Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    25/06/2024, 08:47

General

  • Target

    178e519436029b901b83ded9917589340b8419b012ee0507e9228b57d18f9772.exe

  • Size

    15.7MB

  • MD5

    c4dd5810fda942049a7b3c616a12d846

  • SHA1

    be91406efd5ee4660c2bb7f0f202f5b9e7219d9a

  • SHA256

    178e519436029b901b83ded9917589340b8419b012ee0507e9228b57d18f9772

  • SHA512

    58677a57fc41a2a930dc451aa3cdd9f4ca8fac767f4fff5496d1b694b82505ed67547e7d8a242dff8aca3bc5347a50c6fca6a03de1f7ced2ad503174a4171c7f

  • SSDEEP

    393216:TpQDbvtSyNQadsI9Tq6yI1MAaJJGfNE4iuvYi1M:TUjtSyCaKWqhdQlEOd1M

Malware Config

Signatures

  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 20 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies boot configuration data using bcdedit 3 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 4 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious behavior: CmdExeWriteProcessMemorySpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\178e519436029b901b83ded9917589340b8419b012ee0507e9228b57d18f9772.exe
    "C:\Users\Admin\AppData\Local\Temp\178e519436029b901b83ded9917589340b8419b012ee0507e9228b57d18f9772.exe"
    1⤵
    • Loads dropped DLL
    • Enumerates connected drives
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2924
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c C:\Windows\sysnative\bcdedit.exe /enum {current}
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2436
      • C:\Windows\system32\bcdedit.exe
        C:\Windows\sysnative\bcdedit.exe /enum {current}
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:2568
    • C:\Windows\system32\cmd.exe
      cmd.exe /c C:\Temp\UjyQii\\ujysystem.exe /GetBan
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2956
      • C:\Temp\UjyQii\ujysystem.exe
        C:\Temp\UjyQii\\ujysystem.exe /GetBan
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: CmdExeWriteProcessMemorySpam
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2968
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c C:\Windows\sysnative\bcdedit.exe /enum {current}
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2532
          • C:\Windows\system32\bcdedit.exe
            C:\Windows\sysnative\bcdedit.exe /enum {current}
            5⤵
            • Modifies boot configuration data using bcdedit
            PID:2644
    • C:\Windows\system32\cmd.exe
      cmd.exe /c C:\Temp\UjyQii\\ujysystem.exe /GetBan
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2400
      • C:\Temp\UjyQii\ujysystem.exe
        C:\Temp\UjyQii\\ujysystem.exe /GetBan
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: CmdExeWriteProcessMemorySpam
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1648
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c C:\Windows\sysnative\bcdedit.exe /enum {current}
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1772
          • C:\Windows\system32\bcdedit.exe
            C:\Windows\sysnative\bcdedit.exe /enum {current}
            5⤵
            • Modifies boot configuration data using bcdedit
            PID:2420
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c C:\Temp\UjyQii\\wimlib.EXE apply "C:\Temp\UjyQii\\dism.wim" 1 C:\Temp\UjyQii\dismprgvr\
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1204
      • C:\Temp\UjyQii\wimlib.EXE
        C:\Temp\UjyQii\\wimlib.EXE apply "C:\Temp\UjyQii\\dism.wim" 1 C:\Temp\UjyQii\dismprgvr\
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        PID:1360
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c C:\Temp\UjyQii\\Qiibiosinfo.exe --sys
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:900
      • C:\Temp\UjyQii\Qiibiosinfo.exe
        C:\Temp\UjyQii\\Qiibiosinfo.exe --sys
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2316
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c C:\Temp\UjyQii\\Qiibiosinfo.exe --sys
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1924
      • C:\Temp\UjyQii\Qiibiosinfo.exe
        C:\Temp\UjyQii\\Qiibiosinfo.exe --sys
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2232
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c C:\Temp\UjyQii\\Qiibiosinfo.exe --sys
      2⤵
        PID:2176
        • C:\Temp\UjyQii\Qiibiosinfo.exe
          C:\Temp\UjyQii\\Qiibiosinfo.exe --sys
          3⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:2984
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c C:\Temp\UjyQii\\QiiPECMD.exe SHOW F:-1
        2⤵
        • Loads dropped DLL
        PID:2312
        • C:\Temp\UjyQii\QiiPECMD.exe
          C:\Temp\UjyQii\\QiiPECMD.exe SHOW F:-1
          3⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Suspicious use of AdjustPrivilegeToken
          PID:884
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c "C:\Temp\UjyQii\\cxdir.exe" -mohong
        2⤵
        • Loads dropped DLL
        PID:2076
        • C:\Temp\UjyQii\cxdir.exe
          C:\Temp\UjyQii\\cxdir.exe -mohong
          3⤵
          • Executes dropped EXE
          • Writes to the Master Boot Record (MBR)
          PID:1500
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c "C:\Temp\UjyQii\\cxdir.exe" -mohong
        2⤵
        • Loads dropped DLL
        PID:2280
        • C:\Temp\UjyQii\cxdir.exe
          C:\Temp\UjyQii\\cxdir.exe -mohong
          3⤵
          • Executes dropped EXE
          • Writes to the Master Boot Record (MBR)
          PID:2784
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c "C:\Temp\UjyQii\\cxdir.exe" -mohong
        2⤵
        • Loads dropped DLL
        PID:2492
        • C:\Temp\UjyQii\cxdir.exe
          C:\Temp\UjyQii\\cxdir.exe -mohong
          3⤵
          • Executes dropped EXE
          • Writes to the Master Boot Record (MBR)
          PID:2624
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c "C:\Temp\UjyQii\\cxdir.exe" -mohong
        2⤵
        • Loads dropped DLL
        PID:2636
        • C:\Temp\UjyQii\cxdir.exe
          C:\Temp\UjyQii\\cxdir.exe -mohong
          3⤵
          • Executes dropped EXE
          • Writes to the Master Boot Record (MBR)
          PID:2632
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c C:\Temp\UjyQii\\wimlib.EXE info "" --extract-xml C:\Temp\UjyQii\\WimlibKQD.xml
        2⤵
        • Loads dropped DLL
        PID:2736
        • C:\Temp\UjyQii\wimlib.EXE
          C:\Temp\UjyQii\\wimlib.EXE info "" --extract-xml C:\Temp\UjyQii\\WimlibKQD.xml
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of AdjustPrivilegeToken
          PID:2356

