Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/01/2024, 08:49

General

  • Target

    40691b933f9e08d2d4b77987bb8c08aa.exe

  • Size

    512KB

  • MD5

    40691b933f9e08d2d4b77987bb8c08aa

  • SHA1

    acdda4f9c6ac3ee89945d3dc54087ac2aee80604

  • SHA256

    cceb7e90fd67ae52aaba94f7a93291ee5ecbebbd33081c42db66ec57a30ec979

  • SHA512

    6ade6bec64c17d8258929ad8a7c17354501d90d8b6752e373e1d9025687878dfee65769c081151fee093d5b844384f66dc8e0a8295736375f80308deb34f6102

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6E:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5D

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 5 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 6 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
  • AutoIT Executable 8 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\40691b933f9e08d2d4b77987bb8c08aa.exe
    "C:\Users\Admin\AppData\Local\Temp\40691b933f9e08d2d4b77987bb8c08aa.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1380
    • C:\Windows\SysWOW64\pmjzqyoqiv.exe
      pmjzqyoqiv.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:5040
      • C:\Windows\SysWOW64\ltlzvqde.exe
        C:\Windows\system32\ltlzvqde.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1332
    • C:\Windows\SysWOW64\jphxisolrnzigsc.exe
      jphxisolrnzigsc.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4300
    • C:\Windows\SysWOW64\mssnjnwcurtrn.exe
      mssnjnwcurtrn.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3160
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:1952
    • C:\Windows\SysWOW64\ltlzvqde.exe
      ltlzvqde.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4652

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\jphxisolrnzigsc.exe

    Filesize

    389KB

    MD5

    456755027a97317d437578c9e4b18007

    SHA1

    4273bc918f07b287550025b3f36025ef11dcf4ce

    SHA256

    44095f829506dd8592d3f6902898ede550b667aea0042ed50408f09aa03af637

    SHA512

    758325ecd1f1da2baf234fdc93bd6ad0940dec3d5dc42ea208db1d781b80069c552161e8c46eddf4bdf1faa301c243bc3b1dfe2f1ca71dca6d2de1e4fbdcfedf

  • C:\Windows\SysWOW64\jphxisolrnzigsc.exe

    Filesize

    93KB

    MD5

    257f28bd5bdc2b725434b7ab570814e7

    SHA1

    972446e0f8d210c5d6f42a57a921391a236d564d

    SHA256

    d80f45a5995ba038d69dbe87f7c12827ffa2b53e79beedb0bc6ee91c10a61688

    SHA512

    c27aa91c3c3605941a1a121021c840fc7886cf27d43e9d6b2c371888a276d9dfd39135600a4f933f62dfa3d46cb6e12de6e31b3f8b939676701ff37f8cc61575

  • C:\Windows\SysWOW64\jphxisolrnzigsc.exe

    Filesize

    512KB

    MD5

    a5c25130d73a1899a29bb62aaf0dff6e

    SHA1

    e7cd280b278d13f166ee9e64ed5e2f008c6d97a8

    SHA256

    2324472332c355a30296f2b16d2af0962b33b02177119fdc4d2c06fa8d06a58a

    SHA512

    d2581e4d8441dae962aa07fd53bd0adfdda104a0e89adf8a1e367930a9af157150a1fa593bb1a7244b74230ad0773308eec67e75f335b49efa1d96065225c602

  • C:\Windows\SysWOW64\mssnjnwcurtrn.exe

    Filesize

    512KB

    MD5

    af2d546126c70bb68420fe9552ef0f9f

    SHA1

    110f68b8dab9ae62549c30561baedde598cbeb0b

    SHA256

    492aa6c22420117a8c9bfbfbc46a90a5999a53a1ef9eb8baffe4415e5d728215

    SHA512

    83001aeef86ad875862e4966fd095278add1e6f1ac30f7991e0b103181839bd9d707ebce09a6226a357d7776b34e3991503406223bad7c2bbc773c6d8d31067e

  • C:\Windows\SysWOW64\mssnjnwcurtrn.exe

    Filesize

    381KB

    MD5

    30aec9e0b33fbd99234328357879f812

    SHA1

    3c9d37139d4ccfe2b694afba9633170d0f510a92

    SHA256

    15aad0daaaeea2f1eb8d19a8999f42844b2885d6bef949f6787feba7dad46563

    SHA512

    2060f2cc8c90181dd0a9965f0ff3a94aece08c82c4a68454846f66778bc60dade3ba5ddc38be57311ff4a7bd78217b89a9cd09837eee4b5d9893277299dad415

  • C:\Windows\SysWOW64\pmjzqyoqiv.exe

    Filesize

    512KB

    MD5

    1e09f75706f0b928585adfef09368526

    SHA1

    657ea0b7717e9b1d3ab85f3f0c4328b530478e2a

    SHA256

    27db66b07b3524d46c714c41a37ea53db5106be50273109048d372fc1ddd826f

    SHA512

    da5485648cf69810b3b4883e73069a84f926ffaaadab189b816562ca5c32d1e92b1dd006c26dbc8382ceecfd80e84fff721d66aba3b7edd0b40b706a9ad3a0dd

