Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    155s
  • max time network
    154s
  • platform
    windows10-1703_x64
  • resource
    win10-20231020-en
  • resource tags

    arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system
  • submitted
    02/11/2023, 18:22

General

  • Target

    9e5613fddafac906285f316159ceaf05fa502814beb28cd702f7632ccf2f240a.exe

  • Size

    5.5MB

  • MD5

    94eb3aec5f31794f035f4ca046f78599

  • SHA1

    711a308163f74724ab05538bbc0e41808ac59901

  • SHA256

    9e5613fddafac906285f316159ceaf05fa502814beb28cd702f7632ccf2f240a

  • SHA512

    5308b15f2b4459b39e7557e61795afb4c2a62a7d3a60553e5ac2cfa38b0d7d9cd552f661f08f4a72dbadfc140f7313ee54034d1cefafc78772c2cfed369e443a

  • SSDEEP

    98304:PdRq4AONC9qituGNhDq15yvVR90qudubUD1pAVXZPfZqfthYV8l7e:l/PNMBKzyva3axVpPfZqFhWM7e

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 34 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Runs net.exe
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9e5613fddafac906285f316159ceaf05fa502814beb28cd702f7632ccf2f240a.exe
    "C:\Users\Admin\AppData\Local\Temp\9e5613fddafac906285f316159ceaf05fa502814beb28cd702f7632ccf2f240a.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4076
    • C:\Users\Admin\AppData\Local\Temp\is-85MGT.tmp\is-4MUU0.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-85MGT.tmp\is-4MUU0.tmp" /SL4 $D01EA "C:\Users\Admin\AppData\Local\Temp\9e5613fddafac906285f316159ceaf05fa502814beb28cd702f7632ccf2f240a.exe" 5412255 110592
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:4968
      • C:\Windows\SysWOW64\net.exe
        "C:\Windows\system32\net.exe" helpmsg 2
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2920
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 helpmsg 2
          4⤵
            PID:2588
        • C:\Program Files (x86)\Smart Projects\IsoBuster\IsoBuster_1123.exe
          "C:\Program Files (x86)\Smart Projects\IsoBuster\IsoBuster_1123.exe" -i
          3⤵
          • Executes dropped EXE
          PID:4272
        • C:\Program Files (x86)\Smart Projects\IsoBuster\IsoBuster_1123.exe
          "C:\Program Files (x86)\Smart Projects\IsoBuster\IsoBuster_1123.exe" -s
          3⤵
          • Executes dropped EXE
          PID:3884

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Smart Projects\IsoBuster\IsoBuster_1123.exe

      Filesize

      4.1MB

      MD5

      75cd38470e132f78fa05df657b2bd16d

      SHA1

      cef58de9cf97b75832287edd0d9105969f0f45e3

      SHA256

      98efa63fa9cef31e57462403365f7132851abde194450612f2c4bbfa8fcc1028

      SHA512

      e9b9b59fc0fee3fff3ec13d43f0a85de98375834b6b1f733c5c256721f85d317fd96a99c69e40857822f92edd09a42ee47f866f2db3ebac8615ee7a4ccc5bd94

    • C:\Program Files (x86)\Smart Projects\IsoBuster\IsoBuster_1123.exe

      Filesize

      4.1MB

      MD5

      75cd38470e132f78fa05df657b2bd16d

      SHA1

      cef58de9cf97b75832287edd0d9105969f0f45e3

      SHA256

      98efa63fa9cef31e57462403365f7132851abde194450612f2c4bbfa8fcc1028

      SHA512

      e9b9b59fc0fee3fff3ec13d43f0a85de98375834b6b1f733c5c256721f85d317fd96a99c69e40857822f92edd09a42ee47f866f2db3ebac8615ee7a4ccc5bd94

    • C:\Program Files (x86)\Smart Projects\IsoBuster\IsoBuster_1123.exe

      Filesize

      4.1MB

      MD5

      75cd38470e132f78fa05df657b2bd16d

      SHA1

      cef58de9cf97b75832287edd0d9105969f0f45e3

      SHA256

      98efa63fa9cef31e57462403365f7132851abde194450612f2c4bbfa8fcc1028

      SHA512

      e9b9b59fc0fee3fff3ec13d43f0a85de98375834b6b1f733c5c256721f85d317fd96a99c69e40857822f92edd09a42ee47f866f2db3ebac8615ee7a4ccc5bd94

    • C:\Users\Admin\AppData\Local\Temp\is-85MGT.tmp\is-4MUU0.tmp

      Filesize

      643KB

      MD5

      a991510c12f20ccf8a5231a32a7958c3

      SHA1

      122724d1a4fdea39af3aa427e4941158d7e91dfa

      SHA256

      0c3ab280e156e9ff6a325267bc5d721f71dcb12490a53a03a033d932272f9198

      SHA512

      8f387a6189f6fa51f84004706589ed1706dfd08dfc38c1f8ce3ce010f37efac085fd241396ab69bc25c86174a4637492163bf3cb26f88639551dc9fa0c52eafa

    • C:\Users\Admin\AppData\Local\Temp\is-85MGT.tmp\is-4MUU0.tmp

      Filesize

      643KB

      MD5

      a991510c12f20ccf8a5231a32a7958c3

      SHA1

      122724d1a4fdea39af3aa427e4941158d7e91dfa

      SHA256

      0c3ab280e156e9ff6a325267bc5d721f71dcb12490a53a03a033d932272f9198

      SHA512

      8f387a6189f6fa51f84004706589ed1706dfd08dfc38c1f8ce3ce010f37efac085fd241396ab69bc25c86174a4637492163bf3cb26f88639551dc9fa0c52eafa

    • \Users\Admin\AppData\Local\Temp\is-VVVEU.tmp\_iscrypt.dll

      Filesize

      2KB

      MD5

      a69559718ab506675e907fe49deb71e9

      SHA1

      bc8f404ffdb1960b50c12ff9413c893b56f2e36f

      SHA256

      2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

      SHA512

      e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

    • memory/3884-112-0x0000000000960000-0x0000000000A09000-memory.dmp

      Filesize

      676KB

    • memory/3884-117-0x0000000000400000-0x0000000000825000-memory.dmp

      Filesize

      4.1MB

    • memory/3884-140-0x0000000000400000-0x0000000000825000-memory.dmp

      Filesize

      4.1MB

    • memory/3884-137-0x0000000000400000-0x0000000000825000-memory.dmp

      Filesize

      4.1MB

    • memory/3884-133-0x0000000000400000-0x0000000000825000-memory.dmp

      Filesize

      4.1MB

    • memory/3884-130-0x0000000000400000-0x0000000000825000-memory.dmp

      Filesize

      4.1MB

    • memory/3884-90-0x0000000000400000-0x0000000000825000-memory.dmp

      Filesize

      4.1MB

    • memory/3884-127-0x0000000000400000-0x0000000000825000-memory.dmp

      Filesize

      4.1MB

    • memory/3884-124-0x0000000000400000-0x0000000000825000-memory.dmp

      Filesize

      4.1MB

    • memory/3884-121-0x0000000000400000-0x0000000000825000-memory.dmp

      Filesize

      4.1MB

    • memory/3884-95-0x0000000000400000-0x0000000000825000-memory.dmp

      Filesize

      4.1MB

    • memory/3884-96-0x0000000000400000-0x0000000000825000-memory.dmp

      Filesize

      4.1MB

    • memory/3884-99-0x0000000000400000-0x0000000000825000-memory.dmp

      Filesize

      4.1MB

    • memory/3884-102-0x0000000000400000-0x0000000000825000-memory.dmp

      Filesize

      4.1MB

    • memory/3884-105-0x0000000000400000-0x0000000000825000-memory.dmp

      Filesize

      4.1MB

    • memory/3884-108-0x0000000000400000-0x0000000000825000-memory.dmp

      Filesize

      4.1MB

    • memory/3884-111-0x0000000000400000-0x0000000000825000-memory.dmp

      Filesize

      4.1MB

    • memory/3884-113-0x0000000000960000-0x0000000000A09000-memory.dmp

      Filesize

      676KB

    • memory/3884-118-0x0000000000960000-0x0000000000A09000-memory.dmp

      Filesize

      676KB

    • memory/4076-1-0x0000000000400000-0x0000000000421000-memory.dmp

      Filesize

      132KB

    • memory/4076-91-0x0000000000400000-0x0000000000421000-memory.dmp

      Filesize

      132KB

    • memory/4272-82-0x0000000000400000-0x0000000000825000-memory.dmp

      Filesize

      4.1MB

    • memory/4272-86-0x0000000000400000-0x0000000000825000-memory.dmp

      Filesize

      4.1MB

    • memory/4272-87-0x0000000000400000-0x0000000000825000-memory.dmp

      Filesize

      4.1MB

    • memory/4272-84-0x0000000000400000-0x0000000000825000-memory.dmp

      Filesize

      4.1MB

    • memory/4968-94-0x0000000000400000-0x00000000004CF000-memory.dmp

      Filesize

      828KB

    • memory/4968-92-0x00000000001F0000-0x00000000001F1000-memory.dmp

      Filesize

      4KB

    • memory/4968-7-0x00000000001F0000-0x00000000001F1000-memory.dmp

      Filesize

      4KB