Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-1703_x64 -
resource
win10-20231129-en -
resource tags
arch:x64arch:x86image:win10-20231129-enlocale:en-usos:windows10-1703-x64system -
submitted
11/12/2023, 21:33
Static task
static1
Behavioral task
behavioral1
Sample
0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.exe
Resource
win10-20231129-en
General
-
Target
0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.exe
-
Size
7.5MB
-
MD5
55fc0a2a308a3db904214c9d0455bd65
-
SHA1
3e1bd4ecd4bc029d435c97d6ea03d7592d248621
-
SHA256
0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab
-
SHA512
5e92da2525ca9ce157ec77de369f2a626a901f4ac51c5415def1968d96f59751e3c3949aa3c87132a55008cea281ec3147297746444abcca25b63dcd88a63091
-
SSDEEP
196608:pq/iLRC0OLkYNew6tjCtD2RQVsBp4UAzj:pHC9Lkuew6t2oCO9Azj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2504 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp 312 gifplayer.exe 4720 gifplayer.exe -
Loads dropped DLL 3 IoCs
pid Process 2504 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp 2504 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp 2504 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp -
Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 194.49.94.194 Destination IP 45.155.250.90 Destination IP 152.89.198.214 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
description ioc Process File created C:\Program Files (x86)\PlayGIF\uninstall\unins000.dat 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-NEBBO.tmp 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-M85V6.tmp 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-GBTDJ.tmp 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp File created C:\Program Files (x86)\PlayGIF\is-TA1UE.tmp 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-FO55E.tmp 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-MK03C.tmp 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-9D7MA.tmp 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-RC25M.tmp 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\plugins\internal\is-KJEAM.tmp 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp File opened for modification C:\Program Files (x86)\PlayGIF\gifplayer.exe 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-U3Q53.tmp 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp File created C:\Program Files (x86)\PlayGIF\stuff\is-96UFB.tmp 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-K0PS9.tmp 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-GN4QL.tmp 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-I3TEI.tmp 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-7AA3B.tmp 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-G2S2D.tmp 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\lessmsi\is-M28E9.tmp 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-B1H4B.tmp 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\plugins\internal\is-22005.tmp 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-P8IPR.tmp 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp File created C:\Program Files (x86)\PlayGIF\uninstall\is-16VK7.tmp 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-39U72.tmp 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-EM677.tmp 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-VD52N.tmp 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-E44O9.tmp 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-JQJFK.tmp 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp File created C:\Program Files (x86)\PlayGIF\stuff\is-LDEF7.tmp 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-FIVD3.tmp 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-TPOH9.tmp 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-O1DCM.tmp 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-E68PK.tmp 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-CV4BB.tmp 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-A151P.tmp 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-4DNQN.tmp 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-34N30.tmp 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-JA46B.tmp 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-LO270.tmp 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-NQPH0.tmp 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-9UU23.tmp 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-AOF37.tmp 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-LNS5T.tmp 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-8FQIL.tmp 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-296AL.tmp 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-4BO6O.tmp 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-B3D3E.tmp 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-SML95.tmp 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp File opened for modification C:\Program Files (x86)\PlayGIF\uninstall\unins000.dat 