Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    122s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/10/2024, 21:12

General

  • Target

    eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734dN.exe

  • Size

    512KB

  • MD5

    d8f727185707eeac395c1761e2b34320

  • SHA1

    a2779fe447275984460d5139b4cdbd38f69d1fe1

  • SHA256

    eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734d

  • SHA512

    08cb5ed658412310e7b65361d7361a057fa131ead5db7389bf581a1ae8f9ebf782c531485c7649b9a8889ab6abfa1486fe8cfe49e86ed0d9e9a1658127250a60

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6G:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5l

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 5 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 6 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
  • AutoIT Executable 8 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 13 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734dN.exe
    "C:\Users\Admin\AppData\Local\Temp\eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734dN.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2120
    • C:\Windows\SysWOW64\csbwwdzhup.exe
      csbwwdzhup.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4860
      • C:\Windows\SysWOW64\ojxmtmvt.exe
        C:\Windows\system32\ojxmtmvt.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:5008
    • C:\Windows\SysWOW64\ygawgrrclmvdwpd.exe
      ygawgrrclmvdwpd.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2260
    • C:\Windows\SysWOW64\ojxmtmvt.exe
      ojxmtmvt.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4752
    • C:\Windows\SysWOW64\iyhkumqxzqtkk.exe
      iyhkumqxzqtkk.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4528
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:4764

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe

    Filesize

    512KB

    MD5

    08834a6a18cd952e31a1dc54b6f8587a

    SHA1

    ae7f5f3eebb45bcc528139df1e52cf9211a3ccb6

    SHA256

    e3aa9568e431ade02f136eb6feb200eba7e6576873fc8755f67de708e0089b4b

    SHA512

    a371c3005d6b3ae90ed8eefe55a38040393275468e8146471cb1c8f149f561ddf1f2c027416061aa00897c5ee7ff21f4902bf0c4e1ed05ebf71c154a26f5e3dd

  • C:\Users\Admin\AppData\Local\Temp\TCD16A.tmp\sist02.xsl

    Filesize

    245KB

    MD5

    f883b260a8d67082ea895c14bf56dd56

    SHA1

    7954565c1f243d46ad3b1e2f1baf3281451fc14b

    SHA256

    ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

    SHA512

    d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

  • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

    Filesize

    383B

    MD5

    db2f45dc4a86062bdd8db713dbab79c0

    SHA1

    f5fbb0cf91b73cf92da3759426165d0d85333fdc

    SHA256

    7a9f84e1fe76dc52b709452214076fb378f163a5bfa1d693b547a4603e4cc630

    SHA512

    7143b38b8ef0578c50b2972e500a34df0ce5d1c4cc93165fad704042fbba04ebfba1a66aae9dca540816f7994815dc93614812f44000affa103331d345aaf83a

  • C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

    Filesize

    16B

    MD5

    d29962abc88624befc0135579ae485ec

    SHA1

    e40a6458296ec6a2427bcb280572d023a9862b31

    SHA256

    a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866

    SHA512

    4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

    Filesize

    2KB

    MD5

    e87afa616998017fdb4411c33fa32bfe

    SHA1

    9bdb3386ccb56bb674796afe05b4848a582c88fe

    SHA256

    2c3cb30aa7ef2e49c1cf6a4962cf6a4f751f066dc862e96b91478147c0107167

    SHA512

    ad55a80d4400aa3d02e038aa35ee641dc32d7b44240b7112ddc66af09a90ad80a80d57f086da92156955adc9a69dbb84f9915f86009836a1ddb759174d07703f

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

    Filesize

    3KB

    MD5

    8a91f498267df9f8312f5c4094579eca

    SHA1

    7a275190931886e903712621d6773724b3c7d9fd

    SHA256

    9b19fee70e458a03db59b684bd10cf7af2c691e701cb240b41549f026e8655f2

    SHA512

    8d05956fc39b08f85659c6b205c0e2cd96afb88f32b15773fac30e38b056c95ae58e58cdcde52287214926c5864c2b7d5cc2c03fbfd534a75f645fe2144e8a31

  • C:\Windows\SysWOW64\csbwwdzhup.exe

    Filesize

    512KB

    MD5

    096ca3d99fa206df45d81c8611534dcb

    SHA1

    0f10f38fde0703d065983bb123a09e81b17074c7

    SHA256

    60e5c8d8001a0a09468e6ffb532321372e177f8e91f0dc8af5c6e513c0195a85

    SHA512

    4677d6a8a734a8fe84778efe760700c6b35f34b3447bc5081f3bc010c0d7bc0617d367c02d9a8deaec702a30f9c259e335a96eb8593b76e6cceacdb23bcfa998

