Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    102s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/06/2024, 08:47

General

  • Target

    178e519436029b901b83ded9917589340b8419b012ee0507e9228b57d18f9772.exe

  • Size

    15.7MB

  • MD5

    c4dd5810fda942049a7b3c616a12d846

  • SHA1

    be91406efd5ee4660c2bb7f0f202f5b9e7219d9a

  • SHA256

    178e519436029b901b83ded9917589340b8419b012ee0507e9228b57d18f9772

  • SHA512

    58677a57fc41a2a930dc451aa3cdd9f4ca8fac767f4fff5496d1b694b82505ed67547e7d8a242dff8aca3bc5347a50c6fca6a03de1f7ced2ad503174a4171c7f

  • SSDEEP

    393216:TpQDbvtSyNQadsI9Tq6yI1MAaJJGfNE4iuvYi1M:TUjtSyCaKWqhdQlEOd1M

Malware Config

Signatures

  • Executes dropped EXE 13 IoCs
  • Loads dropped DLL 3 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 4 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious use of AdjustPrivilegeToken 25 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\178e519436029b901b83ded9917589340b8419b012ee0507e9228b57d18f9772.exe
    "C:\Users\Admin\AppData\Local\Temp\178e519436029b901b83ded9917589340b8419b012ee0507e9228b57d18f9772.exe"
    1⤵
    • Enumerates connected drives
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4196
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c C:\Temp\UjyQii\\ujysystem.exe /GetBan
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3904
      • C:\Temp\UjyQii\ujysystem.exe
        C:\Temp\UjyQii\\ujysystem.exe /GetBan
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:4008
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c C:\Temp\UjyQii\\ujysystem.exe /GetBan
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4512
      • C:\Temp\UjyQii\ujysystem.exe
        C:\Temp\UjyQii\\ujysystem.exe /GetBan
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1832
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c C:\Temp\UjyQii\\wimlib.EXE apply "C:\Temp\UjyQii\\dism.wim" 1 C:\Temp\UjyQii\dismfqbxp\
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4476
      • C:\Temp\UjyQii\wimlib.EXE
        C:\Temp\UjyQii\\wimlib.EXE apply "C:\Temp\UjyQii\\dism.wim" 1 C:\Temp\UjyQii\dismfqbxp\
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        PID:2332
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c C:\Temp\UjyQii\\Qiibiosinfo.exe --sys
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1180
      • C:\Temp\UjyQii\Qiibiosinfo.exe
        C:\Temp\UjyQii\\Qiibiosinfo.exe --sys
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1624
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c C:\Temp\UjyQii\\Qiibiosinfo.exe --sys
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4824
      • C:\Temp\UjyQii\Qiibiosinfo.exe
        C:\Temp\UjyQii\\Qiibiosinfo.exe --sys
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4576
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c C:\Temp\UjyQii\\Qiibiosinfo.exe --sys
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4996
      • C:\Temp\UjyQii\Qiibiosinfo.exe
        C:\Temp\UjyQii\\Qiibiosinfo.exe --sys
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2092
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c C:\Temp\UjyQii\\QiiPECMD.exe SHOW F:-1
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3828
      • C:\Temp\UjyQii\QiiPECMD.exe
        C:\Temp\UjyQii\\QiiPECMD.exe SHOW F:-1
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Suspicious use of AdjustPrivilegeToken
        PID:4464
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c "C:\Temp\UjyQii\\cxdir.exe" -mohong
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2916
      • C:\Temp\UjyQii\cxdir.exe
        C:\Temp\UjyQii\\cxdir.exe -mohong
        3⤵
        • Executes dropped EXE
        • Writes to the Master Boot Record (MBR)
        PID:5008
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c "C:\Temp\UjyQii\\cxdir.exe" -mohong
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:680
      • C:\Temp\UjyQii\cxdir.exe
        C:\Temp\UjyQii\\cxdir.exe -mohong
        3⤵
        • Executes dropped EXE
        • Writes to the Master Boot Record (MBR)
        PID:3584
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c "C:\Temp\UjyQii\\cxdir.exe" -mohong
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4412
      • C:\Temp\UjyQii\cxdir.exe
        C:\Temp\UjyQii\\cxdir.exe -mohong
        3⤵
        • Executes dropped EXE
        • Writes to the Master Boot Record (MBR)
        PID:2680
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c "C:\Temp\UjyQii\\cxdir.exe" -mohong
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1676
      • C:\Temp\UjyQii\cxdir.exe
        C:\Temp\UjyQii\\cxdir.exe -mohong
        3⤵
        • Executes dropped EXE
        • Writes to the Master Boot Record (MBR)
        PID:3132
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c C:\Temp\UjyQii\\wimlib.EXE info "" --extract-xml C:\Temp\UjyQii\\WimlibKQD.xml
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2824
      • C:\Temp\UjyQii\wimlib.EXE
        C:\Temp\UjyQii\\wimlib.EXE info "" --extract-xml C:\Temp\UjyQii\\WimlibKQD.xml
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        PID:2840
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c C:\Temp\UjyQii\\wimlib.EXE info "C:\Recovery\WindowsRE\Winre.wim" --header
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3924
      • C:\Temp\UjyQii\wimlib.EXE
        C:\Temp\UjyQii\\wimlib.EXE info "C:\Recovery\WindowsRE\Winre.wim" --header
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        PID:4732

