Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    08/03/2024, 06:58

General

  • Target

    bacf073e0149abfe33067464d8518405.exe

  • Size

    255KB

  • MD5

    bacf073e0149abfe33067464d8518405

  • SHA1

    4f0b943ad5123bb76dd96c0eea7ce3f33236b2e6

  • SHA256

    2e262b8d6f291f262fedfb9087eab6708028f0533f3ac4a6418233af64b58054

  • SHA512

    68474d5c353e9c58f92c109c07933ae0a9c82bd15c37c2dbe8d582502bd05c7d073002cc327009a88ff9e55088c1a47a9ad51ca005f3e0bb5ed7292420e3d605

  • SSDEEP

    3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJW:1xlZam+akqx6YQJXcNlEHUIQeE3mmBI1

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 5 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Windows security modification 2 TTPs 6 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
  • AutoIT Executable 64 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bacf073e0149abfe33067464d8518405.exe
    "C:\Users\Admin\AppData\Local\Temp\bacf073e0149abfe33067464d8518405.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3032
    • C:\Windows\SysWOW64\ygvcadeeyl.exe
      ygvcadeeyl.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2984
      • C:\Windows\SysWOW64\ieukrilz.exe
        C:\Windows\system32\ieukrilz.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2600
    • C:\Windows\SysWOW64\iivtwyfdwkvpmzh.exe
      iivtwyfdwkvpmzh.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2624
    • C:\Windows\SysWOW64\ieukrilz.exe
      ieukrilz.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2628
    • C:\Windows\SysWOW64\xwarmlfbortoj.exe
      xwarmlfbortoj.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2840
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2480
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:2020

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe

      Filesize

      255KB

      MD5

      b10170d9956bf9d46d67085905baf332

      SHA1

      2ad815904c3ffad61036177a9d8889da49e2bcc9

      SHA256

      a644abe08fe4a9ab37833074e4959f759656a8792d7c62654400daffdccefacf

      SHA512

      5eceadc6429a0568dce2b7a56f29e8fa07568d6ee1c70d16ee57375f341c2f054c41f1b88987e157000f299c3652b93841afdccec71e957204b15c8bb4275f77

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      20KB

      MD5

      16381232f9f906faa39500931050e91f

      SHA1

      38696f5f90685750e9e3ed4e23e6e1917330f5f6

      SHA256

      0fcd7413c505fb5f78717b79543b1474d1a0500e25a77890216bd0baa0748314

      SHA512

      e7a2618999b30bfd3f5d3a607c026adec94c9dd64a9613accd41046a72e88a472a38e1c9e93c75e5ca0546f29f54f162d958280ef81f98dfa9f488de68fb298c

    • C:\Windows\SysWOW64\iivtwyfdwkvpmzh.exe

      Filesize

      255KB

      MD5

      44065e480fcad2366ef5edd4a3b64d95

      SHA1

      d1361cac7e4166fa3173059c5295402a7d7cea59

      SHA256

      52cb52e336090e6f907383a09c6fe0841dc4bbe5e227ece96894dc501bda6772

      SHA512

      850222fe55d602778df10a698d12ab0e02a38a26cefcf54c2a238a5e452e350d607ef0ef2ef8a41eca2a6fb2963ce8c08c3ae88cc5e51a3b83eca3bc06d549b9

    • C:\Windows\SysWOW64\xwarmlfbortoj.exe

      Filesize

      255KB

      MD5

      5221d5d1500795c78588bd540cbe3aa0

      SHA1

      3096b340b9477fe54db5fe4db69f69bf6d5d844c

      SHA256

      2ccd04300d3e5b10688b3a2aaf00f4fe6657138976c0608e96fd2c0bd2687e45

      SHA512

      13a32d9a3844eba14f5ed61720a8d73b0a9edae1b76b01acfc5b9c18e444fd1bb3ce99158b4e2456d2f5949566da4d504d3a0b94ec8fff9506bbcca85009e170

    • C:\Windows\mydoc.rtf

      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

    • \Windows\SysWOW64\ieukrilz.exe

      Filesize

      255KB

      MD5

      1f268369d83366e156572ea0d95c974b

      SHA1

      41649278697fd829cc6f2fd8af083e0a5c06a27b

      SHA256

      0fbb683d7adbb9220412075b91d693b00f8c3ba0280df70dfdb3dd51fe3a65e8

      SHA512

      2dac631b824a466e3ed227b1dae19b45ddc835cc94f434277d8a44f3385783ba437ec5c3abd520cde598acd4cd3ebe21643511d5f8f899a2f42b96304a93e365

    • \Windows\SysWOW64\ygvcadeeyl.exe

      Filesize

      255KB

      MD5

      b8d1ec87e6e9ef0195733b66b4e918b1

      SHA1

      e7d0270c01b3129bfbb4256d8b09952f547d8bd9

      SHA256

      8d55c2c7e2b96db0d895b1307109b93fcee950227f41cdf25fc97d884f5618ec

      SHA512

      338166b65f55cc02168a2ebb4e86a9b1cf29c961d49cd80dcfd27018e3d242a050220d437c13f69cc7f9c019010c33caf06cd458b16fd2239ed1bbb5b500c3ca

    • memory/2480-47-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2480-98-0x000000007185D000-0x0000000071868000-memory.dmp

      Filesize

      44KB

    • memory/2480-152-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2480-48-0x000000007185D000-0x0000000071868000-memory.dmp

      Filesize

      44KB

    • memory/2480-46-0x000000002F1D1000-0x000000002F1D2000-memory.dmp

      Filesize

      4KB

    • memory/2600-95-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2600-86-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2600-44-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2600-125-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2600-114-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2600-97-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2600-104-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2600-109-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2600-126-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2624-83-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2624-87-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2624-129-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2624-132-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2624-154-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2624-92-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2624-122-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2624-116-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2624-157-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2624-160-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2624-163-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2624-27-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2624-111-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2624-101-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2624-166-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2624-106-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2628-107-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2628-117-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2628-34-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2628-84-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2628-89-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2628-102-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2628-127-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2628-123-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2628-112-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2628-93-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2840-94-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2840-133-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2840-167-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2840-164-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2840-118-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2840-103-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2840-113-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2840-161-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2840-38-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2840-124-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2840-158-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2840-90-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2840-155-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2840-108-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2840-130-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2840-85-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2984-100-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2984-159-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2984-105-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2984-110-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2984-67-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2984-153-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2984-128-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2984-156-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2984-115-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2984-165-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2984-82-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2984-91-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2984-131-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2984-162-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2984-121-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/2984-96-0x0000000002C10000-0x0000000002CB0000-memory.dmp

      Filesize

      640KB

    • memory/3032-45-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/3032-18-0x0000000003380000-0x0000000003420000-memory.dmp

      Filesize

      640KB

    • memory/3032-0-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB