Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/12/2023, 22:25

General

  • Target

    05906c39cad698da162ccf37f3964228.exe

  • Size

    512KB

  • MD5

    05906c39cad698da162ccf37f3964228

  • SHA1

    0cf0214a3cb6a32e5bc139d6dcff6b7cbb2bcd88

  • SHA256

    e1d59c5b329a280bc03ddc31f57e993eb14fb4afa7d80c4feb7b99c787699065

  • SHA512

    3654a9d697e49d2c245d6dd82c49e5e5db9eedb347e7349d443e9a2247115a15fc27294f3def10a83a71a241fc4266e50d84b4d6633eb5304e139c3b9869c26b

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6i:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm51

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 5 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 6 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
  • AutoIT Executable 8 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\05906c39cad698da162ccf37f3964228.exe
    "C:\Users\Admin\AppData\Local\Temp\05906c39cad698da162ccf37f3964228.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4788
    • C:\Windows\SysWOW64\pjtvmadgvw.exe
      pjtvmadgvw.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4972
      • C:\Windows\SysWOW64\gjxtygvf.exe
        C:\Windows\system32\gjxtygvf.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1856
    • C:\Windows\SysWOW64\ucybtwtikcylseg.exe
      ucybtwtikcylseg.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2340
    • C:\Windows\SysWOW64\gjxtygvf.exe
      gjxtygvf.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2756
    • C:\Windows\SysWOW64\skccszkiupnev.exe
      skccszkiupnev.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1040
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:632

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe

    Filesize

    512KB

    MD5

    13dd77cd52235b3323c9ed73e365683d

    SHA1

    5c53cb5c8292c210453ea95029512ddeb4662d70

    SHA256

    c288566b306558605b61710fe16b7bccecdb0a320a461746a3906520dabeb43e

    SHA512

    62b377ac76b63575a52143c14b73e45e4dbee7889d3feb617a658856836a6131d3006f91764d27146be61dd63949ba5ffb7ca5fe25623bbacef392d09b49bb38

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

    Filesize

    3KB

    MD5

    9d2d45186aec469739dccfd9142bf581

    SHA1

    210796ef1261037e8174bdb59c3f0ce5a5c1b2a0

    SHA256

    bba36215398b951d2f54ea9759bdbdb85a33700afb257f9587f4c0474ec02aa6

    SHA512

    986c10e2dcdae8bf4efa1c4c7de530a0625d6413ffb7f16412ac50f812894d490ded5e67a436802783ac7b1723198b5962e3990640bf34f859abdc4e4928c81c

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

    Filesize

    3KB

    MD5

    afdedf96e787677f71dffb4226ca4ba3

    SHA1

    4b10a3f3a6c80c965094f6fc70d9cf05b9a97b66

    SHA256

    7dcb2cfc0fb6cf92860eb0b7a0c12aae441dc56b9a33a8e8398885d33797c896

    SHA512

    c175e7dac486ed80b4ab126d2815ea2d5d7713b72699ecfdaed2a32267a37a80cb7c16e58055e33431a8a563b689a4527d3b484174d134ca73297f29c6739991

  • C:\Windows\SysWOW64\gjxtygvf.exe

    Filesize

    512KB

    MD5

    80d4bbea15f9a4d057a5c82c9668c9d7

    SHA1

    1ea88ea5bde914d7a60b9fd9755c791ac7c91d22

    SHA256

    41c9853d9c9d4b65ef4edd56824ce2f728bf70a14feb9592537d3664595082ce

    SHA512

    18ff53b0f37336ca14939967aec6293d97d7d181585e366a0ec61152cdfa8b7784187673b72f1d26c71383a8c9cedaa3b1ecacb6c8522dc7bc2a15c4eba0b1b7

  • C:\Windows\SysWOW64\pjtvmadgvw.exe

    Filesize

    512KB

    MD5

    ac914cb54a986f0b5fae0a01019d22f7

    SHA1

    d6d28ba431e2920d28619656985ecada7b2ac6d6

    SHA256

    1bf5485238da45d6174e22a716d7c7fc8561e7a302fad21716aec57e6f5a0411

    SHA512

    e95f09994cd2959b9f8cada8786df67f423b7c4a7022ad3bcd4fcca72c50dc73c37f3ef00a7a1994d878e4fbbd6955663f8958678697e0183119dc24e4635a27

  • C:\Windows\SysWOW64\skccszkiupnev.exe

    Filesize

    512KB

    MD5

    2db8979338b4d022c5b6a2437edf9db5

    SHA1

    ea9a535dc2b54c556edf169f3f490c974f8a4c28

    SHA256

    d149528ae49bff51a413de7632a466a17c516b2de3f1cbbc89fd316f39074e98

    SHA512

    ac5d25609885e2b0d7e94fc3b3df65b20fd1d2c7cf826dcd7f667ac3f3160a4dfe08a401c526de723525f3e6a1c0de89e32ceccac3f069c590ddf7a9e300cc39

  • C:\Windows\SysWOW64\ucybtwtikcylseg.exe

    Filesize

    512KB

    MD5

    62f0d5f755e062409058b4c1190dcf7f

    SHA1

    509e1450a5880149ce688982b53956fac25c7f37

    SHA256

    9a053d2c99f94a1c8cbd4bd70e89706a93e7e83054477b0e9a2e9d0a8fc87ca1

    SHA512

    ad7571182acca941db6476deab94380c3417966be40011c8afadc6d43dc64af4f7bf21eab25639b19b1f5338d20b6713dd4a6882884caeb7865ddf13f9bbae17

