Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

5

c92ea58ebc...63.exe

windows7-x64

10

c92ea58ebc...63.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    14/03/2024, 17:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c92ea58ebc8b3d1a8dea1483d01a7763.exe

  • Size

    512KB

  • MD5

    c92ea58ebc8b3d1a8dea1483d01a7763

  • SHA1

    0e874501653f8b4482e9fb2a03816c9a4f6dbeef

  • SHA256

    84ab41fa3902f5503d41df7774fe849a312277649f40f5a6474f28d9ea3d0eaa

  • SHA512

    20d6c43f53d7d11474f00dcf4d97aba572788682580e3307a83564f1725918151d5a4abd90f4add8ca1969ef28b3e78e2dfc17f5cb64a529b2c00ba51da02ea4

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6D:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5S

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 7 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c92ea58ebc8b3d1a8dea1483d01a7763.exe
    "C:\Users\Admin\AppData\Local\Temp\c92ea58ebc8b3d1a8dea1483d01a7763.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1300
    • C:\Windows\SysWOW64\ybxxivhwmh.exe
      ybxxivhwmh.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2968
      • C:\Windows\SysWOW64\moxlbopq.exe
        C:\Windows\system32\moxlbopq.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2460
    • C:\Windows\SysWOW64\ylwwnxyxclyqudm.exe
      ylwwnxyxclyqudm.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2540
    • C:\Windows\SysWOW64\moxlbopq.exe
      moxlbopq.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2664
    • C:\Windows\SysWOW64\nbiadtkikxpkw.exe
      nbiadtkikxpkw.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2564
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2432
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:1048

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe
      Filesize

      512KB

      MD5

      c7cd6a18f2b48d67c0d046041793e17f

      SHA1

      4b0473dbd54fbaffe49a141d80a743a47d018c91

      SHA256

      7dd605408fa7700f085b3d1240f11ee83070bd4cf3f3627a10c0ea8d3a5fb0a3

      SHA512

      8657e16adf2406bdb34f24544b996cc61457b578f3969d510e0cbe262697ebd65fb393a1d2dff43805d5fdead1b756a6891a5d65f6f3cbd9ff6c1e3aa458d106

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
      Filesize

      20KB

      MD5

      cc5f039f9d0a2cf26ef3e435fd6abae5

      SHA1

      18a83e665867a04827a70ae67c892f7a0b42e040

      SHA256

      c0ca7b11de5bcc76dd98cc77dfb33cb51123ef046e813880ee89bf3aa9ab45ac

      SHA512

      8a5e1af09e9e15957f0e9a2363412ec18f8c561f824b9ead3492972509d1e64d619863cd2b5360d38185c77ccfc6fa2785b713e790174fe287bb0c0a642d71db

      Download Submit

    • C:\Users\Admin\Documents\LimitSplit.doc.exe
      Filesize

      512KB

      MD5

      3665cddaa6052db1cec59dcf654e32a0

      SHA1

      1318c6c77ac89021b3258d225e65ecf593797f2b

      SHA256

      87035b5e528a80658b6f4ba985470548900388d138eba989350e5018027a8488

      SHA512

      762de8fabb9f97c867d1b35fb4a83d75a89878166133b2da5eda44c86cb63e4c1af7b4dcf933fb49dc6c8c74f280bd0f6f02ffea1b0e5edad020429f79af85d0

      Download Submit

    • C:\Windows\SysWOW64\ylwwnxyxclyqudm.exe
      Filesize

      512KB

      MD5

      1abaae5ea6dc321dba8bf6d2b7a5df9b

      SHA1

      cce5c7be888a246c4df08afa5543621e0960d0a2

      SHA256

      f33b8e5801c0dd92115d1cadcc558e0bb0aefd0c996746021c4cb5a022cce4eb

      SHA512

      2a8a02c460e956c2eb72c7998c47fd35b4c4f3eb719912866fb214dae5347049991bd7d1ed4292c483d06fc3e1074260b82723b9b00e0e6ea6f51d2e79c9a921

      Download Submit

    • C:\Windows\mydoc.rtf
      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

      Download Submit

    • \Windows\SysWOW64\moxlbopq.exe
      Filesize

      512KB

      MD5

      9ae8e192f3a8fc56e89aaa5169d181dd

      SHA1

      ae004af9c7c0cfa38afb71cad7939bb85c3e993b

      SHA256

      920ff162ace5ca2efcacef4c3501e61ac4776e29e22d9b256657c491bd1d2e91

      SHA512

      671ba36c5eb5763f93f3b038d6cd6b1fa83f43a4b76f97f20a98524789ff2d894ab23ff6ab00f8cf90f929a9c4eff5918ef2a2ed73f9db7e2dd211ae781dea5b

      Download Submit

    • \Windows\SysWOW64\nbiadtkikxpkw.exe
      Filesize

      512KB

      MD5

      a6b7e808dba38a9f62e6a56966741b14

      SHA1

      5d6f36017ad760fa3e6c4dc6ad785c644500caa4

      SHA256

      f62dd1daa98f36aa6d37c50f14a2b2b2088f126b84e977ea9e476703fbc34138

      SHA512

      418e61dedb15dc98cf7327369a69fb6d060c451964d4fd42462b6552af28a6341c5fa19effcaf5050a21184f49b3c7ca31c420998afd3a59e69592c839da47be

      Download Submit

    • \Windows\SysWOW64\ybxxivhwmh.exe
      Filesize

      512KB

      MD5

      855043f0217032f280eb5c59e91e4b7b

      SHA1

      0488cb426048ee616c4470d8d561b339154078e8

      SHA256

      d824d1f3ff1e64b31984ab833018e4112b02b55b0f784f4e0dcad0e39e0abf4f

      SHA512

      40b1b814f4eb5c0c5faeaefbaeff4d3c076f98d0b1439b67fbc155213ff3f41788e4969e2f1d878f71e06602b1c961888074e921b70eb5ee0e6314054b766842

      Download Submit

    • memory/1300-0-0x0000000000400000-0x0000000000496000-memory.dmp

      Filesize

      600KB

      Download

    • memory/2432-46-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2432-47-0x000000007102D000-0x0000000071038000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2432-45-0x000000002F881000-0x000000002F882000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2432-73-0x000000007102D000-0x0000000071038000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2432-109-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download