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Temp\UjyQii\Qiibiosinfo.exe

      Filesize

      163KB

      MD5

      16d6dffcdedb07cc5d904418116f7342

      SHA1

      2d2a4eae6812509278d0972dcf1d2bee92d4f862

      SHA256

      9b4f7ffa79f80af1bc81f5996562894f346ff20231af54082d68a75b0c3b9a40

      SHA512

      f0ffe189894a8468083349c49dd38f8ad543b29cb504f2a048d75b95971c6133ba3a75ed717c83ad26d98fbf238c7681ec2f9a7928840474175497f847c46749

    • C:\Temp\UjyQii\config.dll

      Filesize

      3KB

      MD5

      36db1085052f53a07453c523d052d842

      SHA1

      278d26d19add905a5c27f9ee59bc1d161981b272

      SHA256

      9edc079f124da1ad8b79fca3cf877113a3ce91b4e63b47f7685c07f238d68596

      SHA512

      88122290ec663e7b750fe27136863105f85c0d4bf51503b142c6086862e39acb4e469d6a8f2da268841994be4066562dbd5cd7746825bbe900c7a491a18c4b2d

    • C:\Temp\UjyQii\cxdir.exe

      Filesize

      42KB

      MD5

      2aa80509e9840822a3b6799a356efe90

      SHA1

      3dc558c97b209c91b7b45f90624f80c05c9094d0

      SHA256

      301ccb6e3f8a5118d7882963715e215140f0b7528039cab3fcd7ace02a48da0d

      SHA512

      9d4e5f95ef444424857e55c345d56ac679005a0bdfddf59fb96f078a5913e7be5ba07cd16993878815dc9d2364d909f20d8b7d65b09bd2ec687622f5812c6bc2

    • C:\Temp\UjyQii\dism.wim

      Filesize

      3.1MB

      MD5

      cd6a67b7fa1958f0b6879009f38c3e3b

      SHA1

      f92f534dd6c7ba3d9edd7bec292d0a489afbe50c

      SHA256

      14e348aa7e8dcd4094993102a09e8309ea8f327d57febd73034b19f792cf6090

      SHA512

      225fc4d92976cc1236db77215a36a3a1977ac396c8146cd54a5984569483d3c96d6f345c07d961b5318d4d1dd85b1a7096cd091b2e5bce3a5cdbb774604109b8

    • C:\Temp\UjyQii\dismprgvr\X64\dism.exe

      Filesize

      329KB

      MD5

      f350e791f2ed95fb4a6fc50a0ea32b37

      SHA1

      472a3de24cd10913354798d51082d20fb166b2b1

      SHA256

      3c63ddb1e3f10ad6aa96ad7e35a080495e32cd748dbdbc0460f3f93beeee6b7f

      SHA512

      4b50aa71bec1aea7e18bd6b4c930942f513e2e8f55e7de217e5f7e19e0363f8f202dd75c9efb4a9b3f5046a90315a99614595ca13fffc4b3c80f9e2a44f5f51b

    • C:\Temp\UjyQii\libwim-15.dll

      Filesize

      775KB

      MD5

      6be0d3c865f445afc1210a79e1db7ca3

      SHA1

      99def6bccb1a32cf022ee574d1ef11a67d34c452

      SHA256

      dd6e34893bdc4719f7d24a7dfb438d4f2caf048a0a2123a840249432d854626f

      SHA512

      a01bd43e8ba810973a884f534fcd931201423f2facfc2f5c48db9cefff0e680d8020be4bc771b22610937cf88fd2b33070d15e48ba2a07a319436dd78223869b