  • C:\Windows\mydoc.rtf

    Filesize

    223B

    MD5

    06604e5941c126e2e7be02c5cd9f62ec

    SHA1

    4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

    SHA256

    85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

    SHA512

    803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

    Filesize

    512KB

    MD5

    29137cc6a837119283509aab66ec2e80

    SHA1

    bd3a44a42798aba1b9b62ef96d78c5cebb311aaa

    SHA256

    4fb8375754e54841f0ab3a92b7963d9c8adb159d77cb32f6acd0f8fa781dac01

    SHA512

    f3534b3cc40a30edff29c2cb252b42a3899d2e5895c2f061ef0df2fcde7e134cf72c09befe0350cd4e606eb65b8bcf09e8e2b5fdb4c2880dfec5e6ba710cfc69

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

    Filesize

    512KB

    MD5

    f1eb7dc52a312a864a7bf18bd7095ff3

    SHA1

    5990aa3bf059b46e7217d3dd0940238e06fcbae1

    SHA256

    6deb73728963035fff975cd176947c39b9fddae751c4018a4fdc23038ea460f1

    SHA512

    4225331db444bcd14f014558f827e660dac30129efcb635210197d26975bbce8098ec540e8cd1061797b3dc33b0e729e744188f7bed1a9bf3ace574fdce14253

  • memory/632-45-0x00007FFDEB9F0000-0x00007FFDEBA00000-memory.dmp

    Filesize

    64KB

  • memory/632-76-0x00007FFE2B970000-0x00007FFE2BB65000-memory.dmp

    Filesize

    2.0MB

  • memory/632-74-0x00007FFE2B970000-0x00007FFE2BB65000-memory.dmp

    Filesize

    2.0MB

  • memory/632-40-0x00007FFDEB9F0000-0x00007FFDEBA00000-memory.dmp

    Filesize

    64KB

  • memory/632-38-0x00007FFDEB9F0000-0x00007FFDEBA00000-memory.dmp

    Filesize

    64KB

  • memory/632-47-0x00007FFE2B970000-0x00007FFE2BB65000-memory.dmp

    Filesize

    2.0MB

  • memory/632-48-0x00007FFE2B970000-0x00007FFE2BB65000-memory.dmp

    Filesize

    2.0MB

  • memory/632-49-0x00007FFE2B970000-0x00007FFE2BB65000-memory.dmp

    Filesize

    2.0MB

  • memory/632-50-0x00007FFDE9240000-0x00007FFDE9250000-memory.dmp

    Filesize

    64KB

  • memory/632-51-0x00007FFDE9240000-0x00007FFDE9250000-memory.dmp

    Filesize

    64KB

  • memory/632-44-0x00007FFE2B970000-0x00007FFE2BB65000-memory.dmp

    Filesize

    2.0MB

  • memory/632-43-0x00007FFDEB9F0000-0x00007FFDEBA00000-memory.dmp

    Filesize

    64KB

  • memory/632-73-0x00007FFE2B970000-0x00007FFE2BB65000-memory.dmp

    Filesize

    2.0MB

  • memory/632-69-0x00007FFE2B970000-0x00007FFE2BB65000-memory.dmp

    Filesize

    2.0MB

  • memory/632-75-0x00007FFE2B970000-0x00007FFE2BB65000-memory.dmp

    Filesize

    2.0MB

  • memory/632-46-0x00007FFE2B970000-0x00007FFE2BB65000-memory.dmp

    Filesize

    2.0MB

  • memory/632-77-0x00007FFE2B970000-0x00007FFE2BB65000-memory.dmp

    Filesize

    2.0MB

  • memory/632-78-0x00007FFE2B970000-0x00007FFE2BB65000-memory.dmp

    Filesize

    2.0MB

  • memory/632-42-0x00007FFE2B970000-0x00007FFE2BB65000-memory.dmp

    Filesize

    2.0MB

  • memory/632-81-0x00007FFE2B970000-0x00007FFE2BB65000-memory.dmp

    Filesize

    2.0MB

  • memory/632-37-0x00007FFDEB9F0000-0x00007FFDEBA00000-memory.dmp

    Filesize

    64KB

  • memory/632-41-0x00007FFE2B970000-0x00007FFE2BB65000-memory.dmp

    Filesize

    2.0MB

  • memory/632-39-0x00007FFE2B970000-0x00007FFE2BB65000-memory.dmp

    Filesize

    2.0MB

  • memory/632-128-0x00007FFDEB9F0000-0x00007FFDEBA00000-memory.dmp

    Filesize

    64KB

  • memory/632-129-0x00007FFDEB9F0000-0x00007FFDEBA00000-memory.dmp

    Filesize

    64KB

  • memory/632-130-0x00007FFDEB9F0000-0x00007FFDEBA00000-memory.dmp

    Filesize

    64KB

  • memory/632-131-0x00007FFDEB9F0000-0x00007FFDEBA00000-memory.dmp

    Filesize

    64KB

  • memory/632-132-0x00007FFE2B970000-0x00007FFE2BB65000-memory.dmp

    Filesize

    2.0MB

  • memory/632-133-0x00007FFE2B970000-0x00007FFE2BB65000-memory.dmp

    Filesize

    2.0MB

  • memory/632-135-0x00007FFE2B970000-0x00007FFE2BB65000-memory.dmp

    Filesize

    2.0MB

  • memory/632-134-0x00007FFE2B970000-0x00007FFE2BB65000-memory.dmp

    Filesize

    2.0MB

  • memory/4788-0-0x0000000000400000-0x0000000000496000-memory.dmp

    Filesize

    600KB