Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/03/2024, 01:57

General

  • Target

    ccd29632beb558de4af374096999d00a.exe

  • Size

    512KB

  • MD5

    ccd29632beb558de4af374096999d00a

  • SHA1

    461df1b2dcd4c4e4714168aa0badec66cb938f21

  • SHA256

    da694c6618e5774ae282ec15f49b77424182202599c02de84db97a1f4d42cfe8

  • SHA512

    93d818d364af12d81e18f3ed08017f1ac5e7126765e1b982defd982291374107ee85f15b8adabec47263143de71cda39ba01edb19dbbae947b42d956314c9d83

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6N:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5q

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 5 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 6 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
  • AutoIT Executable 9 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ccd29632beb558de4af374096999d00a.exe
    "C:\Users\Admin\AppData\Local\Temp\ccd29632beb558de4af374096999d00a.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2992
    • C:\Windows\SysWOW64\ziadralkly.exe
      ziadralkly.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1036
      • C:\Windows\SysWOW64\rvoxtgji.exe
        C:\Windows\system32\rvoxtgji.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:5104
    • C:\Windows\SysWOW64\vndkdokiptkzlxb.exe
      vndkdokiptkzlxb.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3312
    • C:\Windows\SysWOW64\rvoxtgji.exe
      rvoxtgji.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1684
    • C:\Windows\SysWOW64\fsdczgcuxvvon.exe
      fsdczgcuxvvon.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4612
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:3512

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe

    Filesize

    512KB

    MD5

    5d8e6bc603c92f84b6764e7f5224bb07

    SHA1

    02967ebcc2f03f107852057719bab14ced790d5c

    SHA256

    a9754faa60e601ef0e23d1c934af1a093db034b2a5f0c003bb834699138a6f4b

    SHA512

    30a6c66129b3c155d87362227ac15955bccf32af71573058f69885b42d6b0f929fd7db4dcc04471d2bff559922783a1d79cf8ae6ebe9f6a783f0664e8c56f362

  • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

    Filesize

    239B

    MD5

    ff6f3e0b6935aec105412befe2def362

    SHA1

    28c253077973ef073a124d7618cbfe31f18fbe46

    SHA256

    f6159eb04bb936c0cf3357bb7c2d614d1a33193c3e5b170ff69cac412ccb974f

    SHA512

    5aebfcbfcc1e1080a6a3b7c5e7135abd54ae30b9c368a8094643595f6bc12ab366f7c0aa77e678ea721dadbb8d13bb9f79317e7c1d0b9883f63437639bb95966

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

    Filesize

    3KB

    MD5

    eab1b5700767c3190c6d11076e5e0408

    SHA1

    843ef23cef9eaeab615ded5b109dd2a35ff02b0d

    SHA256

    701d4c8bb0b63004793903322f14b61de3959ff5f8f6fc418de5faa5f6f53a9d

    SHA512

    78a86fe5e9853676d48392e6d30d85367ab5c9360497fa4bf1ef79e730dca7bd40502bbf17db0c62080f40650d79f985d193e9751e198087706cc7d8115d4b88

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

    Filesize

    3KB

    MD5

    189d805c6a1f609852c24fa3c902a131

    SHA1

    c9d341efcd3bfdc7bd3b28837ee8d4075484742a

    SHA256

    09529cc2826831d591117da729794a73093eb0d7bedd86f55cd54e50214caf6a

    SHA512

    fc4ecf37900217cc4fc24d54ff72f5d8fd3dafb4f91c5ec28fcf75177fb60a2d3becaeaefead24277be948db58a75f02215e564eaaf91ef66e7c3d835c299622

  • C:\Users\Admin\AppData\Roaming\OutRestore.doc.exe

    Filesize

    512KB

    MD5

    e3d417313bf65bf0ad3cccf5a18e6de4

    SHA1

    6ba3039e6c39e16df78c9be5d252b0650b737930

    SHA256

    3bd327e343f93e7402712c1ec79a7143cabe30d1402c3de518d79f6945947d02

    SHA512

    a7583d8194fbbf888ec4ead70cd942d2c8fa83acab3311675e1bb2a0965a830f19164a429bf4696516af4e85a07f704386b0a7970dca9d82f3c98e7938a21564

