Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    134s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/01/2024, 12:10

General

  • Target

    7d172f1d232d758347932641bbbf7dcf.exe

  • Size

    512KB

  • MD5

    7d172f1d232d758347932641bbbf7dcf

  • SHA1

    2256a32fd4209fc94e66b7a94c120eea6a054a3a

  • SHA256

    3e359659220833717f4206c8257124ee3d5ae741ec5ee1e643c094c07f2d3d05

  • SHA512

    c963c99b8914efa0020791e0ea32f4ffa714b05a92449269070a017c5d9b6b91205fca6dc051a6323c01e7c4a1780ff8523006d884888bd15c46a53e14095e40

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj69:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5O

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 5 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 6 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
  • AutoIT Executable 15 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7d172f1d232d758347932641bbbf7dcf.exe
    "C:\Users\Admin\AppData\Local\Temp\7d172f1d232d758347932641bbbf7dcf.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3616
    • C:\Windows\SysWOW64\vbslyndipj.exe
      vbslyndipj.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:724
      • C:\Windows\SysWOW64\nstsbjpg.exe
        C:\Windows\system32\nstsbjpg.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:5092
    • C:\Windows\SysWOW64\nstsbjpg.exe
      nstsbjpg.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4352
    • C:\Windows\SysWOW64\vkweuuoomcihzfo.exe
      vkweuuoomcihzfo.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:516
    • C:\Windows\SysWOW64\haxnpqxruswoq.exe
      haxnpqxruswoq.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3864
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:4988

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe

    Filesize

    512KB

    MD5

    669f1206ccb61ec03b1e157b4475a0a6

    SHA1

    9127d1d32e349fffa2830677df0444dedf783d58

    SHA256

    af7778e0ce6672a676a8e9fa000a186b308f7632506571798f436c0ca08f5b9e

    SHA512

    d1eb101fe1911ca1408620d1a0046ebf55e9fbf4c9f2d0793f0271a8d920b91115928eb719f9c1f91f57a7e87a26d5ef6146158d9ca95fcd6db25063028ea2ce

  • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

    Filesize

    239B

    MD5

    12b138a5a40ffb88d1850866bf2959cd

    SHA1

    57001ba2de61329118440de3e9f8a81074cb28a2

    SHA256

    9def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf

    SHA512

    9f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

    Filesize

    3KB

    MD5

    92ebe2a901b6991414ecca3754376545

    SHA1

    9d2ff2b2bd7b57bd5e64dc152476143e7586580a

    SHA256

    de2e22e4462f9e4077d3a0fa357e21ba98463c326688c9e095858b6483744a61

    SHA512

    6d72f8158cc47462145a72780e5fba5fb42de0bc808bd515601d57309c3c159bcda15bbfab4410566815bb7bda8411ec97d427c5df8fb245c44db1a83b4eced9

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

    Filesize

    3KB

    MD5

    bbc27d8100a0fb847abfa983789a653b

    SHA1

    c0310fb4fc6a1b2de1a795ff93932d43b37d483c

    SHA256

    96c6e294065fc2be44352f7606a6cd946cd2a8ef5b4757eec75c983aa631a348

    SHA512

    54d27104b0b08fd588c1df4f2a458fca339d1af3a2dbd312d478984fc0944d34e5e4b42952b66df0116bd9fbe396bb356497fdc4c9668475a985e5e8f2a08468

  • C:\Users\Admin\Documents\UndoDisconnect.doc.exe

    Filesize

    512KB

    MD5

    949cdefa3d58486bb8f71105eba01f21

    SHA1

    b6a689e36fdede0f72a4b511a3739b9d59f641f2

    SHA256

    156fa1fda77c2617cbdddefcf112b1e96aaf5dd8a58c6f3b752603f33d0e9133

    SHA512

    4cd40758857aa154f33b227abc4ab99d9b41ffd80b98b93167481d28ad4b006127702f85ae4c484507e1362911255e5c49f1bd0f217c40fe141e07904a0d1eed

  • C:\Windows\SysWOW64\haxnpqxruswoq.exe

    Filesize

    33KB

    MD5

    0ba4af2bd70d9b2fa2e8d257296bfa96

    SHA1

    3b521ddfda77a4a8c16dcef492944250ce3325a5

    SHA256

    083a51e27572e824f72deb0a21eed98ed8f5e64bc70b727a0656249fb3f65a4c

    SHA512

    26d748e53ad4100d11b336aabd040854f9f37608644f22dbc20e9a19b027004d26436e77811d9861514d01809c8b4fe74c003d0e9a15c0f9063f859357a04c9b

  • C:\Windows\SysWOW64\haxnpqxruswoq.exe

    Filesize

    74KB

    MD5

    c039b5309c455f463d4fd7e78ffbaec0

    SHA1

    666b5456365443c4dc07fd0d31111403f6321e80

    SHA256

    80af5aed689bdbaff54fbf406d1eb6ce015731515d7341ff326524d0eeaf992c

    SHA512

    eca135f5ef6dc11b2b0ab9ae66ee5c729f148b5b234b03941a4bbd975056780f92aaa27d1ce39e8402fadb3a03684eb76ce5ffe61f987b2c622102be91a3740c