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Temp\UjyQii\QiiImagex.EXE

    Filesize

    845KB

    MD5

    dcd13e8935cd5a235d6d3124fc9d8bc2

    SHA1

    41426a7d1c5932ac6853186e41797f94c043e7dc

    SHA256

    3d68842a89267810e4fbfa73e57d4a6519ae3269190c066cfab3e7650542465e

    SHA512

    c06569b6080161d26776cda16aadcb5b8c5038b1809d57bc5c6c016710736368ab4f658c6d7b71fbfafb945b045d69c5f89592b537a048458622e521da1f7c5e

  • C:\Temp\UjyQii\QiiPECMD.exe

    Filesize

    1.3MB

    MD5

    99007d06809fc6e424490f02657cb1d6

    SHA1

    7bfb1077c82a08509360fbcf3e65b4799504d332

    SHA256

    4f31fe97180c161aacfa5b1900ceeec2073a20ebe6b33c0a2ae807cb09441565

    SHA512

    5beb2bba290aab47fb4cc1a65ea12e8a0efb4965a25f0700db7f6de2cbd175ce6cb40cbe713d5bc551c484e8030da85b946e625200fcae0841000ea9ea153958

  • C:\Temp\UjyQii\Qiibiosinfo.exe

    Filesize

    163KB

    MD5

    16d6dffcdedb07cc5d904418116f7342

    SHA1

    2d2a4eae6812509278d0972dcf1d2bee92d4f862

    SHA256

    9b4f7ffa79f80af1bc81f5996562894f346ff20231af54082d68a75b0c3b9a40

    SHA512

    f0ffe189894a8468083349c49dd38f8ad543b29cb504f2a048d75b95971c6133ba3a75ed717c83ad26d98fbf238c7681ec2f9a7928840474175497f847c46749

  • C:\Temp\UjyQii\config.dll

    Filesize

    3KB

    MD5

    36db1085052f53a07453c523d052d842

    SHA1

    278d26d19add905a5c27f9ee59bc1d161981b272

    SHA256

    9edc079f124da1ad8b79fca3cf877113a3ce91b4e63b47f7685c07f238d68596

    SHA512

    88122290ec663e7b750fe27136863105f85c0d4bf51503b142c6086862e39acb4e469d6a8f2da268841994be4066562dbd5cd7746825bbe900c7a491a18c4b2d

  • C:\Temp\UjyQii\cxdir.exe

    Filesize

    42KB

    MD5

    2aa80509e9840822a3b6799a356efe90

    SHA1

    3dc558c97b209c91b7b45f90624f80c05c9094d0

    SHA256

    301ccb6e3f8a5118d7882963715e215140f0b7528039cab3fcd7ace02a48da0d

    SHA512

    9d4e5f95ef444424857e55c345d56ac679005a0bdfddf59fb96f078a5913e7be5ba07cd16993878815dc9d2364d909f20d8b7d65b09bd2ec687622f5812c6bc2

  • C:\Temp\UjyQii\dism.wim

    Filesize

    3.1MB

    MD5

    cd6a67b7fa1958f0b6879009f38c3e3b

    SHA1

    f92f534dd6c7ba3d9edd7bec292d0a489afbe50c

    SHA256

    14e348aa7e8dcd4094993102a09e8309ea8f327d57febd73034b19f792cf6090

    SHA512

    225fc4d92976cc1236db77215a36a3a1977ac396c8146cd54a5984569483d3c96d6f345c07d961b5318d4d1dd85b1a7096cd091b2e5bce3a5cdbb774604109b8

  • C:\Temp\UjyQii\dismfqbxp\X64\dism.exe

    Filesize

    329KB

    MD5

    f350e791f2ed95fb4a6fc50a0ea32b37

    SHA1

    472a3de24cd10913354798d51082d20fb166b2b1

    SHA256

    3c63ddb1e3f10ad6aa96ad7e35a080495e32cd748dbdbc0460f3f93beeee6b7f

    SHA512

    4b50aa71bec1aea7e18bd6b4c930942f513e2e8f55e7de217e5f7e19e0363f8f202dd75c9efb4a9b3f5046a90315a99614595ca13fffc4b3c80f9e2a44f5f51b

  • C:\Temp\UjyQii\libwim-15.dll

    Filesize

    775KB

    MD5

    6be0d3c865f445afc1210a79e1db7ca3

    SHA1

    99def6bccb1a32cf022ee574d1ef11a67d34c452

    SHA256

    dd6e34893bdc4719f7d24a7dfb438d4f2caf048a0a2123a840249432d854626f

    SHA512

    a01bd43e8ba810973a884f534fcd931201423f2facfc2f5c48db9cefff0e680d8020be4bc771b22610937cf88fd2b33070d15e48ba2a07a319436dd78223869b

