Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

5

66f4ada621...ed.exe

windows7-x64

10

66f4ada621...ed.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    19/01/2024, 06:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    66f4ada6211466ba531559f800947aed.exe

  • Size

    512KB

  • MD5

    66f4ada6211466ba531559f800947aed

  • SHA1

    5c56be827ec9a7183ba3ee581a63c23e8a55441c

  • SHA256

    86b99fa5ed242d31dd6253954980dba497709b58ae5202c4f7da53d66c140e3e

  • SHA512

    5446beca76cf4e8491b0214a702e44625521b282c4c8f9979dc0d3e78ae94f515a98416bf52fc441fc83b7b09f4f8faf5ef8553eb6d45db96a538c87ff277d9e

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6Z:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5C

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 8 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\66f4ada6211466ba531559f800947aed.exe
    "C:\Users\Admin\AppData\Local\Temp\66f4ada6211466ba531559f800947aed.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1048
    • C:\Windows\SysWOW64\msktsnjfhh.exe
      msktsnjfhh.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2092
      • C:\Windows\SysWOW64\fuoxnwmt.exe
        C:\Windows\system32\fuoxnwmt.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2588
    • C:\Windows\SysWOW64\vppmypdixjosaza.exe
      vppmypdixjosaza.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2704
    • C:\Windows\SysWOW64\fuoxnwmt.exe
      fuoxnwmt.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2792
    • C:\Windows\SysWOW64\wkldsuxtxwiqd.exe
      wkldsuxtxwiqd.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2684
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2728
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:1920

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe
      Filesize

      512KB

      MD5

      822f77e6c92a62068678d2ab3ee49587

      SHA1

      0c57e5978a95dc435acbe75c2862bb1c6bb16ad5

      SHA256

      d3b0beca5c8f8ffca53c19d08b5bbd1d0f9092dcd679bcc91e8de00e2c960adf

      SHA512

      fd797aeb65585605ec0bc28ce5d40e0c37b2b0b9f72b28809dd8d9a21237d81177b0fecfd352af9ec3f8bbfb9f0fe0ecdf813e547cce6cf5c02a8fe6658a81a4

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
      Filesize

      20KB

      MD5

      5d44410174187b4b6ba2361c07005b01

      SHA1

      673154a922210b3a67772a5ed55052c643db041c

      SHA256

      8aeb11addcfacd4a835b09914a01adfe501433496a8fd562908471025b1782c3

      SHA512

      374a069eb0f108c2544a45ca8c0a18a9d460ca8fbf5761bfe074ebebf718a484f340f0a9015b859c9d102d55262a2dbe6b009a22d3d2249b81687364ff107e59

      Download Submit

    • C:\Users\Admin\Documents\SkipStart.doc.exe
      Filesize

      512KB

      MD5

      448ea9b0647fae4f95a56a082c8f1cb0

      SHA1

      4037e04872294b772006244f4d6e6221a6bcdd1f

      SHA256

      2e3243c238ef935f6ea59baada27b5fb9957734aedf082ce25f4752e3759a929

      SHA512

      20acd0839242f67a4421557d79afcbdde9514e51816302b735230dc77aa2a00c37a2120b1253946feca0d68ef25f839226ddbb1751c9869da12c9aac41e38ef1

      Download Submit

    • C:\Users\Admin\Documents\WriteUpdate.doc.exe
      Filesize

      512KB

      MD5

      61f56f71f6ea8d96609505fc3ce2682f

      SHA1

      f2cb13b075ec52a03b0819f0cba9001c8ae706d6

      SHA256

      fb6ccf15f7f7b1d7aba4c64c049c5abc0a87fb58698c505f328b7501620269ce

      SHA512

      3519377842751f6a0f92cd85503db5475bcd6c00449b358305aaa963150df42fa41bf0a029225d57faf81fd7e176d2b37068f073edfb3c51c1f3a18f1bb70547

      Download Submit

    • C:\Windows\SysWOW64\vppmypdixjosaza.exe
      Filesize

      512KB

      MD5

      640a1f3c669228f8ad4f8ccae58c0240

      SHA1

      ac208bba1cafbf531bd034456b2b328d6d1ed27e

      SHA256

      46ed2a76965dc5c46b65a773bf97820dc15fcd37e06193dbf010a8d31fdfbd21

      SHA512

      db64918e78a102333ac8c724f75f4ded5d8ced80b8a24a832210fdae7758c0b4497919f88f35480aed9385288fed3bf95c86fc9fbb29196355e63038a0c8e5c9

      Download Submit

    • C:\Windows\SysWOW64\wkldsuxtxwiqd.exe
      Filesize

      512KB

      MD5

      b614a77912af2d255821f6a1a6d113ce

      SHA1

      1ab77726d973f4b9c35e9228faf4e439ca9ff40a

      SHA256

      ce9abb0574050353854a04e981f632b4225440c18ab19ec32a260e48d7fe51bd

      SHA512

      743de9d21fedd16022b0cdcfbf65aa7553e878d3b4841faa4c7c6fc4da22a6d17166d250cd9bb695f88237cffe64fecec2dc970065ce322b9f516a5168e6618f

      Download Submit

    • C:\Windows\mydoc.rtf
      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

      Download Submit

    • \Windows\SysWOW64\fuoxnwmt.exe
      Filesize

      512KB

      MD5

      d49993e75b1558280609c822e96df310

      SHA1

      44aed78940084a8bc7d899615a02769998344b74

      SHA256

      9c8b1817ed690ee138b72071feb866174be4e3ec4ed9f03103bc210fe58458c0

      SHA512

      a06089dfcba8e7854dd7f245741a6b0f8afc610ea128ebda2889925e7208c25f587b1f53225c6e7f4875f3a0fcc95ab202fc0b2683cba93615f0857fb18cc1aa

      Download Submit

    • \Windows\SysWOW64\msktsnjfhh.exe
      Filesize

      512KB

      MD5

      c05d29b9b28d0c64f370c315337c208c

      SHA1

      b1842dff24e5a8a0bd2ca9fe06613e513e401e82

      SHA256

      09eb7eb093e57ee72593847f51753e5fe4df5c2dff9212c45a03880baee81717

      SHA512

      9fd312f5455553e69cdab76e6b22b2ea671f8c772fe57c9c492f2ed680e99c178fd31282828c57217e5f4275776f3f142dd447e9d8d8481139deceddbe68f673

      Download Submit

    • memory/1048-0-0x0000000000400000-0x0000000000496000-memory.dmp

      Filesize

      600KB

      Download

    • memory/2728-47-0x0000000070BBD000-0x0000000070BC8000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2728-46-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2728-45-0x000000002FD21000-0x000000002FD22000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2728-92-0x0000000070BBD000-0x0000000070BC8000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2728-113-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download