  • C:\Windows\SysWOW64\nstsbjpg.exe

    Filesize

    70KB

    MD5

    9e4f0c94c9fae9bf2364952b547b2505

    SHA1

    33159deb648e9494d10aba96ce61536a35da78e1

    SHA256

    534aa9e2e5f5097ce60ed2b83fbfae8d7fe86487cb48a7a4931fa190f7029f9e

    SHA512

    0b1b3d20f9f9dd59301fe7c0337d8d68191877e049a0596fcbddfb137f659eabde56d6987a8c21af2a7f0f9dce4ab2115b425b3b75a1049feaa16eea5dbf74fb

  • C:\Windows\SysWOW64\nstsbjpg.exe

    Filesize

    65KB

    MD5

    6b2d87c29e03c1669c86b13f0e329f27

    SHA1

    fc01a8091ad1488013e09ecabcbb34ebb2729a38

    SHA256

    6cb9102f5b672aa60bab941d44dfac6baa33354a6dbff3a6cf1b7e16f4e1c61c

    SHA512

    62a6d356d9d1393f780e7ebef155962a8261e76e5c6df375d5d35484702607996e9334a0a3788cde9ee44d7d6cbfbd284c2163ff4e9837884a0ae5712b1e0272

  • C:\Windows\SysWOW64\nstsbjpg.exe

    Filesize

    512KB

    MD5

    5d8ff8268feba5bd14d7ed7f5d38811b

    SHA1

    174011699090c02911e758312fdd68e77d9ae02b

    SHA256

    729eaec19821361f7e6f87d1d5140292515f0c6f81fd3a7dd5e2d4ecd412d5d2

    SHA512

    41740518661fc4ed0ecc0f38458f928bb9d0a73a73d6ca11348c8a9ff6c7ea0fff3ff0ab526eeb0c34cb27f52b8ffc89e0f0d957ea6d271d72ae6501eea8b773

  • C:\Windows\SysWOW64\vbslyndipj.exe

    Filesize

    512KB

    MD5

    5289f314969c98fef4989747501cc467

    SHA1

    6d8932e6fdc50e21a106f92b212da137cbc8c308

    SHA256

    bcd8472a992b704218189deeea3f9631bfd2ca0a434031e3b734d91050640471

    SHA512

    343817e5ee6ee993d3b5e55fead7eba875e719992d0ffb80bc73e6bc4c1c11ec4783ca7a84432f6ceae6d93f1db3f49b67cec30890e665521e2a3e600a6e9746

  • C:\Windows\SysWOW64\vbslyndipj.exe

    Filesize

    448KB

    MD5

    ea3453e14e3dc290437a8a81d7186966

    SHA1

    6966041e94344c696e91811eff994de0a2cd9be6

    SHA256

    0717eb7fe95703addd2899bd92cda76a9bd9c4970e9f2af81e760a207e745b90

    SHA512

    f698bc87d1346a484ef4d194e0c697ba46fb5c1c79d5f00b345cb51ccfcb36928286b8dd5aec53daf173a4a1445e7dd2cfbc6c136e45ad1e23192f75818ed201

  • C:\Windows\SysWOW64\vkweuuoomcihzfo.exe

    Filesize

    448KB

    MD5

    9728739f509ce0f3b3b073c945c208bf

    SHA1

    31bf207a650a7f1bbb8e90552891f1a6f4e4783b

    SHA256

    f252517c755af447fe73347dd23cd133e28c7a203d01382306a195c8ddda3dba

    SHA512

    76e963f4d1b88528ebbdbc375372889efffba4768f6a99bccce4c1faa730e9515f93fa74bd10bb61c0034f2ceb9ef85ee8234f9d13df183ffc7e163ae3dd38e7

  • C:\Windows\SysWOW64\vkweuuoomcihzfo.exe

    Filesize

    119KB

    MD5

    6fcfdb89b52fe7a3eebfaa8dcd40c842

    SHA1

    8d25d76b60b0d013cc2ea073c1dcdd32176a97bf

    SHA256

    6810d8a00109fa0754d3679fa3536e7826693f6f14861be411352ce8f60304d4

    SHA512

    3da91dffeadd1d12f838e2a02c555af61b79be2483583a4556a891aad38299c30a365aea140539aab757c33b8198f74aed3672fef73b5513dec1a58e01cfd8d4

  • C:\Windows\SysWOW64\vkweuuoomcihzfo.exe

    Filesize

    512KB

    MD5

    e9e540bbbfb26bafb3929bf543380b3f

    SHA1

    b246a8f0896258ea45b49d6f18fc3bbbde612197

    SHA256

    7a8fcef877e9c0e8c58b0b9e40c588ab0788cdac9ffc7ae096fc338a1ae7fb93

    SHA512

    3a9ed7ba2995dcd33846a1353f117c4201d265790e3c3589786ac3513bb3ec95c7f2c5fef8329513b874f8fc59ffb9810dd86e92087d622471d54ccfd3dd7307

