Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
131s -
platform
windows10-1703_x64 -
resource
win10-20231020-en -
resource tags
-
submitted
10/12/2023, 16:42
General
-
Target
e1300f547e30d07c7aa987cd9edbb562960fbd1b7865098308b7a377543f1205.exe
-
Size
7.5MB
-
MD5
25770fd849d51f85f26cbff8a78a320b
-
SHA1
9d1d8706afc9dc7a477aef25998015f9413b5715
-
SHA256
e1300f547e30d07c7aa987cd9edbb562960fbd1b7865098308b7a377543f1205
-
SHA512
319776327c4353c32d980935ffd17e66dc51521c502d32b415af92f66ec55830984c5a8beb5e35a4c161bdf2a99836363637a78628efb79fe95ce7c57de42a5b
-
SSDEEP
196608:G1WnE0mkLwfSuDOhMUQK2TMvYqBzQ26keWVe2JJpC+zj:qWnEELvuDOhtQnT+6rWPdC+zj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e1300f547e30d07c7aa987cd9edbb562960fbd1b7865098308b7a377543f1205.exe"C:\Users\Admin\AppData\Local\Temp\e1300f547e30d07c7aa987cd9edbb562960fbd1b7865098308b7a377543f1205.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-DFMP4.tmp\e1300f547e30d07c7aa987cd9edbb562960fbd1b7865098308b7a377543f1205.tmp"C:\Users\Admin\AppData\Local\Temp\is-DFMP4.tmp\e1300f547e30d07c7aa987cd9edbb562960fbd1b7865098308b7a377543f1205.tmp" /SL5="$C01E0,7594666,54272,C:\Users\Admin\AppData\Local\Temp\e1300f547e30d07c7aa987cd9edbb562960fbd1b7865098308b7a377543f1205.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
C:\Program Files (x86)\VoiceAssistant\voiceassist.exe"C:\Program Files (x86)\VoiceAssistant\voiceassist.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 93⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 94⤵
-
-
-
C:\Program Files (x86)\VoiceAssistant\voiceassist.exe"C:\Program Files (x86)\VoiceAssistant\voiceassist.exe" -s3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
989KB
MD55b4b8494a762a062b32fc276684309cf
SHA125571c0080a44492e13a6e3ccf5917bd48faab1d
SHA256ae55df98ac03fad9a015390a70bb80766ac3225419dc66178c54271e0ea03615
SHA5127ccfc0394130d9745fdd8b9ddbb8ea5d9a5e61f61fb1fa28345853f19e526dd9f3a1389a285bcd5690dbc5c48bdcb7ebfc83f8086247fbd42af12b8ee0c9e755
-
Filesize
118KB
MD53e046c1af7bfc89f01ebb561e32577ea
SHA1f0ff9cf2168f9b4c6dfd37fdb11e1787bf9c1aa9
SHA256cfcb1118b96a3836f7b66da80a939d722ade7324a89d0837e9e2f1ca19b43247
SHA5121c962d3a8df363a24fcb63ec8cd2ed27cdb263351e58fb0253effccd22b747c9efc80232b0646a0c2541bb6040a910de3c2967e935166c698c6e4238ebcac29c
-
Filesize
661KB
MD5b259b9a9bff6735779b516844023a086
SHA1b20aa5395036690d0a0ee664ba41179a1ff4d45f
SHA2567da9896c18927335b45859a60152e8fc79ae087b199664ed3e8b7b31efdeb674
SHA512c03534a4c159be340bfc593ac2ad4921b27cd93c16ddcf73d8fd3587e2d0679f128bed2832fc9b5a158310e507237ce93964669752c7860ac323e335f31f5c3c
-
Filesize
367KB
MD5b2cd73016ddc414d9d7d72c528059a64
SHA17c8cef0a623dfdd2ab8851d6736f8063740dbf97
SHA2568d25a6c3bc0b03071bee520336d6b33a1a68b0c960b9d068c1f683a710def4c0
SHA51283c8e115a7570c25fd785ab174117036670176945f8f07197695d68b59411ffe1b83c01b813ccf9a6b75d4fd18bfd3e7144837f0b16dca9ba9cd6f87138eb2a1
-
Filesize
687KB
MD5f448d7f4b76e5c9c3a4eaff16a8b9b73
SHA131808f1ffa84c954376975b7cdb0007e6b762488
SHA2567233b85eb0f8b3aa5cae3811d727aa8742fec4d1091c120a0fe15006f424cc49
SHA512f8197458cd2764c0b852dac34f9bf361110a7dc86903024a97c7bcd3f77b148342bf45e3c2b60f6af8198ae3b83938dbaad5e007d71a0f88006f3a0618cf36f4
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
648KB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
648KB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
648KB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
4KB