Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20231129-en -
resource tags
arch:x64arch:x86image:win10-20231129-enlocale:en-usos:windows10-1703-x64system -
submitted
11/12/2023, 05:23
Static task
static1
Behavioral task
behavioral1
Sample
33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.exe
Resource
win10-20231129-en
General
-
Target
33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.exe
-
Size
6.9MB
-
MD5
a0082f4cbebcaa232207514008354d87
-
SHA1
f03236c77e2d9f261cee45f1ba5180c0de9fbda5
-
SHA256
33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408
-
SHA512
d42c7e6ce44964b20eecb6e748e45a33a88f97ac77294ce26dfdaf6bdfc979b394b8c4be15f0c6cf156a315141652dd1602f286a99cdb18c93a0cf25002397ad
-
SSDEEP
98304:rzyQ4kc+v4jvDhsQepuwmrkz216aPE8d9X+X1M2CX27eGqc6hxTGZtsAzFjTidLb:KQ4PTP94zHQ9OX1M2CGjn6hDc6LKEzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 4448 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp 5080 wmaformat.exe 2600 wmaformat.exe -
Loads dropped DLL 3 IoCs
pid Process 4448 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp 4448 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp 4448 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 141.98.234.31 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
description ioc Process File created C:\Program Files (x86)\WMAFormat\bin\x86\is-DOFD1.tmp 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-OO461.tmp 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-C477V.tmp 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp File created C:\Program Files (x86)\WMAFormat\uninstall\unins000.dat 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp File created C:\Program Files (x86)\WMAFormat\stuff\is-KSHTS.tmp 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-R9117.tmp 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-ENSOP.tmp 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-MH4CH.tmp 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-Q8P5D.tmp 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-62HGF.tmp 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-G9V22.tmp 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-8JVGS.tmp 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-LRPK1.tmp 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-V9GK3.tmp 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-CRRTB.tmp 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-BF3VJ.tmp 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-FILS9.tmp 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-AAVEC.tmp 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-RMKVK.tmp 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-K2AI9.tmp 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-L1T1V.tmp 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-5UENU.tmp 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-P1SO8.tmp 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp File created C:\Program Files (x86)\WMAFormat\is-HM8CC.tmp 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-MD5DV.tmp 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-0PIG3.tmp 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-45T1S.tmp 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-RFV3P.tmp 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-LNQ0N.tmp 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp File created C:\Program Files (x86)\WMAFormat\stuff\is-39MV6.tmp 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-92PH8.tmp 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-GH651.tmp 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-I5IEN.tmp 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-S3LIJ.tmp 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp File opened for modification C:\Program Files (x86)\WMAFormat\uninstall\unins000.dat 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-O81C9.tmp 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-1JGLQ.tmp 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-5Q5DJ.tmp 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-FHSV7.tmp 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-FRNGV.tmp 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-8OS35.tmp 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-713S3.tmp 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\plugins\internal\is-ILOVK.tmp 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-0TIN6.tmp 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-M1V7N.tmp 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-B9JQH.tmp 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\lessmsi\is-0T2B8.tmp 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp File opened for modification C:\Program Files (x86)\WMAFormat\wmaformat.exe 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-P0EHF.tmp 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-V9VTD.tmp 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-M8CN4.tmp 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp File created C:\Program Files (x86)\WMAFormat\uninstall\is-MONEK.tmp 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp File created C:\Program Files (x86)\WMAFormat\stuff\is-E7NIO.tmp 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-V7KIC.tmp 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-TRI0V.tmp 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-73FLF.tmp 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\plugins\internal\is-1SGNB.tmp 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp File created C:\Program Files (x86)\WMAFormat\stuff\is-M055A.tmp 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-OHCBL.tmp 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-3MLAT.tmp 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-P1QUK.tmp 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-731EA.tmp 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-5NVUR.tmp 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp -
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4448 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 4596 wrote to memory of 4448 4596 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.exe 20 PID 4596 wrote to memory of 4448 4596 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.exe 20 PID 4596 wrote to memory of 4448 4596 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.exe 20 PID 4448 wrote to memory of 600 4448 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp 37 PID 4448 wrote to memory of 600 4448 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp 37 PID 4448 wrote to memory of 600 4448 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp 37 PID 4448 wrote to memory of 5080 4448 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp 43 PID 4448 wrote to memory of 5080 4448 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp 43 PID 4448 wrote to memory of 5080 4448 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp 43 PID 4448 wrote to memory of 808 4448 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp 41 PID 4448 wrote to memory of 808 4448 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp 41 PID 4448 wrote to memory of 808 4448 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp 41 PID 4448 wrote to memory of 2600 4448 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp 40 PID 4448 wrote to memory of 2600 4448 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp 40 PID 4448 wrote to memory of 2600 4448 33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp 40 PID 808 wrote to memory of 4604 808 net.exe 39 PID 808 wrote to memory of 4604 808 net.exe 39 PID 808 wrote to memory of 4604 808 net.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.exe"C:\Users\Admin\AppData\Local\Temp\33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\is-HOMUR.tmp\33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp"C:\Users\Admin\AppData\Local\Temp\is-HOMUR.tmp\33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp" /SL5="$70226,6985458,68096,C:\Users\Admin\AppData\Local\Temp\33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵PID:600
-
-
C:\Program Files (x86)\WMAFormat\wmaformat.exe"C:\Program Files (x86)\WMAFormat\wmaformat.exe" -s3⤵
- Executes dropped EXE
PID:2600
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
- Suspicious use of WriteProcessMemory
PID:808
-
-
C:\Program Files (x86)\WMAFormat\wmaformat.exe"C:\Program Files (x86)\WMAFormat\wmaformat.exe" -i3⤵
- Executes dropped EXE
PID:5080
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 111⤵PID:4604
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
208KB
MD5b03f48f48c7da2f923f780844b1627b3
SHA19de7035d374c1d0f441676985edefc745e7fc4f6
SHA256521063348fcaa0e17c0fe5dcbdf5642ff4d457a89652b781a63905280e1460a7
SHA512f5bad98521349586f31f031813f7c36e43405cf483bf575a65e6327efab97794f4b926f512276534bea13dcf69705b5d6bfca799721b8e43861b097e6a8401e3
-
Filesize
229KB
MD55022159aa2b82dbe03ea69278096af2b
SHA11c3df80bce68366ecb2e7a29639624952b7c7476
SHA2562c02c34d7285cc33d62a24970f80d7ed32e7161ed9778143a6daa05ca473180e
SHA512d0471a96962ae379a4297620017b31a29c3b9336b98af05f55ef3e916c997454ea76af19d60339d5237f74ddb541c7fdca1f7fe70200eea2948b7572fb71d9f0
-
Filesize
196KB
MD599aa61a1495faa8b3862b5d382c76dbf
SHA19bc1f89c0f7916b550ae1b7ad15ecf25f50e875a
SHA256d56a6629cd78390465cf5654cad502e5b7669c9d1e43517258b6b8b9e233899e
SHA512b25627eee289b3a3aa30ba95c81b92c9872a51b5f11191848c0b43802e072b3969570ec8407b947737bd128064db7392870474529b32f8b9cd2db03a492b6380
-
C:\Users\Admin\AppData\Local\Temp\is-HOMUR.tmp\33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp
Filesize157KB
MD55d57dfaf4a9205815741eb631e1373cc
SHA1b95aacfc946a01465dd9eee260b927bd555aa8fc
SHA2563a667f7a61be3ec5df289f03d1f6982c81907e1df57529362e75a29a603d1b5d
SHA51221dcd439d95897ce4252477f3cc5dc49885ea3aa6ad718f66b8b0a8c21a25e7b25e8ac535775aa44a18b18e5cc5fbc2b90af6b0b4a6e0d3316ec3f7ea0bfbe42
-
C:\Users\Admin\AppData\Local\Temp\is-HOMUR.tmp\33dd906af3bd990a27e4cea23685b9435c425d1d8fd8a9e3935f7455c597f408.tmp
Filesize392KB
MD5ea5945fb03caa0f173f109198fc49d7e
SHA1a4abab43ef64c0a708ff70f29f8014e0efeb71f6
SHA256f0a7eef1090cc333544610620bd8df830a963e8e0874c9d35cbd98131047a9c3
SHA512fb08b0fe581a5d18ea40172233f3c43c990901826d4ba1f46c42bea931268fc1473bad551198841c20aa1fe3abad6d061c5ed1057253681afaa9f21b4946ae64
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303