Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows10-1703_x64 -
resource
win10-20231129-en -
resource tags
-
submitted
10/12/2023, 17:17
General
-
Target
59d5e2451718fa6580d02d9961d987988883a132f08d2f34e0341ef63d29d964.exe
-
Size
7.5MB
-
MD5
7c9d40570810c8e8ce41b03318191291
-
SHA1
35ec521ae129b33ac1410dda9117e58d10446f73
-
SHA256
59d5e2451718fa6580d02d9961d987988883a132f08d2f34e0341ef63d29d964
-
SHA512
e1a406b399c128b77b84496c452dbc64e6dab9996e840fdfb2bd99547ecb859b65dbc0c6858cfd6574cd64d3c36b4ccf571c33771e5b9913da119bde99a20be7
-
SSDEEP
196608:q1WnE0mkLwfSuDOhMUQK2TMvYqBzQ26keWVe2JJpC+zj:OWnEELvuDOhtQnT+6rWPdC+zj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\59d5e2451718fa6580d02d9961d987988883a132f08d2f34e0341ef63d29d964.exe"C:\Users\Admin\AppData\Local\Temp\59d5e2451718fa6580d02d9961d987988883a132f08d2f34e0341ef63d29d964.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-1JS2C.tmp\59d5e2451718fa6580d02d9961d987988883a132f08d2f34e0341ef63d29d964.tmp"C:\Users\Admin\AppData\Local\Temp\is-1JS2C.tmp\59d5e2451718fa6580d02d9961d987988883a132f08d2f34e0341ef63d29d964.tmp" /SL5="$5021C,7594666,54272,C:\Users\Admin\AppData\Local\Temp\59d5e2451718fa6580d02d9961d987988883a132f08d2f34e0341ef63d29d964.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
C:\Program Files (x86)\VoiceAssistant\voiceassist.exe"C:\Program Files (x86)\VoiceAssistant\voiceassist.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\VoiceAssistant\voiceassist.exe"C:\Program Files (x86)\VoiceAssistant\voiceassist.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 93⤵
- Suspicious use of WriteProcessMemory
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 91⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
627KB
MD5065c0164e6ba91d30cb7369200cf4bc6
SHA1cf4ea10e290ed26327b07b9b1c1c1f98cb1e279b
SHA256a9a00f3b2825d34e8ec07a30afb1865746a6af3c2e6ee3bd9ec169f2d3962adb
SHA512a246f0fb6cc99b9c7afe553a31867da766e42c21e9e24b4077a55d356fb0224f41f042130bc4aa15b7bcb300a96ad625990c811786b928e9c0dae02c88a9ef7a
-
Filesize
678KB
MD5b9204cd50c1ce746137af90a5121ac4e
SHA1d8385d566c23d6f7a9fd26eefdb1b529e4df21aa
SHA256657770a0ce9e28340760fad8422b461836c4740a4273c4fc44df63dba5255462
SHA5125a5c8031fd731a663867453c69b9623c5f0f5766558275d2df186eb7fc15f55831693cf8a056640453e3dd9556d261d60516591944a6dfb02dbc30f403f68198
-
Filesize
618KB
MD5b8a6339e23655f2163f0d2f850ed00f8
SHA185b601ea653c617f34405e3aea41d591d14d6a40
SHA256f5bd7eafa63615cc9dcee5af991c460a4d82fb19f4bdf5aaac8ae7ebd5cdd551
SHA512be8978445fb3acd45c97ba7fa1fd590e5328e041792be45197cfd64eccd8d1c8e176a32d697441891c9bb18e1ac50b9f5c0e5f9b78312e90c8a7cb938e332861
-
Filesize
98KB
MD5cc881bb97ba3b9d11a1d57dc12ee67ec
SHA1415aac7a41b558570ed08999939196789415a2f7
SHA2568df2c05a9bf473e7e33131c16f909fd03c44363f0b38d6ddf16de6db9218985b
SHA51227ade9181a34521d5147a7832ad64cf8cc8af5b024bc87add39874dd37f4d3512094b0a5c32d7fa367984220713c5e60e77d229235ce57bbc25d0900bb4a1aa4
-
Filesize
279KB
MD5187ef6e8ca0b3155bae316bf3b991a3e
SHA1b714d0711d417255990d7f813210e3dcf93cc960
SHA256ac614a4e53a723e97d46944a9c4331d98d0c8be12923cb0f26c3039410aaf9a2
SHA5127462010c5b447a9b79309e62e44936891356171c15803a2d28623b198b9c2ab5fca2ef6e65852816565036ef50f2a76d36c263cf3f31e1876fa5110a64d3ead7
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
648KB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
648KB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
648KB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
4KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB