Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system -
submitted
11/12/2023, 22:28
Static task
static1
Behavioral task
behavioral1
Sample
dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.exe
Resource
win10v2004-20231127-en
General
-
Target
dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.exe
-
Size
7.5MB
-
MD5
f7b7223aa31ce554168ab5ccb52d9e33
-
SHA1
be79051a0e3f17eb6f410384b31addc06fda0999
-
SHA256
dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971
-
SHA512
63567efafbb790f37ca64f90750c046755a646e6149a190b8cb460a23754d9515a75e2d6d1fde4a5a887e8ba2b69a2941af285870526d0500d035a8438384791
-
SSDEEP
196608:VO78pimeIjZMmsj7bXzjl3iT1A9SG7ul2xdVNWiYmJE6RI6zj:I78pimNjMDzjl3dQAdVN1YyRPzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2892 dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp 2020 gifplayer.exe 976 gifplayer.exe -
Loads dropped DLL 3 IoCs
pid Process 2892 dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp 2892 dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp 2892 dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 81.31.197.38 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
description ioc Process File created C:\Program Files (x86)\PlayGIF\bin\x86\is-T4QSQ.tmp dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-MNK72.tmp dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-COMF1.tmp dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-C6CMR.tmp dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-2G2K1.tmp dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-EEO0T.tmp dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-5P1GI.tmp dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-NQBJQ.tmp dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\plugins\internal\is-RJ3JJ.tmp dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp File opened for modification C:\Program Files (x86)\PlayGIF\gifplayer.exe dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-JJULG.tmp dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-L23FN.tmp dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-2JK7G.tmp dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-MVLAI.tmp dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp File created C:\Program Files (x86)\PlayGIF\stuff\is-F8BJ6.tmp dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-MKAM9.tmp dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-QH9UH.tmp dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-TE1AL.tmp dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp File created C:\Program Files (x86)\PlayGIF\uninstall\unins000.dat dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-QPVMK.tmp dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-Q4EG9.tmp dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\plugins\internal\is-4PT2K.tmp dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-0G49B.tmp dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp File created C:\Program Files (x86)\PlayGIF\stuff\is-9IQC6.tmp dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp File created C:\Program Files (x86)\PlayGIF\stuff\is-6TIRL.tmp dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-IP0L4.tmp dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-84AHI.tmp dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-3NRE7.tmp dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp File created C:\Program Files (x86)\PlayGIF\uninstall\is-TRCOD.tmp dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-44F8M.tmp dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-KATOA.tmp dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-0F36A.tmp dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-PFF98.tmp dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-JD6T1.tmp dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-8GSLU.tmp dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-LIKTB.tmp dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-5B7F4.tmp dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-B9ECD.tmp dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-885QG.tmp dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-QP0EM.tmp dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp File created C:\Program Files (x86)\PlayGIF\stuff\is-79L0D.tmp dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-8I52G.tmp dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-VJ535.tmp dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-1C3E1.tmp dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-S0A5S.tmp dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-PKCM0.tmp dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-OA49U.tmp dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp File created C:\Program Files (x86)\PlayGIF\is-KA7IC.tmp dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-47PKM.tmp dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-V4HUD.tmp dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-CMEQH.tmp dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp File opened for modification C:\Program Files (x86)\PlayGIF\uninstall\unins000.dat dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-EIEIN.tmp dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-UAK2C.tmp dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-IF9NV.tmp dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-SFRQC.tmp dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-F6GS0.tmp dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-BICGM.tmp dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-1HJJA.tmp dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-IC7AG.tmp dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-1JEN3.tmp dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\lessmsi\is-9E2QF.tmp dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-EUPS2.tmp dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp -
Runs net.exe
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeManageVolumePrivilege 1840 svchost.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2892 dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1112 wrote to memory of 2892 1112 dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.exe 87 PID 1112 wrote to memory of 2892 1112 dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.exe 87 PID 1112 wrote to memory of 2892 1112 dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.exe 87 PID 2892 wrote to memory of 4040 2892 dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp 90 PID 2892 wrote to memory of 4040 2892 dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp 90 PID 2892 wrote to memory of 4040 2892 dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp 90 PID 2892 wrote to memory of 2020 2892 dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp 92 PID 2892 wrote to memory of 2020 2892 dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp 92 PID 2892 wrote to memory of 2020 2892 dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp 92 PID 2892 wrote to memory of 3940 2892 dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp 95 PID 2892 wrote to memory of 3940 2892 dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp 95 PID 2892 wrote to memory of 3940 2892 dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp 95 PID 2892 wrote to memory of 976 2892 dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp 94 PID 2892 wrote to memory of 976 2892 dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp 94 PID 2892 wrote to memory of 976 2892 dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp 94 PID 3940 wrote to memory of 868 3940 net.exe 96 PID 3940 wrote to memory of 868 3940 net.exe 96 PID 3940 wrote to memory of 868 3940 net.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.exe"C:\Users\Admin\AppData\Local\Temp\dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\is-1M8GL.tmp\dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp"C:\Users\Admin\AppData\Local\Temp\is-1M8GL.tmp\dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp" /SL5="$501C6,7611198,68096,C:\Users\Admin\AppData\Local\Temp\dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵PID:4040
-
-
C:\Program Files (x86)\PlayGIF\gifplayer.exe"C:\Program Files (x86)\PlayGIF\gifplayer.exe" -i3⤵
- Executes dropped EXE
PID:2020
-
-
C:\Program Files (x86)\PlayGIF\gifplayer.exe"C:\Program Files (x86)\PlayGIF\gifplayer.exe" -s3⤵
- Executes dropped EXE
PID:976
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 114⤵PID:868
-
-
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵PID:1104
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1840
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
448KB
MD5ac1d154824d6c405596b60d6b31cf9dc
SHA1624de84ca1b7244fbe91f4b5ff74bdacbad08cfb
SHA2563b4e85d44b7e8fd8054967c65542445c748f32317e16096cb6e467b96cdcc774
SHA51285ded9e431d1d599872fa5f5a465d86fb1e259d75936fb6fe875a2aa35c50904e51aacaaacf90f1786527c1588f6369f521743a0ab9c9c9b59688caf6db33816
-
Filesize
768KB
MD519a2e54a6977915368817604376383fa
SHA182fbcc1b13fc9b66d163176c3d2a3b088c1a5048
SHA256ab16c6529d29d7941a2e9f6cc4e478d31916ff56d8704c89ba587fc7d438a46a
SHA512b281b708375ed0ad1064841c32d6b654cabe06340b8a6bfd8ae2de0247e54dfdd42f43860e5679ac2104ad602941c482b4cfdd1511f3f1d9f35a08baf8f71dae
-
Filesize
2.3MB
MD5970d66fb7a409b3c184fba39e07888ca
SHA1ef28ca4991f3a1b40e691f0cdb9315d043729288
SHA256af208ff17f32d7a51fed0db9daad9ad9790dc6c9cce9f8f32871aa2cb3bcb2b3
SHA5122bbcbbe9745f4b775bd61122114ab605ce23fd952868ec257bee5fca7b5678f8911944f86d5d4cc9221c277497da7da54cf781b59c0e8a030e665741a4db6b7d
-
C:\Users\Admin\AppData\Local\Temp\is-1M8GL.tmp\dbf733d8206ca5e6998c5b6f557a91d77ec461c6c2311bb758f91a1c12554971.tmp
Filesize687KB
MD5f448d7f4b76e5c9c3a4eaff16a8b9b73
SHA131808f1ffa84c954376975b7cdb0007e6b762488
SHA2567233b85eb0f8b3aa5cae3811d727aa8742fec4d1091c120a0fe15006f424cc49
SHA512f8197458cd2764c0b852dac34f9bf361110a7dc86903024a97c7bcd3f77b148342bf45e3c2b60f6af8198ae3b83938dbaad5e007d71a0f88006f3a0618cf36f4
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303