Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system -
submitted
28/11/2023, 09:40
Static task
static1
Behavioral task
behavioral1
Sample
2ef9e73f101529a0b061af3674d8b21b7ce5e894c43f7d173d163fb45ffc05e7.exe
Resource
win10v2004-20231127-en
General
-
Target
2ef9e73f101529a0b061af3674d8b21b7ce5e894c43f7d173d163fb45ffc05e7.exe
-
Size
3.3MB
-
MD5
e9c91582e414d1ca64d5dd5cf1022c81
-
SHA1
ee9c77b9b988a469730a756161499802c7a092c3
-
SHA256
2ef9e73f101529a0b061af3674d8b21b7ce5e894c43f7d173d163fb45ffc05e7
-
SHA512
b364f45ecf9dd96b0a2a60de645639bc45f6d6f67d4190855846a1203e97b86fa891fbb9f62f33be506583b548117ad0ac5771251c05b399b0415abfa91e0dff
-
SSDEEP
98304:VsOoX6Vy6JPvMmZQb8Lny4UqjRynQzKkxbH6dlE:QX6o/mZcAy4Xj+Gfwdu
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 1300 2ef9e73f101529a0b061af3674d8b21b7ce5e894c43f7d173d163fb45ffc05e7.tmp 4780 mpeg4codec.exe 2704 mpeg4codec.exe -
Loads dropped DLL 3 IoCs
pid Process 1300 2ef9e73f101529a0b061af3674d8b21b7ce5e894c43f7d173d163fb45ffc05e7.tmp 1300 2ef9e73f101529a0b061af3674d8b21b7ce5e894c43f7d173d163fb45ffc05e7.tmp 1300 2ef9e73f101529a0b061af3674d8b21b7ce5e894c43f7d173d163fb45ffc05e7.tmp -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 185.237.206.223 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 19 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\BVSMPEG4\is-T1C84.tmp 2ef9e73f101529a0b061af3674d8b21b7ce5e894c43f7d173d163fb45ffc05e7.tmp File created C:\Program Files (x86)\Common Files\BVSMPEG4\is-9UMPV.tmp 2ef9e73f101529a0b061af3674d8b21b7ce5e894c43f7d173d163fb45ffc05e7.tmp File created C:\Program Files (x86)\Common Files\BVSMPEG4\is-4TDGP.tmp 2ef9e73f101529a0b061af3674d8b21b7ce5e894c43f7d173d163fb45ffc05e7.tmp File created C:\Program Files (x86)\Common Files\BVSMPEG4\is-3RVS1.tmp 2ef9e73f101529a0b061af3674d8b21b7ce5e894c43f7d173d163fb45ffc05e7.tmp File created C:\Program Files (x86)\Common Files\BVSMPEG4\is-NTGJA.tmp 2ef9e73f101529a0b061af3674d8b21b7ce5e894c43f7d173d163fb45ffc05e7.tmp File created C:\Program Files (x86)\Common Files\BVSMPEG4\UIText\is-C3J7F.tmp 2ef9e73f101529a0b061af3674d8b21b7ce5e894c43f7d173d163fb45ffc05e7.tmp File created C:\Program Files (x86)\Common Files\BVSMPEG4\is-7L2IP.tmp 2ef9e73f101529a0b061af3674d8b21b7ce5e894c43f7d173d163fb45ffc05e7.tmp File opened for modification C:\Program Files (x86)\Common Files\BVSMPEG4\mpeg4codec.exe 2ef9e73f101529a0b061af3674d8b21b7ce5e894c43f7d173d163fb45ffc05e7.tmp File created C:\Program Files (x86)\Common Files\BVSMPEG4\unins000.dat 2ef9e73f101529a0b061af3674d8b21b7ce5e894c43f7d173d163fb45ffc05e7.tmp File created C:\Program Files (x86)\Common Files\BVSMPEG4\is-M8SQH.tmp 2ef9e73f101529a0b061af3674d8b21b7ce5e894c43f7d173d163fb45ffc05e7.tmp File created C:\Program Files (x86)\Common Files\BVSMPEG4\is-E2U28.tmp 2ef9e73f101529a0b061af3674d8b21b7ce5e894c43f7d173d163fb45ffc05e7.tmp File created C:\Program Files (x86)\Common Files\BVSMPEG4\is-LQSN0.tmp 2ef9e73f101529a0b061af3674d8b21b7ce5e894c43f7d173d163fb45ffc05e7.tmp File created C:\Program Files (x86)\Common Files\BVSMPEG4\is-UV49P.tmp 2ef9e73f101529a0b061af3674d8b21b7ce5e894c43f7d173d163fb45ffc05e7.tmp File opened for