Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
09/01/2024, 04:46
General
-
Target
4d5e6dfe78c7d6afdcd33b82ac6c93d4.exe
-
Size
512KB
-
MD5
4d5e6dfe78c7d6afdcd33b82ac6c93d4
-
SHA1
d678125310c103b686c19d8440705536b2b39d55
-
SHA256
a08683608022e84f917558136d95cfce577f1941292cf14a3fceb1a9722bc10d
-
SHA512
df1b07039b4421aec83ec4907cd47836a65dd9e98ca8dee26f0e4865c778f9443fca5414bd76737052e5f90c54342ac552e627a4de769ad2aae6609aac5d0a92
-
SSDEEP
6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6X:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5q
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
-
AutoIT Executable 22 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 8 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 7 IoCs
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
-
Suspicious use of FindShellTrayWindow 12 IoCs
-
Suspicious use of SendNotifyMessage 12 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d5e6dfe78c7d6afdcd33b82ac6c93d4.exe"C:\Users\Admin\AppData\Local\Temp\4d5e6dfe78c7d6afdcd33b82ac6c93d4.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\crzxbsirfg.execrzxbsirfg.exe2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\kslguljs.exeC:\Windows\system32\kslguljs.exe3⤵
-
-
-
C:\Windows\SysWOW64\tdyqmznxzgonoeu.exetdyqmznxzgonoeu.exe2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\skycbohzmblvo.exeskycbohzmblvo.exe2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\kslguljs.exekslguljs.exe2⤵
- Executes dropped EXE
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
57KB
MD53a81bb7f89fff51fd80d1e9e1e60471f
SHA17c04e73b47855108f7cb0f1f8e76b71078d74158
SHA2567afee2b09ec479879bca80da134ceff2df40ad8eff99ed5b1461e6b64e3c474e
SHA512d8500626b99b14b8e441c88b9a8431db9188b5dea17610b1d5ff35a199195026f6c9961281e7c3a4babe8c88b1a949a03a42c6872e2eb0ec1761f65095f777cc
-
Filesize
62KB
MD5d0ab4b5e3abd207f49d49c2dbea9b582
SHA166e0d9f893de0db38434664722b7f9d6187e1326
SHA256b25beae579f5dbddfd5a132fd552170c99483681ad06497699ccd410e0abfc34
SHA5128773f809569e91b2a37c72352720277fd0567eb52924e3d1d71291d299e1ca45e43b7975cf1a7790a3a5f5b2ad3eb9fe0daa2d3f88ec13b623ae1c04db13f1cc
-
Filesize
40KB
MD5c97cafecbbdae036cac1dc7e886aa4c2
SHA1f3114429144b6a538cfb6b7658d41e6a66fe1e7b
SHA256d36f7d55fb7a69ffe4060b22ed61735234aedf6bc417b879e343ee30e21c0eab
SHA5129da6cdd92f1b2bfa209fb5dbc18ac1c77d6ba518f87f2fede23aa2f108d5542a3cdee78786232aef2a43c7826a2627835c533b083c132590be2cd2e2a74c65e8
-
Filesize
239B
MD512b138a5a40ffb88d1850866bf2959cd
SHA157001ba2de61329118440de3e9f8a81074cb28a2
SHA2569def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf
SHA5129f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb
-
Filesize
3KB
MD5d7161614227f6d13ce08ece24cff5dc4
SHA1d269d7914c6e4a6513081f1ad99bab3cad67f7f8
SHA256ca2e34f750aa68f9fcaf9bd50456bd6b97726b421d409e72cd7b91c51eb925d9
SHA51210ac3c6c77a0623a45308c4c69a761726251fa0e26b365938a00f9a338fdad70c50a9041fa90264f17f9e3e92fd5d7678ee5962fda6603fac1abdad65a4e97e3
-
Filesize
39KB
MD5d939978ab2c38d02cb4f95f83986e4d5
SHA1f5ca80cb012df98953210f631b2873176c92dcf3
SHA2566029469f05263270b11ca05c16764b0b40981cc6cf6a85a8936389252c3be692
SHA512278f2c3a000362d978798922f947b42a0cff030315c69e341635c678d17ed0d55e6db3de1e2b1d07da293d17fc9cd6477b96277b30da25dfed3215c21c6ea6aa
-
Filesize
1KB
MD5ec89629d437c17787acc7061c89e753c
SHA1c65089b32eba1cf75d3546335718073460c971f9
SHA25687b17909878537f2c3d3bc046f54b9eb382e312fa75d2b177457a978dcc7d83c
SHA51265f02cc30b64e2c33d7287c135bc0bb20abe1e35c7176a03e47403db3e21da28f7e7ec7a13ef748aeb76ac06e5e159a9b4e62196692c3411459a4ae235a1bec9
-
Filesize
55KB
MD53708f1ab904be3391fba4fdde2f15bc6
SHA1fae942bbc5fa4dae7aef5fcabf04f1fa1a570393
SHA256f970c857983b4e0d2c578c67023a7d92451565bb9efb0c8ef324b564af2ae0d6
SHA5127e3f3b08a80106253b450366a9a15e916743feb661e416fbfc07006aa0ca8d2263736e529f82769d63478405221adc1313682c3db5a43645d0661038fc355ea1
-
Filesize
56KB
MD51aa60022302d272bbddf3b1be0a4ab6d
SHA12deee5821ac170dc248a1015e1d442e370e4413d
SHA256c0d0683bdb9ba29302c025da268d52cabac463bc9f7159787e0935147644d945
SHA5128253c5bb9f5bbcfd42deafb285449ccc433b5ef8dc0f7b5f2c05aa466f168caefd0390248addfa5ce743d26dd8d37c6af917c3fc28f5e011355689eb1cdc5cb6
-
Filesize
66KB
MD57bc21dc4153a07fde0a0b4afd767e177
SHA16007bbdb88d7176c60ba40cb15a2ef49305619bd
SHA256ecafa4adb34f9862bfe3b1d95385f42ca31d57efcf7d6aafbf8248b2c35d4ad1
SHA51249a6f817d8075fac1f486c56eacc16831c6674fef0ade809cb6655e402c0f6a352ec269e02544a8c74bfb1236c8208ed390bac097ae70230e81dd37221e981ef
-
Filesize
27KB
MD529d43ac90cd1074a950e25396a4f28cf
SHA1505f2f8c6a826552edb394c24abe5dcbb2cf2439
SHA256a83f7e24b0fcc32eff002567a6e107b3f32d70c181ed588b4b79ad80ae51509c
SHA512689ec0fa5be77f5f1162d4796ff4a21f295beb868b306b4b6b75d70a19e8220ee5925e54bb89790a1d2bed59b8d63d3835ad44892a915f37e814687487a27ecd
-
Filesize
29KB
MD53e8688ab641e0c8968281fa789622906
SHA1347023fe09554602f52dadde8b7c064cab81eff7
SHA2561e0f10470392c3352ba0862457d46ae35772c632ad93efe8e06be5a29f9328c1
SHA5122f087af80a72c285f25a5736948b9de4d6d699d2c1152b3b2f105d0a6dd50f3cba28107a67b7a81dde34b00794c340f15548203dda51cda9257e4cb67dfe5a7f
-
Filesize
37KB
MD566a85cc6824d52651d93864e4e18f6f5
SHA1bd80300004c28791b28bda5d77e400b6997ec888
SHA25649fe03a8e6a7e56fdafe931034d175c45c6929d510b349f29cfc96a57991a144
SHA512ec3f015ac27841935e6c63b8863c1fbb4fb462bdb14340daa8d39fb4ec2c6801115bdf5d1ade9a8a3df87256c8e171d7cfc586b0ef417f0aeaa90c9734aa63e5
-
Filesize
40KB
MD54ad159b3d610d32e978c08d5a2cac062
SHA122b66b51e6e9568ea1cab2c372fb8b410820b171
SHA25614b9d02236fe41eb317eef88d98b42850b7f1d801a381959827c92cc5d08f0fc
SHA512d2c379658f305519b2ffcf5808e8952e4d67994eeb7412ba2b9914aeb0f27bf3751e8b87e07750da77a0da162dd7d8fa1703503cfedbb1c64a5014404e06ce04
-
Filesize
101KB
MD5c48e641f0696cb5a3cf84ef34f6078b8
SHA1fa530a47217d18c99a546baa52ceac8687a30a18
SHA25670da0bccca39f0e51c058f1c1b031c619e8bc95cbfc1820f9a8c46ecd693b3f8
SHA5121b8a7f7cce9b6563d4bf91cccf5d051cb276baee7995f1ab58d39ab49efc7cb7f553ce30dfba4b991c07a57ca1b16deb81d617b733e11a6bf553768bd41e139f
-
Filesize
48KB
MD54277b01699bc59758ad5e9b0a4718b0a
SHA10a17013fa0685a1cf485c0283624d9db1a78093e
SHA256b5dc01ff43784aed62c508623eda0f05c7bec0bc20d5689727ed55375413fa50
SHA5124368a305922e48951fb04e3f778994ff48421657e6ec50ddf90bbea3bf1ab78075f328e4b7feb20fc9d075d5cfff9157ac17f53bdd3f3aa26c19e63681d2d743
-
Filesize
164KB
MD53238036331341c9fbba8e4b911b1b464
SHA16676147a8081c7ca97f9b1b008dc0a32a7ba2ccc
SHA256352191ff313a25fc788a273c1ba64b31754b64eee2327cd062cd1be69ee23aa4
SHA51255bd2e5da0d563dee475d8d876cc1b93dbe985403a3f3a43e72f6f0a00b64a7c7119c58ec66a1a4a8e8cb9fa68ba60c7daa3b73948ca600232262cdd067bc964
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
36KB
MD5acc30b82036429fe458ee93484e5533b
SHA1f8442cad06d9a94ad937c16b9ea141a4a6b6183d
SHA256d63bada2ce9b7f1ab28032c9c65d91318985bc0d3a0d208eebfac6b2cd7091c1
SHA5121f28f5289ab25dea0b6c42ec6969f9a49155cd7024197145acc57f547a25de9411d10532d251e507656d52bdb5e70500584b60023e63677bb5973f4166113d14
-
Filesize
23KB
MD5e86e1b120d0d43363252397c348eacd1
SHA180d30ca425a3bd0668c95ff40f3b7cbcf85e3736
SHA25640c26b8c0daa56647ddecf9506e98291961759293ca0e185b588e59ca73607cf
SHA51277751e1cad974da53a965d0870497587477efefa3d1ff56d7c9451255610e24912ffd9b14a812fc2642a1020550f1084477dd6b6b2182ad7d3e7c24cf083bbd7
-
Filesize
5KB
MD54218d293ed3612d8982614d241dce0cc
SHA115388b63642a6838393deb28fa18b077e24d49d8
SHA2566d0bdb0ae5753df5ec4c6fec380b19657a4a3f092e68a2e6ade4e0a3427d65f2
SHA512033fd49279c5eb84aaf0a775b8d26de13ee10694b6922d04ac2b1a281fb0473ee2efe8114d52a2525dab8f7d057b79aefb06c6d952394bb316b49db4d2d00703
-
Filesize
9KB
MD5b35b1f4c5eb499f62524766be9a3f580
SHA1f3a95cd805d4d178906b33d01887e100ac31639f
SHA256e311cc9039f96406b84412246561aed0aa49832d741b137e342843fe26d45b3d
SHA512885bb3047c46cd65081975934aad7936ca99e4c146f0eeae98e36adb5b52c92c7a2a1cc8e645f50b8445dd5aa9d88e1db0ef860bb24c5f7122a87dd2b586a5a7
-
Filesize
2KB
MD5f8d64fbc319cb58315b645e476ab77f9
SHA1db35f786a78ef8f206424d594c90ade339b62931
SHA25658facb95e3bed902972446b15300f57f25ad43739ef0999e6778a1d76eee915d
SHA512f6bd89fe954e75447753d2bce6c3c9c1b31e67e4d224414f48f40255d285c4cfc9a35db41a62f837314fcc6a450239de88b71307a202b940779214447a67ebfc
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
600KB