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-GIJ4N.tmp 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-SDC41.tmp 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-O3I31.tmp 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp File created C:\Program Files (x86)\PlayGIF\stuff\is-SE0SR.tmp 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp File created C:\Program Files (x86)\PlayGIF\stuff\is-J0J54.tmp 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-4OR8I.tmp 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-U4QJ3.tmp 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-3AGFU.tmp 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-FPVVK.tmp 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-0754H.tmp 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-APA3R.tmp 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-N00SV.tmp 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-ES355.tmp 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-GFCHN.tmp 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp -
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2504 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 3572 wrote to memory of 2504 3572 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.exe 74 PID 3572 wrote to memory of 2504 3572 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.exe 74 PID 3572 wrote to memory of 2504 3572 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.exe 74 PID 2504 wrote to memory of 4188 2504 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp 75 PID 2504 wrote to memory of 4188 2504 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp 75 PID 2504 wrote to memory of 4188 2504 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp 75 PID 2504 wrote to memory of 312 2504 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp 77 PID 2504 wrote to memory of 312 2504 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp 77 PID 2504 wrote to memory of 312 2504 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp 77 PID 2504 wrote to memory of 3620 2504 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp 80 PID 2504 wrote to memory of 3620 2504 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp 80 PID 2504 wrote to memory of 3620 2504 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp 80 PID 2504 wrote to memory of 4720 2504 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp 79 PID 2504 wrote to memory of 4720 2504 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp 79 PID 2504 wrote to memory of 4720 2504 0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp 79 PID 3620 wrote to memory of 2476 3620 net.exe 81 PID 3620 wrote to memory of 2476 3620 net.exe 81 PID 3620 wrote to memory of 2476 3620 net.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.exe"C:\Users\Admin\AppData\Local\Temp\0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\is-04QK5.tmp\0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp"C:\Users\Admin\AppData\Local\Temp\is-04QK5.tmp\0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp" /SL5="$60200,7577497,68096,C:\Users\Admin\AppData\Local\Temp\0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵PID:4188
-
-
C:\Program Files (x86)\PlayGIF\gifplayer.exe"C:\Program Files (x86)\PlayGIF\gifplayer.exe" -i3⤵
- Executes dropped EXE
PID:312
-
-
C:\Program Files (x86)\PlayGIF\gifplayer.exe"C:\Program Files (x86)\PlayGIF\gifplayer.exe" -s3⤵
- Executes dropped EXE
PID:4720
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 114⤵PID:2476
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD5f9c5ce57200f4cad797c96a970d0875b
SHA11b0258fcc560d41592389d0d3c8b72b6f16fbf3b
SHA256b9d0ad80cf3a6b23ba2479466f1e95783f8926d1f05f310fd03bb0ea264e96ed
SHA512a2a6913cd987777f0884246949b2f15ca277d767135e4805a2bf4a9ad8b2ec571230a5cb513e8fa435fe07d70be513fe433b096a6ae145c7af97c269a94f5a7b
-
Filesize
835KB
MD5264d55d5388121bbe1cce68e9641832b
SHA11f39ea3f7b01dcba62d8e3c4aa765d76bb19bd99
SHA256a6d79dbdff3850098e697475e2dbef47beebddd607ae6b99ba10a39f9c06c904
SHA5122c2d438efdeeac378b9f81e04f57e99071da85d06c82e6d4b3e262f423b6a4e4299aed9d09cc054ec1b3dd754e992b161537151aabcd086fe2a1b9eb6601e0aa
-
Filesize
288KB
MD5b1fbca4910bab1aa89cdd1766772ca9b
SHA1f65ede3ceb769ebd4d1800e675105c0e9ba3f22d
SHA25670446e4a6ebbf09e58933b325c0cda543f6413157ca4277aa53db50a021c0470
SHA512c4ac46dce8abe0815dadba07d4b035ee22a865941f0ac5c048f567e56de362941fcc8446049408ad5ec65f97074ee55786fe1f312c971ac7d57b97b113b58ca0
-
C:\Users\Admin\AppData\Local\Temp\is-04QK5.tmp\0374b7e0e99cfd8a0e44b921e0084eaa3cd5aecffba78623ec6f42d9669f59ab.tmp
Filesize687KB
MD5f448d7f4b76e5c9c3a4eaff16a8b9b73
SHA131808f1ffa84c954376975b7cdb0007e6b762488
SHA2567233b85eb0f8b3aa5cae3811d727aa8742fec4d1091c120a0fe15006f424cc49
SHA512f8197458cd2764c0b852dac34f9bf361110a7dc86903024a97c7bcd3f77b148342bf45e3c2b60f6af8198ae3b83938dbaad5e007d71a0f88006f3a0618cf36f4
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303