modification C:\Program Files (x86)\Common Files\BVSMPEG4\unins000.dat 2ef9e73f101529a0b061af3674d8b21b7ce5e894c43f7d173d163fb45ffc05e7.tmp File created C:\Program Files (x86)\Common Files\BVSMPEG4\is-L8OTH.tmp 2ef9e73f101529a0b061af3674d8b21b7ce5e894c43f7d173d163fb45ffc05e7.tmp File created C:\Program Files (x86)\Common Files\BVSMPEG4\UIText\is-R95GF.tmp 2ef9e73f101529a0b061af3674d8b21b7ce5e894c43f7d173d163fb45ffc05e7.tmp File created C:\Program Files (x86)\Common Files\BVSMPEG4\is-ODGKS.tmp 2ef9e73f101529a0b061af3674d8b21b7ce5e894c43f7d173d163fb45ffc05e7.tmp File created C:\Program Files (x86)\Common Files\BVSMPEG4\is-ECMK5.tmp 2ef9e73f101529a0b061af3674d8b21b7ce5e894c43f7d173d163fb45ffc05e7.tmp File created C:\Program Files (x86)\Common Files\BVSMPEG4\is-BIQK7.tmp 2ef9e73f101529a0b061af3674d8b21b7ce5e894c43f7d173d163fb45ffc05e7.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs net.exe
-
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 3232 wrote to memory of 1300 3232 2ef9e73f101529a0b061af3674d8b21b7ce5e894c43f7d173d163fb45ffc05e7.exe 84 PID 3232 wrote to memory of 1300 3232 2ef9e73f101529a0b061af3674d8b21b7ce5e894c43f7d173d163fb45ffc05e7.exe 84 PID 3232 wrote to memory of 1300 3232 2ef9e73f101529a0b061af3674d8b21b7ce5e894c43f7d173d163fb45ffc05e7.exe 84 PID 1300 wrote to memory of 3724 1300 2ef9e73f101529a0b061af3674d8b21b7ce5e894c43f7d173d163fb45ffc05e7.tmp 88 PID 1300 wrote to memory of 3724 1300 2ef9e73f101529a0b061af3674d8b21b7ce5e894c43f7d173d163fb45ffc05e7.tmp 88 PID 1300 wrote to memory of 3724 1300 2ef9e73f101529a0b061af3674d8b21b7ce5e894c43f7d173d163fb45ffc05e7.tmp 88 PID 1300 wrote to memory of 4780 1300 2ef9e73f101529a0b061af3674d8b21b7ce5e894c43f7d173d163fb45ffc05e7.tmp 90 PID 1300 wrote to memory of 4780 1300 2ef9e73f101529a0b061af3674d8b21b7ce5e894c43f7d173d163fb45ffc05e7.tmp 90 PID 1300 wrote to memory of 4780 1300 2ef9e73f101529a0b061af3674d8b21b7ce5e894c43f7d173d163fb45ffc05e7.tmp 90 PID 1300 wrote to memory of 4844 1300 2ef9e73f101529a0b061af3674d8b21b7ce5e894c43f7d173d163fb45ffc05e7.tmp 93 PID 1300 wrote to memory of 4844 1300 2ef9e73f101529a0b061af3674d8b21b7ce5e894c43f7d173d163fb45ffc05e7.tmp 93 PID 1300 wrote to memory of 4844 1300 2ef9e73f101529a0b061af3674d8b21b7ce5e894c43f7d173d163fb45ffc05e7.tmp 93 PID 1300 wrote to memory of 2704 1300 2ef9e73f101529a0b061af3674d8b21b7ce5e894c43f7d173d163fb45ffc05e7.tmp 92 PID 1300 wrote to memory of 2704 1300 2ef9e73f101529a0b061af3674d8b21b7ce5e894c43f7d173d163fb45ffc05e7.tmp 92 PID 1300 wrote to memory of 2704 1300 2ef9e73f101529a0b061af3674d8b21b7ce5e894c43f7d173d163fb45ffc05e7.tmp 92 PID 4844 wrote to memory of 4976 4844 net.exe 94 PID 4844 wrote to memory of 4976 4844 net.exe 94 PID 4844 wrote to memory of 4976 4844 net.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ef9e73f101529a0b061af3674d8b21b7ce5e894c43f7d173d163fb45ffc05e7.exe"C:\Users\Admin\AppData\Local\Temp\2ef9e73f101529a0b061af3674d8b21b7ce5e894c43f7d173d163fb45ffc05e7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\is-LV707.tmp\2ef9e73f101529a0b061af3674d8b21b7ce5e894c43f7d173d163fb45ffc05e7.tmp"C:\Users\Admin\AppData\Local\Temp\is-LV707.tmp\2ef9e73f101529a0b061af3674d8b21b7ce5e894c43f7d173d163fb45ffc05e7.tmp" /SL5="$90058,3245822,76288,C:\Users\Admin\AppData\Local\Temp\2ef9e73f101529a0b061af3674d8b21b7ce5e894c43f7d173d163fb45ffc05e7.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵PID:3724
-
-
C:\Program Files (x86)\Common Files\BVSMPEG4\mpeg4codec.exe"C:\Program Files (x86)\Common Files\BVSMPEG4\mpeg4codec.exe" -i3⤵
- Executes dropped EXE
PID:4780
-
-
C:\Program Files (x86)\Common Files\BVSMPEG4\mpeg4codec.exe"C:\Program Files (x86)\Common Files\BVSMPEG4\mpeg4codec.exe" -s3⤵
- Executes dropped EXE
PID:2704
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 283⤵
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 284⤵PID:4976
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.8MB
MD5a863cd83ad9b26cf86d9a916a5505134
SHA1465f99123bfde43b7d5e841bb445f4428a9c63ae
SHA2561e5366ce3d44c99dde2efbc19ef660beddffe65bd98a7b02e25f91f27b3c3805
SHA5121879c5f2249be0e5dc97ecb4c73322e63c77725c8629efcefb33b71fe1f7f1f7b3a7696d311a5eac454ce4c8b5f013bdef23db30cc1ebd18aea75ce32c08a660
-
Filesize
3.8MB
MD5a863cd83ad9b26cf86d9a916a5505134
SHA1465f99123bfde43b7d5e841bb445f4428a9c63ae
SHA2561e5366ce3d44c99dde2efbc19ef660beddffe65bd98a7b02e25f91f27b3c3805
SHA5121879c5f2249be0e5dc97ecb4c73322e63c77725c8629efcefb33b71fe1f7f1f7b3a7696d311a5eac454ce4c8b5f013bdef23db30cc1ebd18aea75ce32c08a660
-
Filesize
3.8MB
MD5a863cd83ad9b26cf86d9a916a5505134
SHA1465f99123bfde43b7d5e841bb445f4428a9c63ae
SHA2561e5366ce3d44c99dde2efbc19ef660beddffe65bd98a7b02e25f91f27b3c3805
SHA5121879c5f2249be0e5dc97ecb4c73322e63c77725c8629efcefb33b71fe1f7f1f7b3a7696d311a5eac454ce4c8b5f013bdef23db30cc1ebd18aea75ce32c08a660
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
32KB
MD5b6f11a0ab7715f570f45900a1fe84732
SHA177b1201e535445af5ea94c1b03c0a1c34d67a77b
SHA256e47dd306a9854599f02bc1b07ca6dfbd5220f8a1352faa9616d1a327de0bbf67
SHA51278a757e67d21eb7cc95954df15e3eeff56113d6b40fb73f0c5f53304265cc52c79125d6f1b3655b64f9a411711b5b70f746080d708d7c222f4e65bad64b1b771
-
Filesize
32KB
MD5b6f11a0ab7715f570f45900a1fe84732
SHA177b1201e535445af5ea94c1b03c0a1c34d67a77b
SHA256e47dd306a9854599f02bc1b07ca6dfbd5220f8a1352faa9616d1a327de0bbf67
SHA51278a757e67d21eb7cc95954df15e3eeff56113d6b40fb73f0c5f53304265cc52c79125d6f1b3655b64f9a411711b5b70f746080d708d7c222f4e65bad64b1b771
-
C:\Users\Admin\AppData\Local\Temp\is-LV707.tmp\2ef9e73f101529a0b061af3674d8b21b7ce5e894c43f7d173d163fb45ffc05e7.tmp
Filesize683KB
MD5f507ce43ea08d1721816ad4b0e090f50
SHA1e4f02bcd410bddabea4c741838d9a88386547629
SHA256d2218bde27d66f28e3caf15e899653a9357ebdc7adf9a763b687f6c03c93e5e1
SHA51237b2f92df632f75447572df840a236ef01021e8291536bf2e8156179333f770afdd8bcbf50cb05bbdbdaa53c00ace46119290800b115823ea035a2389a3f6693
-
C:\Users\Admin\AppData\Local\Temp\is-LV707.tmp\2ef9e73f101529a0b061af3674d8b21b7ce5e894c43f7d173d163fb45ffc05e7.tmp
Filesize683KB
MD5f507ce43ea08d1721816ad4b0e090f50
SHA1e4f02bcd410bddabea4c741838d9a88386547629
SHA256d2218bde27d66f28e3caf15e899653a9357ebdc7adf9a763b687f6c03c93e5e1
SHA51237b2f92df632f75447572df840a236ef01021e8291536bf2e8156179333f770afdd8bcbf50cb05bbdbdaa53c00ace46119290800b115823ea035a2389a3f6693