Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

5

bd1dfe4546...05.exe

windows7-x64

10

bd1dfe4546...05.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    152s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    09/03/2024, 23:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bd1dfe454660f2d6c0b276c6ea85a905.exe

  • Size

    512KB

  • MD5

    bd1dfe454660f2d6c0b276c6ea85a905

  • SHA1

    8e0e3c6518cf76d0771b62d24fc69102a414c90d

  • SHA256

    d5443762381648fdc483d3dbc594deee17d74a1b987c05e9002fd5603ab51be8

  • SHA512

    02e979d868229c157c11316d0bcfde04b551d43b3cf61e656f6b2dd70b98227f4646cdc9280154761a42d6e36a17b93111133aad000ec37062e8292345e60bc7

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj61:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5+

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 7 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 21 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bd1dfe454660f2d6c0b276c6ea85a905.exe
    "C:\Users\Admin\AppData\Local\Temp\bd1dfe454660f2d6c0b276c6ea85a905.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3020
    • C:\Windows\SysWOW64\latnfltogm.exe
      latnfltogm.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2284
      • C:\Windows\SysWOW64\emfochpl.exe
        C:\Windows\system32\emfochpl.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2432
    • C:\Windows\SysWOW64\kbamrosehsnhjao.exe
      kbamrosehsnhjao.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3004
    • C:\Windows\SysWOW64\emfochpl.exe
      emfochpl.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3032
    • C:\Windows\SysWOW64\opgkpxpxgdyvq.exe
      opgkpxpxgdyvq.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2620
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2516
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:2392

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
      Filesize

      512KB

      MD5

      9338331f5f74a8525a8dcbbb0942bbf0

      SHA1

      25921a848ae3cc67cb9f19056b7c274cf4623555

      SHA256

      cd535f0899641f388e384afb7d5e522fcdd84ca8988cd8e586f5d0d70a024b1f

      SHA512

      54ea1cf50602db103c6f2208419170d4392216e34e7803a7bf56e76b382bc6ece78461f8edccfc2b3bf901deb909e91fd57f2e7c6f2d2f4da818192e8051be76

      Download Submit

    • C:\Program Files\RenameClose.doc.exe
      Filesize

      512KB

      MD5

      7c24e648c529dc6fccc4fe8b94382729

      SHA1

      4d957ce7b5a89439095b1472c67dca32d6fe9228

      SHA256

      0dcf3847f356c36bb3e1116e784e7d5a4a40d89d84601b4b602d886c786603c0

      SHA512

      8e7ae4f77239b06441865864a96b2ba6dac8502414d2cb6e2aba5d9a5f5ada47079cb56e75836808a533eaa46a625a48107b9819b200ad071b41e07ac594affd

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
      Filesize

      20KB

      MD5

      2af3ffc0d071c7b333e723ae7512e25b

      SHA1

      f492d3c6d0b02ff8aeb9e7cf779538d06083787b

      SHA256

      a4087d7c9dd2bcb027aba5f7ec27732a2421382403aa103ae8178b7cc97db7c7

      SHA512

      c99fcae0d75d733fdd263be95eb4e4cdfeaa2ed2c6890e6109fcfe4ad6391bda17177b56a758be871676f0e585805affb6308527fc323de3b5d0a05f7a2d4faf

      Download Submit

    • C:\Windows\SysWOW64\emfochpl.exe
      Filesize

      512KB

      MD5

      ecd0b8274feee5543079bca187bfb5ae

      SHA1

      bf04871664b89537a4e534f837be81dad46dc301

      SHA256

      55191f5204fdbcb5943f076a4054e2192faaa1eec4c5cfb63ae8fc649da3ca0c

      SHA512

      cb01de3076da29f19657e0539475dd3b9b0846874774f097b36ea8eb7a3601d412bdeae66181164e872419c1c20868990acce2ca024e720e42ce1ffb49b0ee24

      Download Submit

    • C:\Windows\SysWOW64\kbamrosehsnhjao.exe
      Filesize

      512KB

      MD5

      18cec7541e90177603c0b27b42c15036

      SHA1

      213f0698e8f4aa6911816ce4fcdf9b6937baadb4

      SHA256

      4f5b5b1e07f0f204b1a98c30a1a46dc989ee88dbfbab0a0395ba7051e521dd5c

      SHA512

      8c8091c9459fae83eb4442baf0051d76e12a7009cb0ab3999678811e19756fbcfd24d47d81ca3c5a59489159afbbaf3fe26afbd344ed96894205b9a32bcb154c

      Download Submit

    • C:\Windows\SysWOW64\opgkpxpxgdyvq.exe
      Filesize

      512KB

      MD5

      edc83b452fa5fa96584cd6a4d7548521

      SHA1

      e36ab300f005ff8cc75e9a338d7917be94608485

      SHA256

      99e40c7128622f2dcdf537d10f452f8da8fe369ba7b53dbac1246d157c01d1d9

      SHA512

      fb657a284dde5da649554b8baf9241384c2ca6bef8e62f850e4ef4c2469e50c28a37fc6b1e27ae049a7289c0764097335a4ca0b68e98a2567d70f162f21a6520

      Download Submit

    • C:\Windows\mydoc.rtf
      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

      Download Submit

    • \Windows\SysWOW64\latnfltogm.exe
      Filesize

      512KB

      MD5

      d81b4acc6007891a92f338387eb8b85a

      SHA1

      1453ab4e68a794986a029201cfa4ca9b5c38c86b

      SHA256

      a9574498b2700edf4abc39c776f700a6981546ac56b9669e51c18e3a41ac0289

      SHA512

      a2e8f0a62113ac1d6bc8ce222e3511bdc01d921a6fa3d00290ecfb9a23c6d495730bf7aae18fa047b03145eac25c13c2374be170f3e467a0a451b4c46b633909

      Download Submit

    • memory/2516-45-0x000000002F731000-0x000000002F732000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2516-46-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2516-47-0x000000007196D000-0x0000000071978000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2516-86-0x000000007196D000-0x0000000071978000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2516-107-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3020-0-0x0000000000400000-0x0000000000496000-memory.dmp

      Filesize

      600KB

      Download