHA512

      6e19172aae63a2a706d3c3418f2771f2ef3fff6fb13b9b347fa8155ddde08de962f97a853da572ecd8f34b05b18f573d9d2d128524e368840d91b2897006c34c

      Download Submit

    • \Windows\SysWOW64\xxrxrcrjhc.exe
      Filesize

      512KB

      MD5

      0a3feb205d2e16b3599fc519c5bbe19c

      SHA1

      38a53c60df87f14be37c76c4a50ab271ee0a8a23

      SHA256

      559009689df9d2318ce41db14c0d15ed7ad45c65d8cebd788d36f1223b7e8875

      SHA512

      48c9b0f93fcabcbde8a2ab8232071277e23a612eba028323dbb099019742eb22a9180cc4a2b6319827fadfdc7def723f6b79f5837c0ff320c53dfab8fbb4044b

      Download Submit

    • memory/1700-0-0x0000000000400000-0x0000000000496000-memory.dmp

      Filesize

      600KB

      Download

    • memory/2492-85-0x0000000004030000-0x0000000004031000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2492-89-0x0000000004030000-0x0000000004031000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2628-45-0x000000002F4D1000-0x000000002F4D2000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2628-46-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2628-47-0x000000007134D000-0x0000000071358000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2628-87-0x000000007134D000-0x0000000071358000-memory.dmp

      Filesize

      44KB

      Download