  • C:\Windows\mydoc.rtf

    Filesize

    223B

    MD5

    06604e5941c126e2e7be02c5cd9f62ec

    SHA1

    4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

    SHA256

    85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

    SHA512

    803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

    Filesize

    512KB

    MD5

    ee7ca57bb804b17e99ca221ca1811608

    SHA1

    cf42bb09fca0428c19e478f7e12a6ff52464c2ec

    SHA256

    0da59a3f4f4c63a0fec733de768eb8e69a99ae579c60cd719257469ff9bf50ac

    SHA512

    c433ac237bbf6f8ef3107829adb5d2756088b70f0108a46a8fc3cf3d947e212ec9658b99402ee9a46bd4916143c7f859f56b2b1640dee7ef21cf242a3fc18bf4

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

    Filesize

    512KB

    MD5

    52b74e32d0b7c1f4cb28057f6a445c59

    SHA1

    c5343166a4ffa36d8d29309b4132f3eda94fb29a

    SHA256

    9dfd3cb9ba8d7f72520a8b04f5e9532dd966ea907d7d2731ad9c403309629588

    SHA512

    fb78106cc142c5919408a69614fbf22974c22cb0cec1fe2039acfd8df0de22c045398271f845ff29f3a6c7fa5aad40800fe110126b60377aab461346d25bae58

  • memory/3616-0-0x0000000000400000-0x0000000000496000-memory.dmp

    Filesize

    600KB

  • memory/4988-37-0x00007FFEAA950000-0x00007FFEAA960000-memory.dmp

    Filesize

    64KB

  • memory/4988-43-0x00007FFEEA8D0000-0x00007FFEEAAC5000-memory.dmp

    Filesize

    2.0MB

  • memory/4988-47-0x00007FFEEA8D0000-0x00007FFEEAAC5000-memory.dmp

    Filesize

    2.0MB

  • memory/4988-49-0x00007FFEEA8D0000-0x00007FFEEAAC5000-memory.dmp

    Filesize

    2.0MB

  • memory/4988-46-0x00007FFEEA8D0000-0x00007FFEEAAC5000-memory.dmp

    Filesize

    2.0MB

  • memory/4988-51-0x00007FFEEA8D0000-0x00007FFEEAAC5000-memory.dmp

    Filesize

    2.0MB

  • memory/4988-50-0x00007FFEEA8D0000-0x00007FFEEAAC5000-memory.dmp

    Filesize

    2.0MB

  • memory/4988-52-0x00007FFEEA8D0000-0x00007FFEEAAC5000-memory.dmp

    Filesize

    2.0MB

  • memory/4988-53-0x00007FFEA8890000-0x00007FFEA88A0000-memory.dmp

    Filesize

    64KB

  • memory/4988-54-0x00007FFEEA8D0000-0x00007FFEEAAC5000-memory.dmp

    Filesize

    2.0MB

  • memory/4988-55-0x00007FFEA8890000-0x00007FFEA88A0000-memory.dmp

    Filesize

    64KB

  • memory/4988-42-0x00007FFEAA950000-0x00007FFEAA960000-memory.dmp

    Filesize

    64KB

  • memory/4988-45-0x00007FFEEA8D0000-0x00007FFEEAAC5000-memory.dmp

    Filesize

    2.0MB

  • memory/4988-48-0x00007FFEEA8D0000-0x00007FFEEAAC5000-memory.dmp

    Filesize

    2.0MB

  • memory/4988-44-0x00007FFEAA950000-0x00007FFEAA960000-memory.dmp

    Filesize

    64KB

  • memory/4988-40-0x00007FFEAA950000-0x00007FFEAA960000-memory.dmp

    Filesize

    64KB

  • memory/4988-41-0x00007FFEEA8D0000-0x00007FFEEAAC5000-memory.dmp

    Filesize

    2.0MB

  • memory/4988-39-0x00007FFEEA8D0000-0x00007FFEEAAC5000-memory.dmp

    Filesize

    2.0MB

  • memory/4988-38-0x00007FFEAA950000-0x00007FFEAA960000-memory.dmp

    Filesize

    64KB

  • memory/4988-108-0x00007FFEEA8D0000-0x00007FFEEAAC5000-memory.dmp

    Filesize

    2.0MB

  • memory/4988-130-0x00007FFEAA950000-0x00007FFEAA960000-memory.dmp

    Filesize

    64KB

  • memory/4988-131-0x00007FFEAA950000-0x00007FFEAA960000-memory.dmp

    Filesize

    64KB

  • memory/4988-132-0x00007FFEAA950000-0x00007FFEAA960000-memory.dmp

    Filesize

    64KB

  • memory/4988-133-0x00007FFEAA950000-0x00007FFEAA960000-memory.dmp

    Filesize

    64KB

  • memory/4988-134-0x00007FFEEA8D0000-0x00007FFEEAAC5000-memory.dmp

    Filesize

    2.0MB