Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
09/01/2024, 04:46
Static task
static1
Behavioral task
behavioral1
Sample
4d5e6dfe78c7d6afdcd33b82ac6c93d4.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4d5e6dfe78c7d6afdcd33b82ac6c93d4.exe
Resource
win10v2004-20231215-en
General
-
Target
4d5e6dfe78c7d6afdcd33b82ac6c93d4.exe
-
Size
512KB
-
MD5
4d5e6dfe78c7d6afdcd33b82ac6c93d4
-
SHA1
d678125310c103b686c19d8440705536b2b39d55
-
SHA256
a08683608022e84f917558136d95cfce577f1941292cf14a3fceb1a9722bc10d
-
SHA512
df1b07039b4421aec83ec4907cd47836a65dd9e98ca8dee26f0e4865c778f9443fca5414bd76737052e5f90c54342ac552e627a4de769ad2aae6609aac5d0a92
-
SSDEEP
6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6X:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5q
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 4912 crzxbsirfg.exe 4056 tdyqmznxzgonoeu.exe 3872 kslguljs.exe 1180 skycbohzmblvo.exe -
AutoIT Executable 22 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/1608-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x0006000000023207-27.dat autoit_exe behavioral2/files/0x0006000000023208-31.dat autoit_exe behavioral2/files/0x0006000000023208-32.dat autoit_exe behavioral2/files/0x0006000000023207-26.dat autoit_exe behavioral2/files/0x0006000000023206-23.dat autoit_exe behavioral2/files/0x0006000000023207-35.dat autoit_exe behavioral2/files/0x0007000000023201-64.dat autoit_exe behavioral2/files/0x0006000000023206-22.dat autoit_exe behavioral2/files/0x0006000000023205-19.dat autoit_exe behavioral2/files/0x0006000000023205-18.dat autoit_exe behavioral2/files/0x0006000000023206-5.dat autoit_exe behavioral2/files/0x0002000000022785-94.dat autoit_exe behavioral2/files/0x0003000000022762-88.dat autoit_exe behavioral2/files/0x0003000000022762-86.dat autoit_exe behavioral2/files/0x0006000000023235-103.dat autoit_exe behavioral2/files/0x0006000000023235-99.dat autoit_exe behavioral2/files/0x0006000000023234-97.dat autoit_exe behavioral2/files/0x0006000000023246-128.dat autoit_exe behavioral2/files/0x0006000000023246-126.dat autoit_exe behavioral2/files/0x0006000000023246-123.dat autoit_exe behavioral2/files/0x0006000000023246-130.dat autoit_exe -
Drops file in System32 directory 8 IoCs
description ioc Process File created C:\Windows\SysWOW64\skycbohzmblvo.exe 4d5e6dfe78c7d6afdcd33b82ac6c93d4.exe File opened for modification C:\Windows\SysWOW64\skycbohzmblvo.exe 4d5e6dfe78c7d6afdcd33b82ac6c93d4.exe File created C:\Windows\SysWOW64\crzxbsirfg.exe 4d5e6dfe78c7d6afdcd33b82ac6c93d4.exe File opened for modification C:\Windows\SysWOW64\crzxbsirfg.exe 4d5e6dfe78c7d6afdcd33b82ac6c93d4.exe File created C:\Windows\SysWOW64\tdyqmznxzgonoeu.exe 4d5e6dfe78c7d6afdcd33b82ac6c93d4.exe File opened for modification C:\Windows\SysWOW64\tdyqmznxzgonoeu.exe 4d5e6dfe78c7d6afdcd33b82ac6c93d4.exe File created C:\Windows\SysWOW64\kslguljs.exe 4d5e6dfe78c7d6afdcd33b82ac6c93d4.exe File opened for modification C:\Windows\SysWOW64\kslguljs.exe 4d5e6dfe78c7d6afdcd33b82ac6c93d4.