  • C:\Windows\SysWOW64\pmjzqyoqiv.exe

    Filesize

    386KB

    MD5

    d867a655ae492b330d5de03a1a554ca7

    SHA1

    ed3013d39ff6fe5e8431a2b229becd2e04926e61

    SHA256

    542bf8c10a61473225004305bf2a49d8ef5106f4ef0c62af504926db90c0edd1

    SHA512

    0b692aaa4d2d1d8b7ea6ac2e5b5b41884744a7bda3102634e5bb73b6a725caadada5f94b2759826e3dc354824055b183ecd35d47c0e9578082d3a05148f533dc

  • memory/1380-0-0x0000000000400000-0x0000000000496000-memory.dmp

    Filesize

    600KB

  • memory/1952-50-0x00007FFAFB730000-0x00007FFAFB925000-memory.dmp

    Filesize

    2.0MB

  • memory/1952-41-0x00007FFABB7B0000-0x00007FFABB7C0000-memory.dmp

    Filesize

    64KB

  • memory/1952-48-0x00007FFAB8F50000-0x00007FFAB8F60000-memory.dmp

    Filesize

    64KB

  • memory/1952-52-0x00007FFAFB730000-0x00007FFAFB925000-memory.dmp

    Filesize

    2.0MB

  • memory/1952-53-0x00007FFAB8F50000-0x00007FFAB8F60000-memory.dmp

    Filesize

    64KB

  • memory/1952-56-0x00007FFAFB730000-0x00007FFAFB925000-memory.dmp

    Filesize

    2.0MB

  • memory/1952-57-0x00007FFAFB730000-0x00007FFAFB925000-memory.dmp

    Filesize

    2.0MB

  • memory/1952-59-0x00007FFAFB730000-0x00007FFAFB925000-memory.dmp

    Filesize

    2.0MB

  • memory/1952-61-0x00007FFAFB730000-0x00007FFAFB925000-memory.dmp

    Filesize

    2.0MB

  • memory/1952-58-0x00007FFAFB730000-0x00007FFAFB925000-memory.dmp

    Filesize

    2.0MB

  • memory/1952-55-0x00007FFAFB730000-0x00007FFAFB925000-memory.dmp

    Filesize

    2.0MB

  • memory/1952-54-0x00007FFAFB730000-0x00007FFAFB925000-memory.dmp

    Filesize

    2.0MB

  • memory/1952-51-0x00007FFAFB730000-0x00007FFAFB925000-memory.dmp

    Filesize

    2.0MB

  • memory/1952-49-0x00007FFAFB730000-0x00007FFAFB925000-memory.dmp

    Filesize

    2.0MB

  • memory/1952-44-0x00007FFAFB730000-0x00007FFAFB925000-memory.dmp

    Filesize

    2.0MB

  • memory/1952-43-0x00007FFAFB730000-0x00007FFAFB925000-memory.dmp

    Filesize

    2.0MB

  • memory/1952-42-0x00007FFAFB730000-0x00007FFAFB925000-memory.dmp

    Filesize

    2.0MB

  • memory/1952-47-0x00007FFAFB730000-0x00007FFAFB925000-memory.dmp

    Filesize

    2.0MB

  • memory/1952-39-0x00007FFABB7B0000-0x00007FFABB7C0000-memory.dmp

    Filesize

    64KB

  • memory/1952-40-0x00007FFAFB730000-0x00007FFAFB925000-memory.dmp

    Filesize

    2.0MB

  • memory/1952-38-0x00007FFAFB730000-0x00007FFAFB925000-memory.dmp

    Filesize

    2.0MB

  • memory/1952-35-0x00007FFABB7B0000-0x00007FFABB7C0000-memory.dmp

    Filesize

    64KB

  • memory/1952-37-0x00007FFABB7B0000-0x00007FFABB7C0000-memory.dmp

    Filesize

    64KB

  • memory/1952-36-0x00007FFABB7B0000-0x00007FFABB7C0000-memory.dmp

    Filesize

    64KB

  • memory/1952-121-0x00007FFAFB730000-0x00007FFAFB925000-memory.dmp

    Filesize

    2.0MB

  • memory/1952-143-0x00007FFABB7B0000-0x00007FFABB7C0000-memory.dmp

    Filesize

    64KB

  • memory/1952-144-0x00007FFABB7B0000-0x00007FFABB7C0000-memory.dmp

    Filesize

    64KB

  • memory/1952-146-0x00007FFAFB730000-0x00007FFAFB925000-memory.dmp

    Filesize

    2.0MB

  • memory/1952-145-0x00007FFABB7B0000-0x00007FFABB7C0000-memory.dmp

    Filesize

    64KB

  • memory/1952-148-0x00007FFAFB730000-0x00007FFAFB925000-memory.dmp

    Filesize

    2.0MB

  • memory/1952-149-0x00007FFAFB730000-0x00007FFAFB925000-memory.dmp

    Filesize

    2.0MB

  • memory/1952-150-0x00007FFAFB730000-0x00007FFAFB925000-memory.dmp

    Filesize

    2.0MB

  • memory/1952-147-0x00007FFABB7B0000-0x00007FFABB7C0000-memory.dmp

    Filesize

    64KB