Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

5

b983f86798...ae.exe

windows7-x64

10

b983f86798...ae.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    07/03/2024, 19:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b983f867985ffbc2773e766c2f464bae.exe

  • Size

    512KB

  • MD5

    b983f867985ffbc2773e766c2f464bae

  • SHA1

    b70dab35eef86089c56d7800c3770a2894580c58

  • SHA256

    3bfc2ec771eeb7a2485768a5057093cddfd58e200381bbd5688bb84b3ed7a251

  • SHA512

    2956a409d98905f22020708b5d83256226dc7d6198e03d9a873fd00172a8ce1997b30a0f41c4e97551215bb9fc8988f734258d7ce83094aeefcb0c79e333e0c6

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj62:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5h

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 9 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b983f867985ffbc2773e766c2f464bae.exe
    "C:\Users\Admin\AppData\Local\Temp\b983f867985ffbc2773e766c2f464bae.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1960
    • C:\Windows\SysWOW64\arpfeasnzd.exe
      arpfeasnzd.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2272
      • C:\Windows\SysWOW64\wqeuijsg.exe
        C:\Windows\system32\wqeuijsg.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2412
    • C:\Windows\SysWOW64\qwkacsagmsgxekd.exe
      qwkacsagmsgxekd.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2640
    • C:\Windows\SysWOW64\wqeuijsg.exe
      wqeuijsg.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2572
    • C:\Windows\SysWOW64\yijfbtllbrujf.exe
      yijfbtllbrujf.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2788
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2492
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:656

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
      Filesize

      512KB

      MD5

      1768d8eb7e2376b1943b98dadb717747

      SHA1

      db02c626c16e0e8f10e93517786c35aac6cc2e08

      SHA256

      8c2d8fd6c5aab80127c9f2e5396c3e382834b81cef7145cd9f1400319287fa37

      SHA512

      ee9577ca7874759d9c1f4f9a15f71c70a02a632c317fc5ba338bd01e55f182105dd886e2c30300cfc5d295454a071079b373a3cae00248babf955ec595e1eda9

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
      Filesize

      20KB

      MD5

      9b26ecdf9ed872a954d28f83bd435733

      SHA1

      9f016bb4c35d1449a6c2f047ca7f88364a2373a9

      SHA256

      c0fe2e7172708969a58d7ba8221b83b21cc2c348460e3bb9117e65ab290f1d2e

      SHA512

      f65bfcc07153af47f105800e6a46b5d2d2e839b5643e6803475e9ef4a6c488e03af64be7d7c55f25d0974c4a70a25f3cdf452cec31d3837290147f34390dc08c

      Download Submit

    • C:\Windows\SysWOW64\arpfeasnzd.exe
      Filesize

      320KB

      MD5

      40eccbf82b7b8fc916befc4f91646a41

      SHA1

      9b26728b4c732bfeb504f70ab523d90def972d37

      SHA256

      1dc118e41bf637830be03d9bfe6d57960cf8dc9dbe9c8302a78e3406285bbaaa

      SHA512

      4714d4a188098bfac7feb042ef4c6f0236e826c335c740df7f47d60f0e70d50c5eeaf73e1b94afb0408bd8c6b5ef6fa9d49577a6ac214ce115f4b6db0b341cdf

      Download Submit

    • C:\Windows\SysWOW64\qwkacsagmsgxekd.exe
      Filesize

      448KB

      MD5

      9728739f509ce0f3b3b073c945c208bf

      SHA1

      31bf207a650a7f1bbb8e90552891f1a6f4e4783b

      SHA256

      f252517c755af447fe73347dd23cd133e28c7a203d01382306a195c8ddda3dba

      SHA512

      76e963f4d1b88528ebbdbc375372889efffba4768f6a99bccce4c1faa730e9515f93fa74bd10bb61c0034f2ceb9ef85ee8234f9d13df183ffc7e163ae3dd38e7

      Download Submit

    • C:\Windows\SysWOW64\qwkacsagmsgxekd.exe
      Filesize

      512KB

      MD5

      0508206bd6fe21eb63c539e9c71f2bdc

      SHA1

      a5c10e3ba1013da0dc1008a8ee84b62fd2ece21d

      SHA256

      37f5a9c2fe6c1d014dd45b6764514c1ea85e6784c3e08360624c38def4e04406

      SHA512

      979fde14b0119388efded6aaa3b0174fa3743e652d8aa111cd80ee1adaeca16f8865910b3721caf82580ef29832bae227306c591e030fefde237ad913919ffe9

      Download Submit

    • C:\Windows\SysWOW64\wqeuijsg.exe
      Filesize

      64KB

      MD5

      d76d22b81130bc9206c7c947d7a9ea5e

      SHA1

      5956e88a6ec7949ce5a350e21703307d855f34b1

      SHA256

      b96acd28ea28c51de470bf63ebbc33a346440fe63e236ab9f092e0cb3035b870

      SHA512

      112f4f23127929556f27e12a7979ebd1536af790c92f8ff7870a5b39470bd02d83fbf1697e7ab3eccebd71c44ae7bfbd1dac9c39fefa6e15a488baf840b8aaf1

      Download Submit

    • C:\Windows\SysWOW64\wqeuijsg.exe
      Filesize

      512KB

      MD5

      f9fe13592fe16ed8c8facf41992167c4

      SHA1

      a08483c69d4610ef9b1235557f49d43cd68f91e3

      SHA256

      280de9587855bed378be1f29ccdb83a8187ed3df55c62199bec0c7933df26b68

      SHA512

      9cc2ad528a1ba72fa52c10349b9b064088bc71fcb2b9b9da759ba20b9997b3512a1f74e5bd789d52dc906bdb5b81811fd4e18dcb0b9ae64a03972d89e9d9fa71

      Download Submit

    • C:\Windows\SysWOW64\yijfbtllbrujf.exe
      Filesize

      512KB

      MD5

      d8f9a5cf130e41cd3df360715ce149bd

      SHA1

      e024df1344e08f91838526ab441f633d4da5a7ac

      SHA256

      69547e9cc64f63643db5e20c6f03397aa66f86b2bd52a964a25ab12cb8026c94

      SHA512

      28ce6aeeb80386e1fa312d30c93ae75b9c6b9421e5bc84c3bb87330578ff9b57d54658ec93136a7d068e5bb1c105604d3f83634908990590f9b8a70739371249

      Download Submit

    • C:\Windows\mydoc.rtf
      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

      Download Submit

    • \Windows\SysWOW64\arpfeasnzd.exe
      Filesize

      512KB

      MD5

      b7f688c1d78acff46ed3e5f609662ca0

      SHA1

      edd123f2a170ecdb07b7f4eb7b84745272720804

      SHA256

      51d0cb490e7164e4619ed23a0d20bbf317c089ae844eed58800440a150649ffd

      SHA512

      b2c029bf3e912c28fb426bee1851e164e9c6ba40dd453c9816ace876fe3177c62452549a2b6bad939c170cf133712d1c16527f26b11cf152674a5a9294fd340c

      Download Submit

    • memory/1960-0-0x0000000000400000-0x0000000000496000-memory.dmp

      Filesize

      600KB

      Download

    • memory/2492-47-0x0000000070FED000-0x0000000070FF8000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2492-46-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2492-45-0x000000002F3D1000-0x000000002F3D2000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2492-81-0x0000000070FED000-0x0000000070FF8000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2492-102-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download