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\mydoc.rtf 4d5e6dfe78c7d6afdcd33b82ac6c93d4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 7 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33402D7A9D2382576A3E77D3702F2DDC7DF164DE" 4d5e6dfe78c7d6afdcd33b82ac6c93d4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BC8FAB0FE64F298837D3A4B86EE3E99B3FC02884367034EE1B8429E09D6" 4d5e6dfe78c7d6afdcd33b82ac6c93d4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FC0B02947E2399E52CBBAA5329FD4C5" 4d5e6dfe78c7d6afdcd33b82ac6c93d4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7F8BFF8C4F2985129141D7287D9DBCE7E144594567346241D79B" 4d5e6dfe78c7d6afdcd33b82ac6c93d4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7FC68B0FE1B22DCD209D0D68A7B9010" 4d5e6dfe78c7d6afdcd33b82ac6c93d4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1848C7751596DBC3B8C17FE6EDE434BE" 4d5e6dfe78c7d6afdcd33b82ac6c93d4.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 4d5e6dfe78c7d6afdcd33b82ac6c93d4.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 1608 4d5e6dfe78c7d6afdcd33b82ac6c93d4.exe 1608 4d5e6dfe78c7d6afdcd33b82ac6c93d4.exe 1608 4d5e6dfe78c7d6afdcd33b82ac6c93d4.exe 1608 4d5e6dfe78c7d6afdcd33b82ac6c93d4.exe 1608 4d5e6dfe78c7d6afdcd33b82ac6c93d4.exe 1608 4d5e6dfe78c7d6afdcd33b82ac6c93d4.exe 1608 4d5e6dfe78c7d6afdcd33b82ac6c93d4.exe 1608 4d5e6dfe78c7d6afdcd33b82ac6c93d4.exe 1608 4d5e6dfe78c7d6afdcd33b82ac6c93d4.exe 1608 4d5e6dfe78c7d6afdcd33b82ac6c93d4.exe 1608 4d5e6dfe78c7d6afdcd33b82ac6c93d4.exe 1608 4d5e6dfe78c7d6afdcd33b82ac6c93d4.exe 1608 4d5e6dfe78c7d6afdcd33b82ac6c93d4.exe 1608 4d5e6dfe78c7d6afdcd33b82ac6c93d4.exe 1608 4d5e6dfe78c7d6afdcd33b82ac6c93d4.exe 1608 4d5e6dfe78c7d6afdcd33b82ac6c93d4.exe -
Suspicious use of FindShellTrayWindow 12 IoCs
pid Process 1608 4d5e6dfe78c7d6afdcd33b82ac6c93d4.exe 1608 4d5e6dfe78c7d6afdcd33b82ac6c93d4.exe 1608 4d5e6dfe78c7d6afdcd33b82ac6c93d4.exe 4912 crzxbsirfg.exe 4912 crzxbsirfg.exe 4912 crzxbsirfg.exe 4056 tdyqmznxzgonoeu.exe 4056 tdyqmznxzgonoeu.exe 4056 tdyqmznxzgonoeu.exe 1180 skycbohzmblvo.exe 1180 skycbohzmblvo.exe 1180 skycbohzmblvo.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 1608 4d5e6dfe78c7d6afdcd33b82ac6c93d4.exe 1608 4d5e6dfe78c7d6afdcd33b82ac6c93d4.exe 1608 4d5e6dfe78c7d6afdcd33b82ac6c93d4.exe 4912 crzxbsirfg.exe 4912 crzxbsirfg.exe 4912 crzxbsirfg.exe 4056 tdyqmznxzgonoeu.exe 4056 tdyqmznxzgonoeu.exe 4056 tdyqmznxzgonoeu.exe 1180 skycbohzmblvo.exe 1180 skycbohzmblvo.exe 1180 skycbohzmblvo.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1608 wrote to memory of 4912 1608 4d5e6dfe78c7d6afdcd33b82ac6c93d4.exe 29 PID 1608 wrote to memory of 4912 1608 4d5e6dfe78c7d6afdcd33b82ac6c93d4.exe 29 PID 1608 wrote to memory of 4912 1608 4d5e6dfe78c7d6afdcd33b82ac6c93d4.exe 29 PID 1608 wrote to memory of 4056 1608 4d5e6dfe78c7d6afdcd33b82ac6c93d4.exe 30 PID 1608 wrote to memory of 4056 1608 4d5e6dfe78c7d6afdcd33b82ac6c93d4.exe 30 PID 1608 wrote to memory of 4056 1608 4d5e6dfe78c7d6afdcd33b82ac6c93d4.exe 30 PID 1608 wrote to memory of 3872 1608 4d5e6dfe78c7d6afdcd33b82ac6c93d4.exe 32 PID 1608 wrote to memory of 3872 1608 4d5e6dfe78c7d6afdcd33b82ac6c93d4.exe 32 PID 1608 wrote to memory of 3872 1608 4d5e6dfe78c7d6afdcd33b82ac6c93d4.exe 32 PID 1608 wrote to memory of 1180 1608 4d5e6dfe78c7d6afdcd33b82ac6c93d4.exe 31 PID 1608 wrote to memory of 1180 1608 4d5e6dfe78c7d6afdcd33b82ac6c93d4.exe 31 PID 1608 wrote to memory of 1180 1608 4d5e6dfe78c7d6afdcd33b82ac6c93d4.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d5e6dfe78c7d6afdcd33b82ac6c93d4.exe"C:\Users\Admin\AppData\Local\Temp\4d5e6dfe78c7d6afdcd33b82ac6c93d4.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Windows\SysWOW64\crzxbsirfg.execrzxbsirfg.exe2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4912 -
C:\Windows\SysWOW64\kslguljs.exeC:\Windows\system32\kslguljs.exe3⤵PID:3096
-
-
-
C:\Windows\SysWOW64\tdyqmznxzgonoeu.exetdyqmznxzgonoeu.exe2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4056
-
-
C:\Windows\SysWOW64\skycbohzmblvo.exeskycbohzmblvo.exe2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1180
-
-
C:\Windows\SysWOW64\kslguljs.exekslguljs.exe2⤵
- Executes dropped EXE
PID:3872
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵PID:316
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
57KB
MD53a81bb7f89fff51fd80d1e9e1e60471f
SHA17c04e73b47855108f7cb0f1f8e76b71078d74158
SHA2567afee2b09ec479879bca80da134ceff2df40ad8eff99ed5b1461e6b64e3c474e
SHA512d8500626b99b14b8e441c88b9a8431db9188b5dea17610b1d5ff35a199195026f6c9961281e7c3a4babe8c88b1a949a03a42c6872e2eb0ec1761f65095f777cc
-
Filesize
62KB
MD5d0ab4b5e3abd207f49d49c2dbea9b582
SHA166e0d9f893de0db38434664722b7f9d6187e1326
SHA256b25beae579f5dbddfd5a132fd552170c99483681ad06497699ccd410e0abfc34
SHA5128773f809569e91b2a37c72352720277fd0567eb52924e3d1d71291d299e1ca45e43b7975cf1a7790a3a5f5b2ad3eb9fe0daa2d3f88ec13b623ae1c04db13f1cc
-
Filesize
40KB
MD5c97cafecbbdae036cac1dc7e886aa4c2
SHA1f3114429144b6a538cfb6b7658d41e6a66fe1e7b
SHA256d36f7d55fb7a69ffe4060b22ed61735234aedf6bc417b879e343ee30e21c0eab
SHA5129da6cdd92f1b2bfa209fb5dbc18ac1c77d6ba518f87f2fede23aa2f108d5542a3cdee78786232aef2a43c7826a2627835c533b083c132590be2cd2e2a74c65e8
-
Filesize
239B
MD512b138a5a40ffb88d1850866bf2959cd
SHA157001ba2de61329118440de3e9f8a81074cb28a2
SHA2569def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf
SHA5129f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize3KB
MD5d7161614227f6d13ce08ece24cff5dc4
SHA1d269d7914c6e4a6513081f1ad99bab3cad67f7f8
SHA256ca2e34f750aa68f9fcaf9bd50456bd6b97726b421d409e72cd7b91c51eb925d9
SHA51210ac3c6c77a0623a45308c4c69a761726251fa0e26b365938a00f9a338fdad70c50a9041fa90264f17f9e3e92fd5d7678ee5962fda6603fac1abdad65a4e97e3
-
Filesize
39KB
MD5d939978ab2c38d02cb4f95f83986e4d5
SHA1f5ca80cb012df98953210f631b2873176c92dcf3
SHA2566029469f05263270b11ca05c16764b0b40981cc6cf6a85a8936389252c3be692
SHA512278f2c3a000362d978798922f947b42a0cff030315c69e341635c678d17ed0d55e6db3de1e2b1d07da293d17fc9cd6477b96277b30da25dfed3215c21c6ea6aa
-
Filesize
1KB
MD5ec89629d437c17787acc7061c89e753c
SHA1c65089b32eba1cf75d3546335718073460c971f9
SHA25687b17909878537f2c3d3bc046f54b9eb382e312fa75d2b177457a978dcc7d83c
SHA51265f02cc30b64e2c33d7287c135bc0bb20abe1e35c7176a03e47403db3e21da28f7e7ec7a13ef748aeb76ac06e5e159a9b4e62196692c3411459a4ae235a1bec9
-
Filesize
55KB
MD53708f1ab904be3391fba4fdde2f15bc6
SHA1fae942bbc5fa4dae7aef5fcabf04f1fa1a570393
SHA256f970c857983b4e0d2c578c67023a7d92451565bb9efb0c8ef324b564af2ae0d6
SHA5127e3f3b08a80106253b450366a9a15e916743feb661e416fbfc07006aa0ca8d2263736e529f82769d63478405221adc1313682c3db5a43645d0661038fc355ea1
-
Filesize
56KB
MD51aa60022302d272bbddf3b1be0a4ab6d
SHA12deee5821ac170dc248a1015e1d442e370e4413d
SHA256c0d0683bdb9ba29302c025da268d52cabac463bc9f7159787e0935147644d945
SHA5128253c5bb9f5bbcfd42deafb285449ccc433b5ef8dc0f7b5f2c05aa466f168caefd0390248addfa5ce743d26dd8d37c6af917c3fc28f5e011355689eb1cdc5cb6
-
Filesize
66KB
MD57bc21dc4153a07fde0a0b4afd767e177
SHA16007bbdb88d7176c60ba40cb15a2ef49305619bd
SHA256ecafa4adb34f9862bfe3b1d95385f42ca31d57efcf7d6aafbf8248b2c35d4ad1
SHA51249a6f817d8075fac1f486c56eacc16831c6674fef0ade809cb6655e402c0f6a352ec269e02544a8c74bfb1236c8208ed390bac097ae70230e81dd37221e981ef
-
Filesize
27KB
MD529d43ac90cd1074a950e25396a4f28cf
SHA1505f2f8c6a826552edb394c24abe5dcbb2cf2439
SHA256a83f7e24b0fcc32eff002567a6e107b3f32d70c181ed588b4b79ad80ae51509c
SHA512689ec0fa5be77f5f1162d4796ff4a21f295beb868b306b4b6b75d70a19e8220ee5925e54bb89790a1d2bed59b8d63d3835ad44892a915f37e814687487a27ecd
-
Filesize
29KB
MD53e8688ab641e0c8968281fa789622906
SHA1347023fe09554602f52dadde8b7c064cab81eff7
SHA2561e0f10470392c3352ba0862457d46ae35772c632ad93efe8e06be5a29f9328c1
SHA5122f087af80a72c285f25a5736948b9de4d6d699d2c1152b3b2f105d0a6dd50f3cba28107a67b7a81dde34b00794c340f15548203dda51cda9257e4cb67dfe5a7f
-
Filesize
37KB
MD566a85cc6824d52651d93864e4e18f6f5
SHA1bd80300004c28791b28bda5d77e400b6997ec888
SHA25649fe03a8e6a7e56fdafe931034d175c45c6929d510b349f29cfc96a57991a144
SHA512ec3f015ac27841935e6c63b8863c1fbb4fb462bdb14340daa8d39fb4ec2c6801115bdf5d1ade9a8a3df87256c8e171d7cfc586b0ef417f0aeaa90c9734aa63e5
-
Filesize
40KB
MD54ad159b3d610d32e978c08d5a2cac062
SHA122b66b51e6e9568ea1cab2c372fb8b410820b171
SHA25614b9d02236fe41eb317eef88d98b42850b7f1d801a381959827c92cc5d08f0fc
SHA512d2c379658f305519b2ffcf5808e8952e4d67994eeb7412ba2b9914aeb0f27bf3751e8b87e07750da77a0da162dd7d8fa1703503cfedbb1c64a5014404e06ce04
-
Filesize
101KB
MD5c48e641f0696cb5a3cf84ef34f6078b8
SHA1fa530a47217d18c99a546baa52ceac8687a30a18
SHA25670da0bccca39f0e51c058f1c1b031c619e8bc95cbfc1820f9a8c46ecd693b3f8
SHA5121b8a7f7cce9b6563d4bf91cccf5d051cb276baee7995f1ab58d39ab49efc7cb7f553ce30dfba4b991c07a57ca1b16deb81d617b733e11a6bf553768bd41e139f
-
Filesize
48KB
MD54277b01699bc59758ad5e9b0a4718b0a
SHA10a17013fa0685a1cf485c0283624d9db1a78093e
SHA256b5dc01ff43784aed62c508623eda0f05c7bec0bc20d5689727ed55375413fa50
SHA5124368a305922e48951fb04e3f778994ff48421657e6ec50ddf90bbea3bf1ab78075f328e4b7feb20fc9d075d5cfff9157ac17f53bdd3f3aa26c19e63681d2d743
-
Filesize
164KB
MD53238036331341c9fbba8e4b911b1b464
SHA16676147a8081c7ca97f9b1b008dc0a32a7ba2ccc
SHA256352191ff313a25fc788a273c1ba64b31754b64eee2327cd062cd1be69ee23aa4
SHA51255bd2e5da0d563dee475d8d876cc1b93dbe985403a3f3a43e72f6f0a00b64a7c7119c58ec66a1a4a8e8cb9fa68ba60c7daa3b73948ca600232262cdd067bc964
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
36KB
MD5acc30b82036429fe458ee93484e5533b
SHA1f8442cad06d9a94ad937c16b9ea141a4a6b6183d
SHA256d63bada2ce9b7f1ab28032c9c65d91318985bc0d3a0d208eebfac6b2cd7091c1
SHA5121f28f5289ab25dea0b6c42ec6969f9a49155cd7024197145acc57f547a25de9411d10532d251e507656d52bdb5e70500584b60023e63677bb5973f4166113d14
-
Filesize
23KB
MD5e86e1b120d0d43363252397c348eacd1
SHA180d30ca425a3bd0668c95ff40f3b7cbcf85e3736
SHA25640c26b8c0daa56647ddecf9506e98291961759293ca0e185b588e59ca73607cf
SHA51277751e1cad974da53a965d0870497587477efefa3d1ff56d7c9451255610e24912ffd9b14a812fc2642a1020550f1084477dd6b6b2182ad7d3e7c24cf083bbd7
-
Filesize
5KB
MD54218d293ed3612d8982614d241dce0cc
SHA115388b63642a6838393deb28fa18b077e24d49d8
SHA2566d0bdb0ae5753df5ec4c6fec380b19657a4a3f092e68a2e6ade4e0a3427d65f2
SHA512033fd49279c5eb84aaf0a775b8d26de13ee10694b6922d04ac2b1a281fb0473ee2efe8114d52a2525dab8f7d057b79aefb06c6d952394bb316b49db4d2d00703
-
Filesize
9KB
MD5b35b1f4c5eb499f62524766be9a3f580
SHA1f3a95cd805d4d178906b33d01887e100ac31639f
SHA256e311cc9039f96406b84412246561aed0aa49832d741b137e342843fe26d45b3d
SHA512885bb3047c46cd65081975934aad7936ca99e4c146f0eeae98e36adb5b52c92c7a2a1cc8e645f50b8445dd5aa9d88e1db0ef860bb24c5f7122a87dd2b586a5a7
-
Filesize
2KB
MD5f8d64fbc319cb58315b645e476ab77f9
SHA1db35f786a78ef8f206424d594c90ade339b62931
SHA25658facb95e3bed902972446b15300f57f25ad43739ef0999e6778a1d76eee915d
SHA512f6bd89fe954e75447753d2bce6c3c9c1b31e67e4d224414f48f40255d285c4cfc9a35db41a62f837314fcc6a450239de88b71307a202b940779214447a67ebfc