Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
03/01/2024, 14:57
Static task
static1
Behavioral task
behavioral1
Sample
1694c0fe69e7b2a5e1fb8f76de91fa47.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1694c0fe69e7b2a5e1fb8f76de91fa47.exe
Resource
win10v2004-20231215-en
General
-
Target
1694c0fe69e7b2a5e1fb8f76de91fa47.exe
-
Size
512KB
-
MD5
1694c0fe69e7b2a5e1fb8f76de91fa47
-
SHA1
96ef777ac2d8b9d5a2e7abca0954efc4a29bfa32
-
SHA256
8211aac46563d0fe4e35480ba6879a4d54311e918bf022d8df6a360cc0c87c20
-
SHA512
197ba89c8fb623d522f726fbaaa91fc9ba5976ae862aa6bae0bbb2467034807dc12ea83799cb33812b0d6ecc157a83155a30ea457c2ceb9a05ac6e8e2f6ac1ff
-
SSDEEP
6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6S:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5v
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 3400 samspqijxe.exe 5012 ckywomlxxwbrvuo.exe 2304 zloxdxuz.exe 4792 ettrjmfxvpgfa.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/4084-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe -
Drops file in System32 directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\zloxdxuz.exe 1694c0fe69e7b2a5e1fb8f76de91fa47.exe File created C:\Windows\SysWOW64\ettrjmfxvpgfa.exe 1694c0fe69e7b2a5e1fb8f76de91fa47.exe File opened for modification C:\Windows\SysWOW64\ettrjmfxvpgfa.exe 1694c0fe69e7b2a5e1fb8f76de91fa47.exe File created C:\Windows\SysWOW64\samspqijxe.exe 1694c0fe69e7b2a5e1fb8f76de91fa47.exe File opened for modification C:\Windows\SysWOW64\samspqijxe.exe 1694c0fe69e7b2a5e1fb8f76de91fa47.exe File created C:\Windows\SysWOW64\ckywomlxxwbrvuo.exe 1694c0fe69e7b2a5e1fb8f76de91fa47.exe File opened for modification C:\Windows\SysWOW64\ckywomlxxwbrvuo.exe 1694c0fe69e7b2a5e1fb8f76de91fa47.exe File created C:\Windows\SysWOW64\zloxdxuz.exe 1694c0fe69e7b2a5e1fb8f76de91fa47.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\mydoc.rtf 1694c0fe69e7b2a5e1fb8f76de91fa47.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 7 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2EC1B15F47E138EA53CAB9A133E9D4CC" 1694c0fe69e7b2a5e1fb8f76de91fa47.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EF4FC834F5F82139132D72A7D93BCE5E634584767406341D7EC" 1694c0fe69e7b2a5e1fb8f76de91fa47.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E0F06BC1FE6622D1D10CD0D28A0E9110" 1694c0fe69e7b2a5e1fb8f76de91fa47.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1849C67814E0DBC5B8C07F97ECE237CA" 1694c0fe69e7b2a5e1fb8f76de91fa47.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 1694c0fe69e7b2a5e1fb8f76de91fa47.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32402C799C2482256D4577D1702F2CAD7C8664DC" 1694c0fe69e7b2a5e1fb8f76de91fa47.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ACDFABFFE64F2E7837F3B3586973E99B3FE03884311023BE2C8459E08A5" 1694c0fe69e7b2a5e1fb8f76de91fa47.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 4084 1694c0fe69e7b2a5e1fb8f76de91fa47.exe 4084 1694c0fe69e7b2a5e1fb8f76de91fa47.exe 4084 1694c0fe69e7b2a5e1fb8f76de91fa47.exe 4084 1694c0fe69e7b2a5e1fb8f76de91fa47.exe 4084 1694c0fe69e7b2a5e1fb8f76de91fa47.exe 4084 1694c0fe69e7b2a5e1fb8f76de91fa47.exe 4084 1694c0fe69e7b2a5e1fb8f76de91fa47.exe 4084 1694c0fe69e7b2a5e1fb8f76de91fa47.exe 4084 1694c0fe69e7b2a5e1fb8f76de91fa47.exe 4084 1694c0fe69e7b2a5e1fb8f76de91fa47.exe 4084 1694c0fe69e7b2a5e1fb8f76de91fa47.exe 4084 1694c0fe69e7b2a5e1fb8f76de91fa47.exe 4084 1694c0fe69e7b2a5e1fb8f76de91fa47.exe 4084 1694c0fe69e7b2a5e1fb8f76de91fa47.exe 4084 1694c0fe69e7b2a5e1fb8f76de91fa47.exe 4084 1694c0fe69e7b2a5e1fb8f76de91fa47.exe -
Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 4084 1694c0fe69e7b2a5e1fb8f76de91fa47.exe 4084 1694c0fe69e7b2a5e1fb8f76de91fa47.exe 4084 1694c0fe69e7b2a5e1fb8f76de91fa47.exe 3400 samspqijxe.exe 3400 samspqijxe.exe 3400 samspqijxe.exe 5012 ckywomlxxwbrvuo.exe -
Suspicious use of SendNotifyMessage 7 IoCs
pid Process 4084 1694c0fe69e7b2a5e1fb8f76de91fa47.exe 4084 1694c0fe69e7b2a5e1fb8f76de91fa47.exe 4084 1694c0fe69e7b2a5e1fb8f76de91fa47.exe 3400 samspqijxe.exe 3400 samspqijxe.exe 3400 samspqijxe.exe 5012 ckywomlxxwbrvuo.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4084 wrote to memory of 3400 4084 1694c0fe69e7b2a5e1fb8f76de91fa47.exe 29 PID 4084 wrote to memory of 3400 4084 1694c0fe69e7b2a5e1fb8f76de91fa47.exe 29 PID 4084 wrote to memory of 3400 4084 1694c0fe69e7b2a5e1fb8f76de91fa47.exe 29 PID 4084 wrote to memory of 5012 4084 1694c0fe69e7b2a5e1fb8f76de91fa47.exe 25 PID 4084 wrote to memory of 5012 4084 1694c0fe69e7b2a5e1fb8f76de91fa47.exe 25 PID 4084 wrote to memory of 5012 4084 1694c0fe69e7b2a5e1fb8f76de91fa47.exe 25 PID 4084 wrote to memory of 2304 4084 1694c0fe69e7b2a5e1fb8f76de91fa47.exe 24 PID 4084 wrote to memory of 2304 4084 1694c0fe69e7b2a5e1fb8f76de91fa47.exe 24 PID 4084 wrote to memory of 2304 4084 1694c0fe69e7b2a5e1fb8f76de91fa47.exe 24 PID 4084 wrote to memory of 4792 4084 1694c0fe69e7b2a5e1fb8f76de91fa47.exe 21 PID 4084 wrote to memory of 4792 4084 1694c0fe69e7b2a5e1fb8f76de91fa47.exe 21 PID 4084 wrote to memory of 4792 4084 1694c0fe69e7b2a5e1fb8f76de91fa47.exe 21
Processes
-
C:\Users\Admin\AppData\Local\Temp\1694c0fe69e7b2a5e1fb8f76de91fa47.exe"C:\Users\Admin\AppData\Local\Temp\1694c0fe69e7b2a5e1fb8f76de91fa47.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Windows\SysWOW64\ettrjmfxvpgfa.exeettrjmfxvpgfa.exe2⤵
- Executes dropped EXE
PID:4792
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵PID:212
-
-
C:\Windows\SysWOW64\zloxdxuz.exezloxdxuz.exe2⤵
- Executes dropped EXE
PID:2304
-
-
C:\Windows\SysWOW64\ckywomlxxwbrvuo.execkywomlxxwbrvuo.exe2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5012
-
-
C:\Windows\SysWOW64\samspqijxe.exesamspqijxe.exe2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3400
-
-
C:\Windows\SysWOW64\zloxdxuz.exeC:\Windows\system32\zloxdxuz.exe1⤵PID:1900