Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

5

c0f5f6ce7a...6a.exe

windows7-x64

10

c0f5f6ce7a...6a.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    11/03/2024, 15:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c0f5f6ce7a241bda371348f17923016a.exe

  • Size

    512KB

  • MD5

    c0f5f6ce7a241bda371348f17923016a

  • SHA1

    c8550edbdb6e316214dde0aa58184f78c687e59d

  • SHA256

    dbdb6bc32647ab85b7ec32c6b242c13cf23108e3407f4cd4510b3f12b7ae9536

  • SHA512

    24945ceadb37098bbeee2f62f12bce4e3179e6fcd71033106838dab30ca69bb269fe1b1fa4b7fa676e8f7e44ccda6b289071426e383a889a57820f8caee19335

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6I:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5f

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 6 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 47 IoCs
  • Suspicious use of SendNotifyMessage 37 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\c0f5f6ce7a241bda371348f17923016a.exe
    "C:\Users\Admin\AppData\Local\Temp\c0f5f6ce7a241bda371348f17923016a.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1812
    • C:\Windows\SysWOW64\esrzslcila.exe
      esrzslcila.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2756
      • C:\Windows\SysWOW64\fuyruhbm.exe
        C:\Windows\system32\fuyruhbm.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2588
    • C:\Windows\SysWOW64\frqaxhixmljermk.exe
      frqaxhixmljermk.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2572
    • C:\Windows\SysWOW64\fuyruhbm.exe
      fuyruhbm.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2636
    • C:\Windows\SysWOW64\gxekxsdhsmvlh.exe
      gxekxsdhsmvlh.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2560
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2692
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:840
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2804

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe
      Filesize

      512KB

      MD5

      baaa7299aa510d4bac3c768bd9d5ab5f

      SHA1

      4c493d025a10e9cca8bd310a42c9cac389b907d7

      SHA256

      1ed9ec078e7c96b765980100e5d74c57c7a8d53f271b5a704c15a7c407b29d84

      SHA512

      5af19fe662511bce5fe5dc7219d7c376fce9f09ac349a1072c3d8c19e3de21d8ea7a0398cacbe47e44da0dc7b82bd261ee7277ce2496c8ca3e42695eedc85b3b

      Download Submit

    • C:\Windows\SysWOW64\frqaxhixmljermk.exe
      Filesize

      512KB

      MD5

      4d1084b1b5c73faf5ae9c7e35c2647f2

      SHA1

      e11b72793e60e327d41902552dea111e151f6a9f

      SHA256

      25d9b80668dac915994664090df3855f4bda9b3b04198db0b43928eb12707598

      SHA512

      ce0743f1a5bade92dd1552a3e20e0367c5bd6f65adac93c7f7a311b941f018298d965cc76c2e24f4bd21d37354f227c88174a80274653a62a6b9552ec8359526

      Download Submit

    • C:\Windows\mydoc.rtf
      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

      Download Submit

    • \Windows\SysWOW64\esrzslcila.exe
      Filesize

      512KB

      MD5

      943d8bfe618e53c519b0066a25010f05

      SHA1

      82e55a372f49a5a86d7d11f9850b2410c1659915

      SHA256

      bab43af0ab6a8892eda0fbcf592993597a51838d843f37a78b99d013eaee1f44

      SHA512

      b2deac5cc3a20d6d29cb2e8a4b8b90732c2d74098fb9dff1c597d43c52d29002d6360bc6bad4812a65c1d6252388feb75788ef785aa5cd8708f726971086df22

      Download Submit

    • \Windows\SysWOW64\fuyruhbm.exe
      Filesize

      512KB

      MD5

      0bd193fc79f578febec32d6fb751a315

      SHA1

      6c0308def24e595f8f60b1c5338756b601f8bc1e

      SHA256

      7017110cd4f8f86d2f7e204a1ead854414d53f3fd0e1986003c5cb534efe3178

      SHA512

      29548b72a8189f7ae8c1a5cc3917cbce014d8f45955678b9f1f1cb577eb756fdc5ee516b1578e7a2351af5f7b9972def632e7e5a9c5a836af2a62ad1d2373d53

      Download Submit

    • \Windows\SysWOW64\gxekxsdhsmvlh.exe
      Filesize

      512KB

      MD5

      698d3ddfba2660c5465dcb799f1fd9d3

      SHA1

      458320a39d2787b79273ceb89b3286de24e01055

      SHA256

      f864b4c776ac3fcfa6546c985883c124e5a78d2d330d821d5a929e0634edf091

      SHA512

      18f30a7045128fa7a51d4a9aee31815f1c7c55bb36a4f4fd9716f8a278d7830bd4ba87e34bd826640198e55846166eb397c4c08aa020cb9b8739873c492ecaed

      Download Submit

    • memory/1812-0-0x0000000000400000-0x0000000000496000-memory.dmp

      Filesize

      600KB

      Download

    • memory/2692-45-0x000000002F591000-0x000000002F592000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2692-46-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2692-47-0x000000007104D000-0x0000000071058000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2692-77-0x000000007104D000-0x0000000071058000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2804-76-0x00000000041E0000-0x00000000041E1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2804-78-0x00000000041E0000-0x00000000041E1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2804-84-0x00000000032E0000-0x00000000032F0000-memory.dmp

      Filesize

      64KB

      Download