  • C:\Windows\SysWOW64\iyhkumqxzqtkk.exe

    Filesize

    512KB

    MD5

    06f4a7119ee80cf567847676d88828a5

    SHA1

    47eb5505a05ecc8e52eb3711ec489fc5e1d82cb5

    SHA256

    6eea5cc43217e847f0faea946cf8af66624db620f0b0a36cd079761b5a3d961b

    SHA512

    d75eaf2494c83f60a9169c7a4fdcdda33915e4518446ae223df14b3f1b88bdccb40ccf52831ad2cfa2405f90f823347ae58d19c3c18a4654833116ab590f4444

  • C:\Windows\SysWOW64\ojxmtmvt.exe

    Filesize

    512KB

    MD5

    beadf65cc46dc60a3bc626f978f7d891

    SHA1

    bcd40f6d4d961334bb44052f5b01f42638a1e368

    SHA256

    ce1870533039f3198bff8eace3a34b0831863128092aa4b550ac4251621a3f26

    SHA512

    5d62c8f6b90da09e0e9b9089f632e3260af0a094d7d68a279e321403706134fa6fea560b9522b6f7148522a538366cd52b98f05e5c3ef3e3967d68151d414b45

  • C:\Windows\SysWOW64\ygawgrrclmvdwpd.exe

    Filesize

    512KB

    MD5

    32d811243598873ea7b72837e02b112f

    SHA1

    66f667a34c0258b45f8fe56dc8f6bc49a586ff19

    SHA256

    58632ea782f24dccaf9a8fd4734c9a9fa968c0cf5217538adfd3a9c345963bbd

    SHA512

    be683452d94a4554e20cba79fa5238736f64001ea9cfcaf58415e6c3c527969c60a7322ecb1a903b28eac4333f78260ed49d0809a873dd85b600aa49c204551f

  • C:\Windows\mydoc.rtf

    Filesize

    223B

    MD5

    06604e5941c126e2e7be02c5cd9f62ec

    SHA1

    4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

    SHA256

    85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

    SHA512

    803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

    Filesize

    512KB

    MD5

    b0ecea1d79e81a6dbeed5c0255acd316

    SHA1

    5a67638e48b34049ae7b469c3c88a5424d3a7372

    SHA256

    6c8267e0529d02e0344f7e34e2dda1577ce0b9c0a168d8fe88f328af9001ca6e

    SHA512

    343326beaf738a6f4b63c2c37329f0770b3bdcd1c8a6f9ea298936fd3d71619e813408b881dbd2ca072119136a07b67244e5f14a8721774062e66b653e88a79a

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

    Filesize

    512KB

    MD5

    258e68a9ade95f18c6680b190b60c089

    SHA1

    f709e8823d949546bf1c335ab7bfe4fa10865674

    SHA256

    770e4e79cb7b90402208cedf453ad8779945ba717eecf2537d894ab7847bd199

    SHA512

    02d5023e9c00a156815bb9132382d9f9ca2b9d9abd3b10b1895f0d6a84becb2ad1c1202503a6b7f9145dc4db967b3d9da26f20233b2f3c110ae70d1793c82a3a

  • memory/2120-0-0x0000000000400000-0x0000000000496000-memory.dmp

    Filesize

    600KB

  • memory/4764-37-0x00007FF7DCAD0000-0x00007FF7DCAE0000-memory.dmp

    Filesize

    64KB

  • memory/4764-43-0x00007FF7DA9E0000-0x00007FF7DA9F0000-memory.dmp

    Filesize

    64KB

  • memory/4764-42-0x00007FF7DA9E0000-0x00007FF7DA9F0000-memory.dmp

    Filesize

    64KB

  • memory/4764-41-0x00007FF7DCAD0000-0x00007FF7DCAE0000-memory.dmp

    Filesize

    64KB

  • memory/4764-40-0x00007FF7DCAD0000-0x00007FF7DCAE0000-memory.dmp

    Filesize

    64KB

  • memory/4764-38-0x00007FF7DCAD0000-0x00007FF7DCAE0000-memory.dmp

    Filesize

    64KB

  • memory/4764-39-0x00007FF7DCAD0000-0x00007FF7DCAE0000-memory.dmp

    Filesize

    64KB