    • C:\Temp\UjyQii\ujysystem.exe

      Filesize

      833KB

      MD5

      dec5ca26876a565fc8385e18cdf7146f

      SHA1

      44964b076be3c1f1d3b8f57553791fb7d9cf71dd

      SHA256

      42a2c19262795cccc5dcb3c5ffd17bb2b07f5da5a8fda14f965deb9419140a2a

      SHA512

      efe166e3b481a1bac027c386853e7e6ab9e531e981e2bf74b513d1a81c17cafe75c0850211e72beacd3f514961b072e83ba17a886d7700a45e6352a84c50068e

    • \Temp\UjyQii\QiiImagex.EXE

      Filesize

      845KB

      MD5

      dcd13e8935cd5a235d6d3124fc9d8bc2

      SHA1

      41426a7d1c5932ac6853186e41797f94c043e7dc

      SHA256

      3d68842a89267810e4fbfa73e57d4a6519ae3269190c066cfab3e7650542465e

      SHA512

      c06569b6080161d26776cda16aadcb5b8c5038b1809d57bc5c6c016710736368ab4f658c6d7b71fbfafb945b045d69c5f89592b537a048458622e521da1f7c5e

    • \Temp\UjyQii\QiiPECMD.exe

      Filesize

      1.3MB

      MD5

      99007d06809fc6e424490f02657cb1d6

      SHA1

      7bfb1077c82a08509360fbcf3e65b4799504d332

      SHA256

      4f31fe97180c161aacfa5b1900ceeec2073a20ebe6b33c0a2ae807cb09441565

      SHA512

      5beb2bba290aab47fb4cc1a65ea12e8a0efb4965a25f0700db7f6de2cbd175ce6cb40cbe713d5bc551c484e8030da85b946e625200fcae0841000ea9ea153958

    • \Temp\UjyQii\wimlib.EXE

      Filesize

      135KB

      MD5

      b31b05e78bc60474cc511974b8ebd63e

      SHA1

      48de3c65d7c5544b78322d32aaef8492c889a5f5

      SHA256

      102e24cb2e77b8354658924be1e9b2597cee215409539dfc2e19f14d3cd2b1a1

      SHA512

      0f25754551de7168494f78d1e3264a007177591d767662b1dfda80b4156cfedf2e9ea2f437e0b212197e9509b6cde06e2c80f550db42a321347eaf1a973bed32

    • memory/900-198-0x0000000002350000-0x0000000003B21000-memory.dmp

      Filesize

      23.8MB

    • memory/1360-140-0x000000013FC30000-0x000000013FC5A000-memory.dmp

      Filesize

      168KB

    • memory/1360-141-0x000007FEF7160000-0x000007FEF724A000-memory.dmp

      Filesize

      936KB

    • memory/1500-212-0x0000000000400000-0x0000000000410000-memory.dmp

      Filesize

      64KB

    • memory/1648-19-0x0000000000400000-0x0000000000630000-memory.dmp

      Filesize

      2.2MB

    • memory/1648-13-0x0000000000400000-0x0000000000630000-memory.dmp

      Filesize

      2.2MB

    • memory/1648-15-0x0000000000400000-0x0000000000630000-memory.dmp

      Filesize

      2.2MB

    • memory/2232-201-0x000000013F5E0000-0x0000000140DB1000-memory.dmp

      Filesize

      23.8MB

    • memory/2316-197-0x000000013F790000-0x0000000140F61000-memory.dmp

      Filesize

      23.8MB

    • memory/2356-228-0x000007FEF6760000-0x000007FEF684A000-memory.dmp

      Filesize

      936KB

    • memory/2356-227-0x000000013F910000-0x000000013F93A000-memory.dmp

      Filesize

      168KB

    • memory/2624-218-0x0000000000400000-0x0000000000410000-memory.dmp

      Filesize

      64KB

    • memory/2632-221-0x0000000000400000-0x0000000000410000-memory.dmp

      Filesize

      64KB

    • memory/2784-215-0x0000000000400000-0x0000000000410000-memory.dmp

      Filesize

      64KB

    • memory/2924-14-0x0000000000400000-0x0000000002E99000-memory.dmp

      Filesize

      42.6MB

    • memory/2924-5-0x0000000000400000-0x0000000002E99000-memory.dmp

      Filesize

      42.6MB

    • memory/2924-0-0x0000000000400000-0x0000000002E99000-memory.dmp

      Filesize

      42.6MB

    • memory/2924-231-0x0000000000400000-0x0000000002E99000-memory.dmp

      Filesize

      42.6MB

    • memory/2924-232-0x0000000000400000-0x0000000002E99000-memory.dmp

      Filesize

      42.6MB

    • memory/2968-4-0x0000000000400000-0x0000000000630000-memory.dmp

      Filesize

      2.2MB

    • memory/2968-9-0x0000000000400000-0x0000000000630000-memory.dmp

      Filesize

      2.2MB

    • memory/2968-6-0x0000000000400000-0x0000000000630000-memory.dmp

      Filesize

      2.2MB

    • memory/2984-204-0x000000013F750000-0x0000000140F21000-memory.dmp

      Filesize

      23.8MB