Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

34de2818f6...54.exe

windows7-x64

10

34de2818f6...54.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    04/06/2024, 20:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    34de2818f6f0aeaeddce9ba8486e411976cb5c3bf8484309f5b23b4c929d6454.exe

  • Size

    484KB

  • MD5

    020047a12b1f54be1a7fb62d2715f1aa

  • SHA1

    91713461fce6a8635291b65bf0af8fbe30eb7c66

  • SHA256

    34de2818f6f0aeaeddce9ba8486e411976cb5c3bf8484309f5b23b4c929d6454

  • SHA512

    00207e74bb8390ca8b15f7a10ef8aa03734a1637abd22539049cba2cc5e3edfcffab8951ba0c5f56927aea098cf5ab4b243dc676d757b022f032a9e2f03c95e0

  • SSDEEP

    12288:QgkDxdkL+6JNgKVcRa+fpHyWs3OBH4pUm:2xsKXa+hHyWseBg/

Score
10/10
evasionpersistencetrojan

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 4 IoCs
    persistence
  • UAC bypass 3 TTPs 13 IoCs
    evasiontrojan
  • Adds policy Run key to start application 2 TTPs 27 IoCs
    persistence
  • Disables RegEdit via registry modification 6 IoCs
    evasion
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 8 IoCs
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 8 IoCs
    evasiontrojan
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops autorun.inf file 1 TTPs 4 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 32 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 32 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs
  • System policy modification 1 TTPs 41 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\34de2818f6f0aeaeddce9ba8486e411976cb5c3bf8484309f5b23b4c929d6454.exe
    "C:\Users\Admin\AppData\Local\Temp\34de2818f6f0aeaeddce9ba8486e411976cb5c3bf8484309f5b23b4c929d6454.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2192
    • C:\Users\Admin\AppData\Local\Temp\bwztizaelgj.exe
      "C:\Users\Admin\AppData\Local\Temp\bwztizaelgj.exe" "c:\users\admin\appdata\local\temp\34de2818f6f0aeaeddce9ba8486e411976cb5c3bf8484309f5b23b4c929d6454.exe*"
      2⤵
      • Modifies WinLogon for persistence
      • UAC bypass
      • Adds policy Run key to start application
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2144
      • C:\Users\Admin\AppData\Local\Temp\bdmxcdr.exe
        "C:\Users\Admin\AppData\Local\Temp\bdmxcdr.exe" "-C:\Users\Admin\AppData\Local\Temp\aldxlvshvuucbvrx.exe"
        3⤵
        • Modifies WinLogon for persistence
        • UAC bypass
        • Adds policy Run key to start application
        • Disables RegEdit via registry modification
        • Executes dropped EXE
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Drops autorun.inf file
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • System policy modification
        PID:2436
      • C:\Users\Admin\AppData\Local\Temp\bdmxcdr.exe
        "C:\Users\Admin\AppData\Local\Temp\bdmxcdr.exe" "-C:\Users\Admin\AppData\Local\Temp\aldxlvshvuucbvrx.exe"
        3⤵
        • Modifies WinLogon for persistence
        • UAC bypass
        • Adds policy Run key to start application
        • Disables RegEdit via registry modification
        • Executes dropped EXE
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System policy modification
        PID:2444
    • C:\Users\Admin\AppData\Local\Temp\bwztizaelgj.exe
      "C:\Users\Admin\AppData\Local\Temp\bwztizaelgj.exe" "c:\users\admin\appdata\local\temp\34de2818f6f0aeaeddce9ba8486e411976cb5c3bf8484309f5b23b4c929d6454.exe"
      2⤵
      • Modifies WinLogon for persistence
      • UAC bypass
      • Adds policy Run key to start application
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System policy modification
      PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Winlogon Helper DLL

1
T1547.004

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Winlogon Helper DLL

1
T1547.004

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Modify Registry

5
T1112

Credential Access

Discovery

System Information Discovery

2
T1082

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\fzadatzxuclcknshzoijm.cig
    Filesize

    272B

    MD5

    bd94d1a6e0d642497b0a8f2f7c267858

    SHA1

    7fe60412735c50167945fe9131d54e04d1671537

    SHA256

    8845fe1762739fdb24330a3fd6be2cff78a6fedd5775ef091c2b431fa33268bf

    SHA512

    3d35c237956bf4ec3cf91e89a161a083bea8b69d6722a0eb62ce073cd50182d88b25470cb5c0ba61f488d0102f0d083972e8a17ab575fa794c138c3f3905cad5

    Download Submit

  • C:\Program Files (x86)\fzadatzxuclcknshzoijm.cig
    Filesize

    272B

    MD5

    9ef6f6a35ef51374565263d8ee8fa596

    SHA1

    67da6aa01fe456a4f2e21b46b0c61cfe97c8d5bb

    SHA256

    6df4cb2c3ddfe7c36e12cfec5508c78ef35f9a488531a1d495886933c40da99e

    SHA512

    36df4e2f0721504b313c3afd51fb11a9f6c0f80436e661acc116466c204eebd3b432a30dcaf276b47b9dbe8ebe730e3b51b5162f1d42cc9c7433c230c77d1dc5

    Download Submit

  • C:\Program Files (x86)\fzadatzxuclcknshzoijm.cig
    Filesize

    272B

    MD5

    a915eba39c912103352650c329013542

    SHA1

    28b6e3d6fc9a691a11f664a5517ea6a25c036cac

    SHA256

    577a1e17d3d591361bea38c905ad724a898cfa0b8376f91b47cff5e9ea08e37e

    SHA512

    23dcaef85854b15242b0f75d96b629e1e8041e0abd4051f14bbc3de53601d2ab57f9656fe482c2e23ff894a1c863c48381367cd623d6da10e43504d646b54be2

    Download Submit

  • C:\Program Files (x86)\fzadatzxuclcknshzoijm.cig
    Filesize

    272B

    MD5

    760209cf55fc2b8d40eee9ea7fb521e9

    SHA1

    0ba59696a9a54c0a7e92d5e00f630689fee74eb5

    SHA256

    c5dcafb938913b122fa3303705c2fa83218889880d254e78e109d57fc56f667f

    SHA512

    e69703aab068fb6c0174ea49115082d17397838a1ab04c4f02ceae842029048d57fb578b23e6247b97dba8c87e2cabb996c9efd34babe0c98ad5bd8ba366216a

    Download Submit

  • C:\Users\Admin\AppData\Local\afrfnrirzsmohvllootftbfwfngacvjz.cch
    Filesize

    3KB

    MD5

    cdb663de2c95845d6c701ce48ca570da

    SHA1

    c4cf8367d4f3cabb0dcdf748a3fdb818caf48219

    SHA256

    8cf420dfff7f54a8e5eaa4fb5a4a0f2dbc0ac7ca714476d337a002226a9a2d25

    SHA512

    f285405ad38a0016ab5ba49166d2c1dd8800220fb078eb8c81ce7ea2bbd5555bc7bcb89433b1fe8119922d21fe1407bae77995f2e2947919cfab9e97ad3904ee

    Download Submit

  • C:\Users\Admin\AppData\Local\fzadatzxuclcknshzoijm.cig
    Filesize

    272B

    MD5

    b9496e1de224c25f6d414f7802716827

    SHA1

    d01f4e0cf0cc6b94081b8bce2d3187f02848b266

    SHA256

    28b01da608a5d6bfc240c8572b3eeb658d5c92549b01b14c1d891c938b338951

    SHA512

    9d117ef2818ca0276c5c1f4243eccb806d3f5d233ee2daf62aa2cef983aefbc81717951f09778f21129fcc5fc3fa91b7c28bcee29bf9cda43d2f28e04f9b0d6b

    Download Submit

  • C:\Users\Admin\AppData\Local\fzadatzxuclcknshzoijm.cig
    Filesize

    272B

    MD5

    dd1cbaaa95ed56ea3fad30c97986f1ac

    SHA1

    28fed2b6c2e37af42aa27018d2471b81f5707be8

    SHA256

    daa11ccdc5eb0e381d88f8e215f24a294aaa91d1f785980a8af36d897d141711

    SHA512

    afa6591ddba17c3179630d79891e1a40dbc41e187d912e5c49a86d4d66b09254c1365bc846cb0e354fe2fc53ad30ce58ac24132e8fb3b8831908586d7df7ca1a

    Download Submit

  • C:\Users\Admin\AppData\Local\fzadatzxuclcknshzoijm.cig
    Filesize

    272B

    MD5

    e942c4d76e9a67a5dfa2ac240013bc89

    SHA1

    3bad1487874c07ddabbea637105430f62a89faf1

    SHA256

    cf5a7f44dd7d5222f9fc8cf0217de769039bf90ca089c77de0356df4904d1e4f

    SHA512

    a53b51302f4639fad76c4fe5cf88615033b3131fa5e66521526e72e8e7262e6262b75b74504fb163babe4e7ac3e1b755abed677785a737af3f7b1e3a39123a7c

    Download Submit

  • C:\Windows\SysWOW64\qdxtjvulbceopljrck.exe
    Filesize

    484KB

    MD5

    020047a12b1f54be1a7fb62d2715f1aa

    SHA1

    91713461fce6a8635291b65bf0af8fbe30eb7c66

    SHA256

    34de2818f6f0aeaeddce9ba8486e411976cb5c3bf8484309f5b23b4c929d6454

    SHA512

    00207e74bb8390ca8b15f7a10ef8aa03734a1637abd22539049cba2cc5e3edfcffab8951ba0c5f56927aea098cf5ab4b243dc676d757b022f032a9e2f03c95e0

    Download Submit

  • \Users\Admin\AppData\Local\Temp\bdmxcdr.exe
    Filesize

    724KB

    MD5

    7b7ec3acc78fd47a0dd1acb44edacf3e

    SHA1

    a6e5d1249f586e8f2938a5af680cc91c80d7e630

    SHA256

    ca908bfa8cc5071fc09330e9d81ea688e6e1c2dea52966c3f075bc1bdc74630a

    SHA512

    f376b52ea67323f6904ddbd7eb921f2811dda647882d03020d8b88d7f211d297def718bfab824e8d749899d26420b34a4479dcfcd1ca6177ba9693e3c49d0fdf

    Download Submit

  • \Users\Admin\AppData\Local\Temp\bwztizaelgj.exe
    Filesize

    320KB

    MD5

    1dd5dd5561723f37ccc81e15ecdbf830

    SHA1

    eeb9131c8d276ceb710d163e89fdc62b3e111971

    SHA256

    c8c542ac3f6526d1501c2b9d6262bfa029a1ac0d9dd6b3c1965977abdd8bd126

    SHA512

    b4881d7cd0c2ceeba067e13d23763e739389108d1269acd6c343dd308aa1fedde89da696a8482944342f44ea1094ea6b50021a15d4c6d03762ba032a9598bba5

    Download Submit