Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20231129-en -
resource tags
-
submitted
11/12/2023, 05:23
General
-
Target
33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.exe
-
Size
6.9MB
-
MD5
a0082f4cbebcaa232207514008354d87
-
SHA1
f03236c77e2d9f261cee45f1ba5180c0de9fbda5
-
SHA256
33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408
-
SHA512
d42c7e6ce44964b20eecb6e748e45a33a88f97ac77294ce26dfdaf6bdfc979b394b8c4be15f0c6cf156a315141652dd1602f286a99cdb18c93a0cf25002397ad
-
SSDEEP
98304:rzyQ4kc+v4jvDhsQepuwmrkz216aPE8d9X+X1M2CX27eGqc6hxTGZtsAzFjTidLb:KQ4PTP94zHQ9OX1M2CGjn6hDc6LKEzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.exe"C:\Users\Admin\AppData\Local\Temp\33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-HOMUR.tmp\33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp"C:\Users\Admin\AppData\Local\Temp\is-HOMUR.tmp\33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp" /SL5="$70226,6985458,68096,C:\Users\Admin\AppData\Local\Temp\33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
C:\Program Files (x86)\WMAFormat\wmaformat.exe"C:\Program Files (x86)\WMAFormat\wmaformat.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Program Files (x86)\WMAFormat\wmaformat.exe"C:\Program Files (x86)\WMAFormat\wmaformat.exe" -i3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 111⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
208KB
MD5b03f48f48c7da2f923f780844b1627b3
SHA19de7035d374c1d0f441676985edefc745e7fc4f6
SHA256521063348fcaa0e17c0fe5dcbdf5642ff4d457a89652b781a63905280e1460a7
SHA512f5bad98521349586f31f031813f7c36e43405cf483bf575a65e6327efab97794f4b926f512276534bea13dcf69705b5d6bfca799721b8e43861b097e6a8401e3
-
Filesize
229KB
MD55022159aa2b82dbe03ea69278096af2b
SHA11c3df80bce68366ecb2e7a29639624952b7c7476
SHA2562c02c34d7285cc33d62a24970f80d7ed32e7161ed9778143a6daa05ca473180e
SHA512d0471a96962ae379a4297620017b31a29c3b9336b98af05f55ef3e916c997454ea76af19d60339d5237f74ddb541c7fdca1f7fe70200eea2948b7572fb71d9f0
-
Filesize
196KB
MD599aa61a1495faa8b3862b5d382c76dbf
SHA19bc1f89c0f7916b550ae1b7ad15ecf25f50e875a
SHA256d56a6629cd78390465cf5654cad502e5b7669c9d1e43517258b6b8b9e233899e
SHA512b25627eee289b3a3aa30ba95c81b92c9872a51b5f11191848c0b43802e072b3969570ec8407b947737bd128064db7392870474529b32f8b9cd2db03a492b6380
-
Filesize
157KB
MD55d57dfaf4a9205815741eb631e1373cc
SHA1b95aacfc946a01465dd9eee260b927bd555aa8fc
SHA2563a667f7a61be3ec5df289f03d1f6982c81907e1df57529362e75a29a603d1b5d
SHA51221dcd439d95897ce4252477f3cc5dc49885ea3aa6ad718f66b8b0a8c21a25e7b25e8ac535775aa44a18b18e5cc5fbc2b90af6b0b4a6e0d3316ec3f7ea0bfbe42
-
Filesize
392KB
MD5ea5945fb03caa0f173f109198fc49d7e
SHA1a4abab43ef64c0a708ff70f29f8014e0efeb71f6
SHA256f0a7eef1090cc333544610620bd8df830a963e8e0874c9d35cbd98131047a9c3
SHA512fb08b0fe581a5d18ea40172233f3c43c990901826d4ba1f46c42bea931268fc1473bad551198841c20aa1fe3abad6d061c5ed1057253681afaa9f21b4946ae64
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB