Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

5

5acf740d15...5e.exe

windows7-x64

10

5acf740d15...5e.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    14/01/2024, 08:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5acf740d15c50aa170de2c46aa31985e.exe

  • Size

    512KB

  • MD5

    5acf740d15c50aa170de2c46aa31985e

  • SHA1

    2259a108545ef0f783f5f813a35585a7b62a0026

  • SHA256

    7214765ed06c2750d089c5ac36f868155ac34e38c4c741e26ee998d85ca9322e

  • SHA512

    61be62ad01893210bd63035cbbccb21b76d3f2d56241b85031b8fa6c015fed212c751860ea931b5a825f14fc557df2b6924a4d89905131665af787efca3a02db

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6G:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm55

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 7 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 21 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5acf740d15c50aa170de2c46aa31985e.exe
    "C:\Users\Admin\AppData\Local\Temp\5acf740d15c50aa170de2c46aa31985e.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2540
    • C:\Windows\SysWOW64\mykkbyjwmq.exe
      mykkbyjwmq.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2804
      • C:\Windows\SysWOW64\qdofmzya.exe
        C:\Windows\system32\qdofmzya.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2576
    • C:\Windows\SysWOW64\dixnulmheyhceam.exe
      dixnulmheyhceam.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2840
    • C:\Windows\SysWOW64\qdofmzya.exe
      qdofmzya.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1884
    • C:\Windows\SysWOW64\xxcmprohbjiol.exe
      xxcmprohbjiol.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2596
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2648
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:1664

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe
      Filesize

      512KB

      MD5

      30fb6778e48542a62273b7c52d9f9ce0

      SHA1

      92a59603b09e199b127dab472fe9a88a14722678

      SHA256

      f9f029ca93cc212b0165fc47814189994d9f950cb8f8f48923088e61225bb09e

      SHA512

      16e089cb0186560846d6c260b4f1655a4890fb97aa61a6239f0067d7fa1cb9d99727d745a657df4f62107942c34b5da0fdb7ebbd2685f2c7e2650ff7977a2727

      Download Submit

    • C:\Program Files\HideApprove.doc.exe
      Filesize

      512KB

      MD5

      6dec199d8863e640299f296f10e341b2

      SHA1

      20fd76ceae9c3f8ca645754a6e531bc4f3476ce6

      SHA256

      26feb8d977e4689d870dd5037c132c7b0ca8f39a27389cb0daba8dcbf1acb399

      SHA512

      2587042c40ce482df07d02fe6b0747d60d8a2d481026abeaf657d35932a848e51d7c18f4956f34a501f5fd72f08ede9166ee12619ba860837f0d72b4e91cb038

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
      Filesize

      20KB

      MD5

      973dc3a14d949699939b15d3950dd79b

      SHA1

      3ba26c5e7dcea454c26f530c0713a0734d02990d

      SHA256

      6c60b1fc52722f8a4df54aace97bb4ac876855d1df871f7aad699e7faec293f9

      SHA512

      915dace3ed80a62166bba4c8b908f4b1743b7b4c3f06a34513e65dd18b966e90f1b110a7eb5f6a60ac0325fe5b15c9fa7c70d01d96404ba52d156e88d89301c8

      Download Submit

    • C:\Windows\SysWOW64\dixnulmheyhceam.exe
      Filesize

      512KB

      MD5

      8420d62f72d92affe0fff63cbd23b64f

      SHA1

      f76ba5be1d3cb524a5d6936e293cd69ba3004d32

      SHA256

      64734fa9c588a7e2d055e8ee768456c59e0ce858daa0288daf2f91ef917aab1a

      SHA512

      6d478b5575fe4dde638c69039130ff92c2b02ef2d64792afe23f8019fa56f9b5f81288855e82cba12de2d5b94fb373143759a83feff03582f5e0521bde718c45

      Download Submit

    • C:\Windows\mydoc.rtf
      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

      Download Submit

    • \Windows\SysWOW64\mykkbyjwmq.exe
      Filesize

      512KB

      MD5

      f40d3bbd8cb4e24bd16dc7d7bb0a2866

      SHA1

      d9181e188b3eb5b8511f258b040d17d5eeb58649

      SHA256

      1dbe4a0fa5f040b4695f54aaac96f0ce98b02c7834217639722c25993e998209

      SHA512

      549a800b71e373b74ba08908cc59a28cb864ff88a2f8235eba05f1640eb12a2927b6524ee25dbbe60f2df67a48028b59a1854d3dcabd16398f1179228bfb7b4c

      Download Submit

    • \Windows\SysWOW64\qdofmzya.exe
      Filesize

      512KB

      MD5

      e05bb7cd68af9e143c9bfba81a64a5c6

      SHA1

      8e7e95af08cded311e7804dcde9744aea5dd0a7b

      SHA256

      9dc65c1ea7bfe0190dd5dbcde9fd104f7d3385de6644b78bffb692956543ffd0

      SHA512

      01cbd79067f0d8ae063d992b3f8de42e26ce4ceb45cf3b786a8f5879fdec671776613278d323acb384a2139de3a27269ca1d6874ec918160b0bdfc629a922f62

      Download Submit

    • \Windows\SysWOW64\xxcmprohbjiol.exe
      Filesize

      512KB

      MD5

      f85750dc20fed97ab44a46d2ff1af33b

      SHA1

      761e782ba26acbdeb91dd86469d5015b1c938988

      SHA256

      57eac201e98388607a1231dd0c8653ed7d20c975c48cd48e0e772b71162a7b81

      SHA512

      0054886d52f4401b49a74035f83ff842c1cecc69ef2936257fb8d9d3681c11898d63636ded65382b5bf64644559508c13d88f721f2dc3e0e031aa53db195e8fc

      Download Submit

    • memory/2540-0-0x0000000000400000-0x0000000000496000-memory.dmp

      Filesize

      600KB

      Download

    • memory/2648-45-0x000000002FE71000-0x000000002FE72000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2648-52-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2648-53-0x0000000070AED000-0x0000000070AF8000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2648-82-0x0000000070AED000-0x0000000070AF8000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2648-103-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download