Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    136s
  • platform
    windows10-1703_x64
  • resource
    win10-20231020-en
  • resource tags

    arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system
  • submitted
    05/11/2023, 09:02 UTC

General

  • Target

    97526db39e87eaf8a7c645b138c9b73670e96a9c1b3ab380d3ea5431f42ef583.exe

  • Size

    5.6MB

  • MD5

    eaa782bef4dd2ac10dd4e58321d8a485

  • SHA1

    8a88905bfe87e3146f8f9894826598bb83ffb9c3

  • SHA256

    97526db39e87eaf8a7c645b138c9b73670e96a9c1b3ab380d3ea5431f42ef583

  • SHA512

    bd43291320c8200e9164cd0c975424d1a1afaa91d2c8c10cea88fbc1aae121f23681eed773b8c05421d7572712733b79a72b30b38a860e16dbca64f217e59585

  • SSDEEP

    98304:QiRmxZFsM4kxzDcT+GcY437KvDwEHuujlsaSzsC0p43MpQdZ9nc+fsCb+oSBAON6:JRm1syxacY48eda2TMpQdZ9nc+fyhNjG

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 34 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Runs net.exe
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\97526db39e87eaf8a7c645b138c9b73670e96a9c1b3ab380d3ea5431f42ef583.exe
    "C:\Users\Admin\AppData\Local\Temp\97526db39e87eaf8a7c645b138c9b73670e96a9c1b3ab380d3ea5431f42ef583.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3692
    • C:\Users\Admin\AppData\Local\Temp\is-MT21D.tmp\is-A6U6F.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-MT21D.tmp\is-A6U6F.tmp" /SL4 $7018C "C:\Users\Admin\AppData\Local\Temp\97526db39e87eaf8a7c645b138c9b73670e96a9c1b3ab380d3ea5431f42ef583.exe" 5597940 141824
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:2856
      • C:\Windows\SysWOW64\net.exe
        "C:\Windows\system32\net.exe" helpmsg 2
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1272
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 helpmsg 2
          4⤵
            PID:4404
        • C:\Program Files (x86)\Smart Projects\IsoBuster\IsoBuster_1121.exe
          "C:\Program Files (x86)\Smart Projects\IsoBuster\IsoBuster_1121.exe" -i
          3⤵
          • Executes dropped EXE
          PID:1916
        • C:\Program Files (x86)\Smart Projects\IsoBuster\IsoBuster_1121.exe
          "C:\Program Files (x86)\Smart Projects\IsoBuster\IsoBuster_1121.exe" -s
          3⤵
          • Executes dropped EXE
          PID:2964

    Network

    • flag-us
      DNS
      43.229.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      43.229.111.52.in-addr.arpa
      IN PTR
      Response
    • flag-fr
      DNS
      emcxdoi.ua
      IsoBuster_1121.exe
      Remote address:
      51.159.66.125:53
      Request
      emcxdoi.ua
      IN A
      Response
      emcxdoi.ua
      IN A
      185.141.63.172
    • flag-bg
      GET
      http://emcxdoi.ua/single.php?c=94bf3661c794e3eb1ba43206dd65bf6ada593eec48a792c6c460983d96725657a011e5d2855f6c1fae6fce8bd311a185a1071450c614bb54b5de02372b5d028b83e01eddffd4f4f25aa0d6a5ed5bf098a72d6f82d4d533
      IsoBuster_1121.exe
      Remote address:
      185.141.63.172:80
      Request
      GET /single.php?c=94bf3661c794e3eb1ba43206dd65bf6ada593eec48a792c6c460983d96725657a011e5d2855f6c1fae6fce8bd311a185a1071450c614bb54b5de02372b5d028b83e01eddffd4f4f25aa0d6a5ed5bf098a72d6f82d4d533 HTTP/1.1
      Host: emcxdoi.ua
      User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
      Response
      HTTP/1.1 200 OK
      Server: nginx/1.12.2
      Date: Sun, 05 Nov 2023 11:43:39 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
      X-Powered-By: PHP/7.1.33
    • flag-bg
      GET
      http://emcxdoi.ua/single.php?c=94bf3661c794e3eb1ba43206dd65bf6ada593eec48a792c6c460983d96735657a011e5d2855f6c1fae6fce8ec341fdd6f2044c01951cf55aa2815f3a345c198b9be20d89ae93efa71bb09ffdf60eb2c8a32d6e8eddd630fb465441
      IsoBuster_1121.exe
      Remote address:
      185.141.63.172:80
      Request
      GET /single.php?c=94bf3661c794e3eb1ba43206dd65bf6ada593eec48a792c6c460983d96735657a011e5d2855f6c1fae6fce8ec341fdd6f2044c01951cf55aa2815f3a345c198b9be20d89ae93efa71bb09ffdf60eb2c8a32d6e8eddd630fb465441 HTTP/1.1
      Host: emcxdoi.ua
      User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
      Response
      HTTP/1.1 200 OK
      Server: nginx/1.12.2
      Date: Sun, 05 Nov 2023 11:43:43 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
      X-Powered-By: PHP/7.1.33
    • flag-us
      DNS
      0.f.1.f.6.b.7.5.4.b.7.6.b.9.5.6.f.7.e.0.0.7.8.5.d.7.2.4.f.9.3.3.ip6.arpa
      Remote address:
      8.8.8.8:53
      Request
      0.f.1.f.6.b.7.5.4.b.7.6.b.9.5.6.f.7.e.0.0.7.8.5.d.7.2.4.f.9.3.3.ip6.arpa
      IN PTR
      Response
    • flag-us
      DNS
      125.66.159.51.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      125.66.159.51.in-addr.arpa
      IN PTR
      Response
      125.66.159.51.in-addr.arpa
      IN PTR
      51-159-66-125rev poneytelecomeu
    • flag-us
      DNS
      77.239.69.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      77.239.69.13.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      172.63.141.185.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      172.63.141.185.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      163.252.72.23.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      163.252.72.23.in-addr.arpa
      IN PTR
      Response
      163.252.72.23.in-addr.arpa
      IN PTR
      a23-72-252-163deploystaticakamaitechnologiescom
    • flag-us
      DNS
      187.142.187.37.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      187.142.187.37.in-addr.arpa
      IN PTR
      Response
      187.142.187.37.in-addr.arpa
      IN PTR
      2416gra1ovhabcdnetwork
    • 185.141.63.172:80
      http://emcxdoi.ua/single.php?c=94bf3661c794e3eb1ba43206dd65bf6ada593eec48a792c6c460983d96735657a011e5d2855f6c1fae6fce8ec341fdd6f2044c01951cf55aa2815f3a345c198b9be20d89ae93efa71bb09ffdf60eb2c8a32d6e8eddd630fb465441
      http
      IsoBuster_1121.exe
      866 B
      1.1kB
      6
      6

      HTTP Request

      GET http://emcxdoi.ua/single.php?c=94bf3661c794e3eb1ba43206dd65bf6ada593eec48a792c6c460983d96725657a011e5d2855f6c1fae6fce8bd311a185a1071450c614bb54b5de02372b5d028b83e01eddffd4f4f25aa0d6a5ed5bf098a72d6f82d4d533

      HTTP Response

      200

      HTTP Request

      GET http://emcxdoi.ua/single.php?c=94bf3661c794e3eb1ba43206dd65bf6ada593eec48a792c6c460983d96735657a011e5d2855f6c1fae6fce8ec341fdd6f2044c01951cf55aa2815f3a345c198b9be20d89ae93efa71bb09ffdf60eb2c8a32d6e8eddd630fb465441

      HTTP Response

      200
    • 37.187.142.187:1074
      IsoBuster_1121.exe
      383 B
      174 B
      5
      4
    • 8.8.8.8:53
      43.229.111.52.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      43.229.111.52.in-addr.arpa

    • 51.159.66.125:53
      emcxdoi.ua
      dns
      IsoBuster_1121.exe
      56 B
      82 B
      1
      1

      DNS Request

      emcxdoi.ua

      DNS Response

      185.141.63.172

    • 8.8.8.8:53
      0.f.1.f.6.b.7.5.4.b.7.6.b.9.5.6.f.7.e.0.0.7.8.5.d.7.2.4.f.9.3.3.ip6.arpa
      dns
      118 B
      182 B
      1
      1

      DNS Request

      0.f.1.f.6.b.7.5.4.b.7.6.b.9.5.6.f.7.e.0.0.7.8.5.d.7.2.4.f.9.3.3.ip6.arpa

    • 8.8.8.8:53
      125.66.159.51.in-addr.arpa
      dns
      72 B
      119 B
      1
      1

      DNS Request

      125.66.159.51.in-addr.arpa

    • 8.8.8.8:53
      77.239.69.13.in-addr.arpa
      dns
      71 B
      145 B
      1
      1

      DNS Request

      77.239.69.13.in-addr.arpa

    • 8.8.8.8:53
      172.63.141.185.in-addr.arpa
      dns
      73 B
      124 B
      1
      1

      DNS Request

      172.63.141.185.in-addr.arpa

    • 8.8.8.8:53
      163.252.72.23.in-addr.arpa
      dns
      72 B
      137 B
      1
      1

      DNS Request

      163.252.72.23.in-addr.arpa

    • 8.8.8.8:53
      187.142.187.37.in-addr.arpa
      dns
      73 B
      113 B
      1
      1

      DNS Request

      187.142.187.37.in-addr.arpa

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Smart Projects\IsoBuster\IsoBuster_1121.exe

      Filesize

      4.4MB

      MD5

      81bf17b6bc712eec07e481349afc3dbc

      SHA1

      eedecca191d3a6b1f16483714343fe1019d7fc62

      SHA256

      81baf334067384061f84fb8335cd811aa22984601ad103e3f575f0a5cb9a639b

      SHA512

      3aa53bfc176d2313e7a02c8f3511e1892adcacf02ee28135e5ae46b1224fdfaef6ddcba8b5f9b340c40c39d22b87d23468401df2c84ac57c57fdeabf2f302171

    • C:\Program Files (x86)\Smart Projects\IsoBuster\IsoBuster_1121.exe

      Filesize

      4.4MB

      MD5

      81bf17b6bc712eec07e481349afc3dbc

      SHA1

      eedecca191d3a6b1f16483714343fe1019d7fc62

      SHA256

      81baf334067384061f84fb8335cd811aa22984601ad103e3f575f0a5cb9a639b

      SHA512

      3aa53bfc176d2313e7a02c8f3511e1892adcacf02ee28135e5ae46b1224fdfaef6ddcba8b5f9b340c40c39d22b87d23468401df2c84ac57c57fdeabf2f302171

    • C:\Program Files (x86)\Smart Projects\IsoBuster\IsoBuster_1121.exe

      Filesize

      4.4MB

      MD5

      81bf17b6bc712eec07e481349afc3dbc

      SHA1

      eedecca191d3a6b1f16483714343fe1019d7fc62

      SHA256

      81baf334067384061f84fb8335cd811aa22984601ad103e3f575f0a5cb9a639b

      SHA512

      3aa53bfc176d2313e7a02c8f3511e1892adcacf02ee28135e5ae46b1224fdfaef6ddcba8b5f9b340c40c39d22b87d23468401df2c84ac57c57fdeabf2f302171

    • C:\Users\Admin\AppData\Local\Temp\is-MT21D.tmp\is-A6U6F.tmp

      Filesize

      642KB

      MD5

      e57693101a63b1f934f462bc7a2ef093

      SHA1

      2748ea8c66b980f14c9ce36c1c3061e690cf3ce7

      SHA256

      71267ff94c9fc72cbffaeed3bc2f33cef1eeb1887c29c574d7f26595d1a6235f

      SHA512

      3dcda686a85b19a9c7b4c96d132e90ed43c7df13ce9456beb2b88c278d8068cc3abcbfe25b1607c7b8281d276efb24809730f352927b326254f3208cbdf54a3e

    • C:\Users\Admin\AppData\Local\Temp\is-MT21D.tmp\is-A6U6F.tmp

      Filesize

      642KB

      MD5

      e57693101a63b1f934f462bc7a2ef093

      SHA1

      2748ea8c66b980f14c9ce36c1c3061e690cf3ce7

      SHA256

      71267ff94c9fc72cbffaeed3bc2f33cef1eeb1887c29c574d7f26595d1a6235f

      SHA512

      3dcda686a85b19a9c7b4c96d132e90ed43c7df13ce9456beb2b88c278d8068cc3abcbfe25b1607c7b8281d276efb24809730f352927b326254f3208cbdf54a3e

    • \Users\Admin\AppData\Local\Temp\is-H2EG0.tmp\_iscrypt.dll

      Filesize

      2KB

      MD5

      a69559718ab506675e907fe49deb71e9

      SHA1

      bc8f404ffdb1960b50c12ff9413c893b56f2e36f

      SHA256

      2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

      SHA512

      e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

    • memory/1916-86-0x0000000000400000-0x000000000086F000-memory.dmp

      Filesize

      4.4MB

    • memory/1916-84-0x0000000000400000-0x000000000086F000-memory.dmp

      Filesize

      4.4MB

    • memory/1916-83-0x0000000000400000-0x000000000086F000-memory.dmp

      Filesize

      4.4MB

    • memory/1916-87-0x0000000000400000-0x000000000086F000-memory.dmp

      Filesize

      4.4MB

    • memory/2856-92-0x00000000001F0000-0x00000000001F1000-memory.dmp

      Filesize

      4KB

    • memory/2856-7-0x00000000001F0000-0x00000000001F1000-memory.dmp

      Filesize

      4KB

    • memory/2856-94-0x0000000000400000-0x00000000004CF000-memory.dmp

      Filesize

      828KB

    • memory/2964-99-0x0000000000400000-0x000000000086F000-memory.dmp

      Filesize

      4.4MB

    • memory/2964-112-0x0000000000A60000-0x0000000000B04000-memory.dmp

      Filesize

      656KB

    • memory/2964-90-0x0000000000400000-0x000000000086F000-memory.dmp

      Filesize

      4.4MB

    • memory/2964-95-0x0000000000400000-0x000000000086F000-memory.dmp

      Filesize

      4.4MB

    • memory/2964-96-0x0000000000400000-0x000000000086F000-memory.dmp

      Filesize

      4.4MB

    • memory/2964-142-0x0000000000400000-0x000000000086F000-memory.dmp

      Filesize

      4.4MB

    • memory/2964-102-0x0000000000400000-0x000000000086F000-memory.dmp

      Filesize

      4.4MB

    • memory/2964-105-0x0000000000400000-0x000000000086F000-memory.dmp

      Filesize

      4.4MB

    • memory/2964-108-0x0000000000400000-0x000000000086F000-memory.dmp

      Filesize

      4.4MB

    • memory/2964-111-0x0000000000400000-0x000000000086F000-memory.dmp

      Filesize

      4.4MB

    • memory/2964-113-0x0000000000A60000-0x0000000000B04000-memory.dmp

      Filesize

      656KB

    • memory/2964-139-0x0000000000400000-0x000000000086F000-memory.dmp

      Filesize

      4.4MB

    • memory/2964-117-0x0000000000400000-0x000000000086F000-memory.dmp

      Filesize

      4.4MB

    • memory/2964-118-0x0000000000A60000-0x0000000000B04000-memory.dmp

      Filesize

      656KB

    • memory/2964-121-0x0000000000400000-0x000000000086F000-memory.dmp

      Filesize

      4.4MB

    • memory/2964-124-0x0000000000400000-0x000000000086F000-memory.dmp

      Filesize

      4.4MB

    • memory/2964-127-0x0000000000400000-0x000000000086F000-memory.dmp

      Filesize

      4.4MB

    • memory/2964-130-0x0000000000400000-0x000000000086F000-memory.dmp

      Filesize

      4.4MB

    • memory/2964-133-0x0000000000400000-0x000000000086F000-memory.dmp

      Filesize

      4.4MB

    • memory/2964-134-0x0000000000A60000-0x0000000000B04000-memory.dmp

      Filesize

      656KB

    • memory/2964-135-0x0000000000A60000-0x0000000000B04000-memory.dmp

      Filesize

      656KB

    • memory/3692-91-0x0000000000400000-0x0000000000429000-memory.dmp

      Filesize

      164KB

    • memory/3692-1-0x0000000000400000-0x0000000000429000-memory.dmp

      Filesize

      164KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.