Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    147s
  • platform
    windows10-1703_x64
  • resource
    win10-20231129-en
  • resource tags

    arch:x64arch:x86image:win10-20231129-enlocale:en-usos:windows10-1703-x64system
  • submitted
    11/12/2023, 05:23

General

  • Target

    33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.exe

  • Size

    6.9MB

  • MD5

    a0082f4cbebcaa232207514008354d87

  • SHA1

    f03236c77e2d9f261cee45f1ba5180c0de9fbda5

  • SHA256

    33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408

  • SHA512

    d42c7e6ce44964b20eecb6e748e45a33a88f97ac77294ce26dfdaf6bdfc979b394b8c4be15f0c6cf156a315141652dd1602f286a99cdb18c93a0cf25002397ad

  • SSDEEP

    98304:rzyQ4kc+v4jvDhsQepuwmrkz216aPE8d9X+X1M2CX27eGqc6hxTGZtsAzFjTidLb:KQ4PTP94zHQ9OX1M2CGjn6hDc6LKEzj

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 63 IoCs
  • Runs net.exe
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.exe
    "C:\Users\Admin\AppData\Local\Temp\33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4596
    • C:\Users\Admin\AppData\Local\Temp\is-HOMUR.tmp\33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-HOMUR.tmp\33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp" /SL5="$70226,6985458,68096,C:\Users\Admin\AppData\Local\Temp\33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4448
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\system32\schtasks.exe" /Query
        3⤵
          PID:600
        • C:\Program Files (x86)\WMAFormat\wmaformat.exe
          "C:\Program Files (x86)\WMAFormat\wmaformat.exe" -s
          3⤵
          • Executes dropped EXE
          PID:2600
        • C:\Windows\SysWOW64\net.exe
          "C:\Windows\system32\net.exe" helpmsg 11
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:808
        • C:\Program Files (x86)\WMAFormat\wmaformat.exe
          "C:\Program Files (x86)\WMAFormat\wmaformat.exe" -i
          3⤵
          • Executes dropped EXE
          PID:5080
    • C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 helpmsg 11
      1⤵
        PID:4604

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\WMAFormat\wmaformat.exe

        Filesize

        208KB

        MD5

        b03f48f48c7da2f923f780844b1627b3

        SHA1

        9de7035d374c1d0f441676985edefc745e7fc4f6

        SHA256

        521063348fcaa0e17c0fe5dcbdf5642ff4d457a89652b781a63905280e1460a7

        SHA512

        f5bad98521349586f31f031813f7c36e43405cf483bf575a65e6327efab97794f4b926f512276534bea13dcf69705b5d6bfca799721b8e43861b097e6a8401e3

      • C:\Program Files (x86)\WMAFormat\wmaformat.exe

        Filesize

        229KB

        MD5

        5022159aa2b82dbe03ea69278096af2b

        SHA1

        1c3df80bce68366ecb2e7a29639624952b7c7476

        SHA256

        2c02c34d7285cc33d62a24970f80d7ed32e7161ed9778143a6daa05ca473180e

        SHA512

        d0471a96962ae379a4297620017b31a29c3b9336b98af05f55ef3e916c997454ea76af19d60339d5237f74ddb541c7fdca1f7fe70200eea2948b7572fb71d9f0

      • C:\Program Files (x86)\WMAFormat\wmaformat.exe

        Filesize

        196KB

        MD5

        99aa61a1495faa8b3862b5d382c76dbf

        SHA1

        9bc1f89c0f7916b550ae1b7ad15ecf25f50e875a

        SHA256

        d56a6629cd78390465cf5654cad502e5b7669c9d1e43517258b6b8b9e233899e

        SHA512

        b25627eee289b3a3aa30ba95c81b92c9872a51b5f11191848c0b43802e072b3969570ec8407b947737bd128064db7392870474529b32f8b9cd2db03a492b6380

      • C:\Users\Admin\AppData\Local\Temp\is-HOMUR.tmp\33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp

        Filesize

        157KB

        MD5

        5d57dfaf4a9205815741eb631e1373cc

        SHA1

        b95aacfc946a01465dd9eee260b927bd555aa8fc

        SHA256

        3a667f7a61be3ec5df289f03d1f6982c81907e1df57529362e75a29a603d1b5d

        SHA512

        21dcd439d95897ce4252477f3cc5dc49885ea3aa6ad718f66b8b0a8c21a25e7b25e8ac535775aa44a18b18e5cc5fbc2b90af6b0b4a6e0d3316ec3f7ea0bfbe42

      • C:\Users\Admin\AppData\Local\Temp\is-HOMUR.tmp\33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp

        Filesize

        392KB

        MD5

        ea5945fb03caa0f173f109198fc49d7e

        SHA1

        a4abab43ef64c0a708ff70f29f8014e0efeb71f6

        SHA256

        f0a7eef1090cc333544610620bd8df830a963e8e0874c9d35cbd98131047a9c3

        SHA512

        fb08b0fe581a5d18ea40172233f3c43c990901826d4ba1f46c42bea931268fc1473bad551198841c20aa1fe3abad6d061c5ed1057253681afaa9f21b4946ae64

      • \Users\Admin\AppData\Local\Temp\is-0332E.tmp\_isetup\_iscrypt.dll

        Filesize

        2KB

        MD5

        a69559718ab506675e907fe49deb71e9

        SHA1

        bc8f404ffdb1960b50c12ff9413c893b56f2e36f

        SHA256

        2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

        SHA512

        e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

      • \Users\Admin\AppData\Local\Temp\is-0332E.tmp\_isetup\_isdecmp.dll

        Filesize

        19KB

        MD5

        3adaa386b671c2df3bae5b39dc093008

        SHA1

        067cf95fbdb922d81db58432c46930f86d23dded

        SHA256

        71cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38

        SHA512

        bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303

      • memory/2600-162-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/2600-189-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/2600-209-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/2600-206-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/2600-159-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/2600-158-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/2600-202-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/2600-199-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/2600-196-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/2600-193-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/2600-190-0x0000000000840000-0x00000000008DE000-memory.dmp

        Filesize

        632KB

      • memory/2600-186-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/2600-177-0x0000000000840000-0x00000000008DE000-memory.dmp

        Filesize

        632KB

      • memory/2600-164-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/2600-167-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/2600-170-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/2600-173-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/2600-176-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/2600-183-0x0000000000840000-0x00000000008DE000-memory.dmp

        Filesize

        632KB

      • memory/2600-182-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/4448-163-0x00000000001F0000-0x00000000001F1000-memory.dmp

        Filesize

        4KB

      • memory/4448-10-0x00000000001F0000-0x00000000001F1000-memory.dmp

        Filesize

        4KB

      • memory/4448-161-0x0000000000400000-0x00000000004BC000-memory.dmp

        Filesize

        752KB

      • memory/4596-160-0x0000000000400000-0x0000000000418000-memory.dmp

        Filesize

        96KB

      • memory/4596-2-0x0000000000400000-0x0000000000418000-memory.dmp

        Filesize

        96KB

      • memory/4596-0-0x0000000000400000-0x0000000000418000-memory.dmp

        Filesize

        96KB

      • memory/5080-151-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/5080-152-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/5080-154-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/5080-155-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB