Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
14/05/2024, 02:18
Static task
static1
Behavioral task
behavioral1
Sample
76664c6018506cd76f461cb245004689a64f83e5592738062f5c91720f06fe3d.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
76664c6018506cd76f461cb245004689a64f83e5592738062f5c91720f06fe3d.exe
Resource
win10v2004-20240508-en
General
-
Target
76664c6018506cd76f461cb245004689a64f83e5592738062f5c91720f06fe3d.exe
-
Size
152KB
-
MD5
e8006c0efa0058b3f5afc8b53a06ff4b
-
SHA1
58ed7fa42e310a85556c3454fa286f59387381d8
-
SHA256
76664c6018506cd76f461cb245004689a64f83e5592738062f5c91720f06fe3d
-
SHA512
16da8cedba205cab6f3bb184bb4f1466e71d840f2e30741ce2343a68c9349ce407a8f42d6dffc8aba078add80cf188432802bbcf5f9c4dce12dd77abfdeff8ed
-
SSDEEP
3072:oZpYg19EeiLLmjempGuCYooEK1JWaCItULG3rt2Wcora4dIC:OPjEl6jLiQ1JW+Oy3p/n
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x0008000000023320-11.dat acprotect -
Deletes itself 1 IoCs
pid Process 2080 qvtys.exe -
Executes dropped EXE 2 IoCs
pid Process 2080 qvtys.exe 2996 uni.exe -
Loads dropped DLL 1 IoCs
pid Process 2996 uni.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Linycpy = "c:\\Program Files\\ywosj\\uni.exe \"c:\\Program Files\\ywosj\\uniuw.dll\",SetHandle" uni.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\s: uni.exe File opened (read-only) \??\t: uni.exe File opened (read-only) \??\y: uni.exe File opened (read-only) \??\a: uni.exe File opened (read-only) \??\h: uni.exe File opened (read-only) \??\i: uni.exe File opened (read-only) \??\n: uni.exe File opened (read-only) \??\v: uni.exe File opened (read-only) \??\x: uni.exe File opened (read-only) \??\j: uni.exe File opened (read-only) \??\m: uni.exe File opened (read-only) \??\p: uni.exe File opened (read-only) \??\q: uni.exe File opened (read-only) \??\w: uni.exe File opened (read-only) \??\z: uni.exe File opened (read-only) \??\b: uni.exe File opened (read-only) \??\g: uni.exe File opened (read-only) \??\k: uni.exe File opened (read-only) \??\r: uni.exe File opened (read-only) \??\e: uni.exe File opened (read-only) \??\l: uni.exe File opened (read-only) \??\o: uni.exe File opened (read-only) \??\u: uni.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PHYSICALDRIVE0 uni.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification \??\c:\Program Files\ywosj\uni.exe qvtys.exe File opened for modification \??\c:\Program Files\ywosj qvtys.exe File created \??\c:\Program Files\ywosj\uniuw.dll qvtys.exe File created \??\c:\Program Files\ywosj\uni.exe qvtys.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 uni.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString uni.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 552 PING.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2996 uni.exe 2996 uni.exe 2996 uni.exe 2996 uni.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2996 uni.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 708 76664c6018506cd76f461cb245004689a64f83e5592738062f5c91720f06fe3d.exe 2080 qvtys.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 708 wrote to memory of 2408 708 76664c6018506cd76f461cb245004689a64f83e5592738062f5c91720f06fe3d.exe 93 PID 708 wrote to memory of 2408 708 76664c6018506cd76f461cb245004689a64f83e5592738062f5c91720f06fe3d.exe 93 PID 708 wrote to memory of 2408 708 76664c6018506cd76f461cb245004689a64f83e5592738062f5c91720f06fe3d.exe 93 PID 2408 wrote to memory of 552 2408 cmd.exe 95 PID 2408 wrote to memory of 552 2408 cmd.exe 95 PID 2408 wrote to memory of 552 2408 cmd.exe 95 PID 2408 wrote to memory of 2080 2408 cmd.exe 99 PID 2408 wrote to memory of 2080 2408 cmd.exe 99 PID 2408 wrote to memory of 2080 2408 cmd.exe 99 PID 2080 wrote to memory of 2996 2080 qvtys.exe 100 PID 2080 wrote to memory of 2996 2080 qvtys.exe 100 PID 2080 wrote to memory of 2996 2080 qvtys.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\76664c6018506cd76f461cb245004689a64f83e5592738062f5c91720f06fe3d.exe"C:\Users\Admin\AppData\Local\Temp\76664c6018506cd76f461cb245004689a64f83e5592738062f5c91720f06fe3d.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:708 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 -n 2&C:\Users\Admin\AppData\Local\Temp\\qvtys.exe "C:\Users\Admin\AppData\Local\Temp\76664c6018506cd76f461cb245004689a64f83e5592738062f5c91720f06fe3d.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 23⤵
- Runs ping.exe
PID:552
-
-
C:\Users\Admin\AppData\Local\Temp\qvtys.exeC:\Users\Admin\AppData\Local\Temp\\qvtys.exe "C:\Users\Admin\AppData\Local\Temp\76664c6018506cd76f461cb245004689a64f83e5592738062f5c91720f06fe3d.exe"3⤵
- Deletes itself
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\Program Files\ywosj\uni.exe"c:\Program Files\ywosj\uni.exe" "c:\Program Files\ywosj\uniuw.dll",SetHandle C:\Users\Admin\AppData\Local\Temp\qvtys.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2996
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4028,i,10373433614523925616,13586256558317053467,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:81⤵PID:3160
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD5889b99c52a60dd49227c5e485a016679
SHA18fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA2566cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
SHA51208933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641
-
Filesize
152KB
MD5d32d15aadeb7e0bc81a5ea1edaf49cdb
SHA1c279e70760f93a1b62afc99a210e917be129f079
SHA25698991368ec14a8e4509d97623c6fb3e81e1fe62bb852d1c01c426dd021fa6b4e
SHA51250cc948d3b809d7de449f4e4ccb48d82eb476b9a955759ac50969e995d962bca9b69b6b9d72342e338b3cdf6f69c834644906862087757daafecb2b62e548073
-
Filesize
128KB
MD586377bfa1b6651ec3f67c616092e1c62
SHA194f5267201a0600b5294f40feeb0a6aaf8ce307d
SHA25693ccdf1660e3fbbdf8ffbac2c06a6223dfddf60b838b35cd69c000c5b1537390
SHA512cba3689b45a6f08d21d51e6884014f5cbdc410809975d932cdfed58b7b09b67aae05e6cd68a15d53f56d7e85826d957c0ef9ff7d07c7cfc00fcdfaad8b6a5d19