  • C:\Temp\UjyQii\ujysystem.exe

    Filesize

    833KB

    MD5

    dec5ca26876a565fc8385e18cdf7146f

    SHA1

    44964b076be3c1f1d3b8f57553791fb7d9cf71dd

    SHA256

    42a2c19262795cccc5dcb3c5ffd17bb2b07f5da5a8fda14f965deb9419140a2a

    SHA512

    efe166e3b481a1bac027c386853e7e6ab9e531e981e2bf74b513d1a81c17cafe75c0850211e72beacd3f514961b072e83ba17a886d7700a45e6352a84c50068e

  • C:\Temp\UjyQii\wimlib.EXE

    Filesize

    135KB

    MD5

    b31b05e78bc60474cc511974b8ebd63e

    SHA1

    48de3c65d7c5544b78322d32aaef8492c889a5f5

    SHA256

    102e24cb2e77b8354658924be1e9b2597cee215409539dfc2e19f14d3cd2b1a1

    SHA512

    0f25754551de7168494f78d1e3264a007177591d767662b1dfda80b4156cfedf2e9ea2f437e0b212197e9509b6cde06e2c80f550db42a321347eaf1a973bed32

  • memory/1624-189-0x00007FF6B9AC0000-0x00007FF6BB291000-memory.dmp

    Filesize

    23.8MB

  • memory/1624-223-0x00007FF6B9AC0000-0x00007FF6BB291000-memory.dmp

    Filesize

    23.8MB

  • memory/1624-190-0x00007FF6B9AC0000-0x00007FF6BB291000-memory.dmp

    Filesize

    23.8MB

  • memory/1832-14-0x0000000000400000-0x0000000000630000-memory.dmp

    Filesize

    2.2MB

  • memory/1832-18-0x0000000000400000-0x0000000000630000-memory.dmp

    Filesize

    2.2MB

  • memory/1832-17-0x0000000000400000-0x0000000000630000-memory.dmp

    Filesize

    2.2MB

  • memory/2092-195-0x00007FF6B9AC0000-0x00007FF6BB291000-memory.dmp

    Filesize

    23.8MB

  • memory/2332-139-0x00007FFFADBA0000-0x00007FFFADC8A000-memory.dmp

    Filesize

    936KB

  • memory/2332-138-0x00007FF743ED0000-0x00007FF743EFA000-memory.dmp

    Filesize

    168KB

  • memory/2680-206-0x0000000000400000-0x0000000000410000-memory.dmp

    Filesize

    64KB

  • memory/2840-213-0x00007FF743ED0000-0x00007FF743EFA000-memory.dmp

    Filesize

    168KB

  • memory/2840-214-0x00007FFFADBA0000-0x00007FFFADC8A000-memory.dmp

    Filesize

    936KB

  • memory/3132-208-0x0000000000400000-0x0000000000410000-memory.dmp

    Filesize

    64KB

  • memory/3584-204-0x0000000000400000-0x0000000000410000-memory.dmp

    Filesize

    64KB

  • memory/4008-10-0x0000000000400000-0x0000000000630000-memory.dmp

    Filesize

    2.2MB

  • memory/4008-6-0x0000000000400000-0x0000000000630000-memory.dmp

    Filesize

    2.2MB

  • memory/4008-7-0x0000000000400000-0x0000000000630000-memory.dmp

    Filesize

    2.2MB

  • memory/4008-9-0x0000000000400000-0x0000000000630000-memory.dmp

    Filesize

    2.2MB

  • memory/4196-15-0x0000000002E7E000-0x0000000002E7F000-memory.dmp

    Filesize

    4KB

  • memory/4196-0-0x0000000000400000-0x0000000002E99000-memory.dmp

    Filesize

    42.6MB

  • memory/4196-222-0x0000000000400000-0x0000000002E99000-memory.dmp

    Filesize

    42.6MB

  • memory/4196-8-0x0000000000400000-0x0000000002E99000-memory.dmp

    Filesize

    42.6MB

  • memory/4196-16-0x0000000000400000-0x0000000002E99000-memory.dmp

    Filesize

    42.6MB

  • memory/4196-217-0x0000000000400000-0x0000000002E99000-memory.dmp

    Filesize

    42.6MB

  • memory/4196-1-0x0000000002E7E000-0x0000000002E7F000-memory.dmp

    Filesize

    4KB

  • memory/4576-225-0x00007FF6B9AC0000-0x00007FF6BB291000-memory.dmp

    Filesize

    23.8MB

  • memory/4576-193-0x00007FF6B9AC0000-0x00007FF6BB291000-memory.dmp

    Filesize

    23.8MB

  • memory/4576-192-0x00007FF6B9AC0000-0x00007FF6BB291000-memory.dmp

    Filesize

    23.8MB

  • memory/4732-221-0x00007FFFADBA0000-0x00007FFFADC8A000-memory.dmp

    Filesize

    936KB

  • memory/4732-220-0x00007FF743ED0000-0x00007FF743EFA000-memory.dmp

    Filesize

    168KB

  • memory/5008-202-0x0000000000400000-0x0000000000410000-memory.dmp

    Filesize

    64KB