  • C:\Windows\SysWOW64\fsdczgcuxvvon.exe

    Filesize

    512KB

    MD5

    36359cbd21763849d639bf92e31a4906

    SHA1

    4cfb0961d67f177f8b0f0d67c7718cc4c47067c8

    SHA256

    e56e961d1eecf610552d67bc865f7399599ec9b09ec5590ec9791bde4a600833

    SHA512

    c9b30866ac533bfc6d4a47fda0201c891d226179bb45a68ffa70b16b25a910c60697e8a8852ec4f8e5cdf4eb48cf95d2edf127b69c7c35dcb25b0945ecdd5907

  • C:\Windows\SysWOW64\rvoxtgji.exe

    Filesize

    512KB

    MD5

    4d7711ce4bab3bfc5d18207f43859f0a

    SHA1

    7fb7705eda049fe72ced09494c31d6aaca2c4f67

    SHA256

    dbabdfd5474b40448a5790dae2a4ac7de7ad17d19ceff07e3582844c7ab73229

    SHA512

    4513914afbd1cab1bd3b604a6c82cd7b06ec292a85cf7af23da32e8e5dba3573d247d594a1a1ec7e095bf27e704bb085c08af25c954d812c1ff01096bf7f8ecf

  • C:\Windows\SysWOW64\vndkdokiptkzlxb.exe

    Filesize

    512KB

    MD5

    3d23b20b7ba00aefe3671fa4264b022d

    SHA1

    ac72335f26cd4abfc09901f1b41e111ea8e2a836

    SHA256

    7ed999084628423376e3b26a1de029bf10b5b030feb5a360f1cebfb1e22a62f2

    SHA512

    1e2e1d773efbe964ce41ec299dc5af215dd857b74d6a3d7e4aad92367f577dc8902355c4014c239f06489b53fabb9cb65df4bb187a01af4492fce9432740d1fd

  • C:\Windows\SysWOW64\ziadralkly.exe

    Filesize

    512KB

    MD5

    0b7325fdd992d78f363ca58474ba55bb

    SHA1

    0506d73582a98c5098d1e71d182a2a6994bc6f83

    SHA256

    87283eeeebf5630868fe45a81be4f3f6f9e633733f6b290a047b4dc359fc4625

    SHA512

    3da89ab2d2d38a37596299838e993330279e2e6efaa9d37a526bc3c38c71b5fed36edeedc25996f4cfabd4e28cc5cabb77774839b3e52c8152d8dedc2b4e720c

  • C:\Windows\mydoc.rtf

    Filesize

    223B

    MD5

    06604e5941c126e2e7be02c5cd9f62ec

    SHA1

    4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

    SHA256

    85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

    SHA512

    803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

    Filesize

    512KB

    MD5

    44ae707545c75a255288846de5ceaa8b

    SHA1

    84481fd67c2fc6be37b747403db4255eddb08166

    SHA256

    090ad5f61554593f9db353c0455a8c564311e54ac27ad53343fe98522732ed27

    SHA512

    81276517b710df460e28ed9e8eab34c3e6dd3d542d748650ed9af4c5b905fcbcb391351fcd407333133ea9820ef8b80bfcaf247b19eb324517e98890fc883430

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

    Filesize

    512KB

    MD5

    6f05a062909c36c0dc46c77e142b7f31

    SHA1

    a6ba796b3dd9685ef912b604bc2fdfa331fcc057

    SHA256

    c9ced9949218663fe871050b4a58c482ccc0d0585143733cc14c1d74c19d5ea5

    SHA512

    5cdd97ec72139a778ce79d73aec3c893e0266ea1b0b58b3f87b4e7338cf6a59e33db3ed1101afd0f579679dff94d8b839e3e630c797ad53daff167bb1c49b567

  • memory/2992-0-0x0000000000400000-0x0000000000496000-memory.dmp

    Filesize

    600KB

  • memory/3512-54-0x00007FF887190000-0x00007FF887385000-memory.dmp

    Filesize

    2.0MB

  • memory/3512-42-0x00007FF847210000-0x00007FF847220000-memory.dmp

    Filesize

    64KB

  • memory/3512-48-0x00007FF887190000-0x00007FF887385000-memory.dmp

    Filesize

    2.0MB

  • memory/3512-49-0x00007FF887190000-0x00007FF887385000-memory.dmp

    Filesize

    2.0MB

  • memory/3512-50-0x00007FF887190000-0x00007FF887385000-memory.dmp

    Filesize

    2.0MB

  • memory/3512-51-0x00007FF887190000-0x00007FF887385000-memory.dmp

    Filesize

    2.0MB

  • memory/3512-41-0x00007FF847210000-0x00007FF847220000-memory.dmp

    Filesize

    64KB

  • memory/3512-52-0x00007FF8451B0000-0x00007FF8451C0000-memory.dmp

    Filesize

    64KB

  • memory/3512-53-0x00007FF887190000-0x00007FF887385000-memory.dmp

    Filesize

    2.0MB

  • memory/3512-46-0x00007FF887190000-0x00007FF887385000-memory.dmp

    Filesize

    2.0MB

  • memory/3512-56-0x00007FF8451B0000-0x00007FF8451C0000-memory.dmp

    Filesize

    64KB

  • memory/3512-57-0x00007FF887190000-0x00007FF887385000-memory.dmp

    Filesize

    2.0MB

  • memory/3512-59-0x00007FF887190000-0x00007FF887385000-memory.dmp

    Filesize

    2.0MB

  • memory/3512-58-0x00007FF887190000-0x00007FF887385000-memory.dmp

    Filesize

    2.0MB

  • memory/3512-55-0x00007FF887190000-0x00007FF887385000-memory.dmp

    Filesize

    2.0MB

  • memory/3512-47-0x00007FF887190000-0x00007FF887385000-memory.dmp

    Filesize

    2.0MB

  • memory/3512-43-0x00007FF887190000-0x00007FF887385000-memory.dmp

    Filesize

    2.0MB

  • memory/3512-40-0x00007FF887190000-0x00007FF887385000-memory.dmp

    Filesize

    2.0MB

  • memory/3512-39-0x00007FF887190000-0x00007FF887385000-memory.dmp

    Filesize

    2.0MB

  • memory/3512-95-0x00007FF887190000-0x00007FF887385000-memory.dmp

    Filesize

    2.0MB

  • memory/3512-96-0x00007FF887190000-0x00007FF887385000-memory.dmp

    Filesize

    2.0MB

  • memory/3512-100-0x00007FF887190000-0x00007FF887385000-memory.dmp

    Filesize

    2.0MB

  • memory/3512-38-0x00007FF847210000-0x00007FF847220000-memory.dmp

    Filesize

    64KB

  • memory/3512-37-0x00007FF847210000-0x00007FF847220000-memory.dmp

    Filesize

    64KB

  • memory/3512-36-0x00007FF887190000-0x00007FF887385000-memory.dmp

    Filesize

    2.0MB

  • memory/3512-35-0x00007FF847210000-0x00007FF847220000-memory.dmp

    Filesize

    64KB

  • memory/3512-140-0x00007FF847210000-0x00007FF847220000-memory.dmp

    Filesize

    64KB

  • memory/3512-141-0x00007FF847210000-0x00007FF847220000-memory.dmp

    Filesize

    64KB

  • memory/3512-142-0x00007FF847210000-0x00007FF847220000-memory.dmp

    Filesize

    64KB

  • memory/3512-143-0x00007FF847210000-0x00007FF847220000-memory.dmp

    Filesize

    64KB

  • memory/3512-144-0x00007FF887190000-0x00007FF887385000-memory.dmp

    Filesize

    2.0MB