Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
-
submitted
11/12/2023, 05:01
General
-
Target
650eba1d45243b489d8bc4d731ff642e6a55c334b255b94853c7b55f01a88c40.exe
-
Size
6.9MB
-
MD5
55fd7498feb8aac1827bbd4dd539a07e
-
SHA1
078e4d4a169cfc5bfc4f7ed8e51172f173fd9ef9
-
SHA256
650eba1d45243b489d8bc4d731ff642e6a55c334b255b94853c7b55f01a88c40
-
SHA512
dbfd95c7a68ee4661a199821030872465f9894a34bed2b60739ab674a5fb93acc10e51b83d2343bae8ade9f0ec4327be07f26350646a38b392e011d18ccf8b18
-
SSDEEP
98304:2zyQ4kc+v4jvDhsQepuwmrkz216aPE8d9X+X1M2CX27eGqc6hxTGZtsAzFjTidLb:DQ4PTP94zHQ9OX1M2CGjn6hDc6LKEzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\650eba1d45243b489d8bc4d731ff642e6a55c334b255b94853c7b55f01a88c40.exe"C:\Users\Admin\AppData\Local\Temp\650eba1d45243b489d8bc4d731ff642e6a55c334b255b94853c7b55f01a88c40.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-LV435.tmp\650eba1d45243b489d8bc4d731ff642e6a55c334b255b94853c7b55f01a88c40.tmp"C:\Users\Admin\AppData\Local\Temp\is-LV435.tmp\650eba1d45243b489d8bc4d731ff642e6a55c334b255b94853c7b55f01a88c40.tmp" /SL5="$180042,6985458,68096,C:\Users\Admin\AppData\Local\Temp\650eba1d45243b489d8bc4d731ff642e6a55c334b255b94853c7b55f01a88c40.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
C:\Program Files (x86)\WMAFormat\wmaformat.exe"C:\Program Files (x86)\WMAFormat\wmaformat.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Program Files (x86)\WMAFormat\wmaformat.exe"C:\Program Files (x86)\WMAFormat\wmaformat.exe" -i3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 111⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
50KB
MD5bcd2b2b611dcb74193a52c8af33cdc0d
SHA1ca2379313015c542e073e7d530c840db56ce0c3a
SHA2565eea76344173581d0f55b292fb69a4e1841f644c13f563d10e003eff91f57f81
SHA512ccf04007edbfb56c246a2fb6b2fe8f881384ee148db49c8c6d8a2e6e56ddaac8fc7c81e07628ea21b1a76bdf35a1fe15f736adc9458717acfb7193fc85752aef
-
Filesize
14KB
MD5df8c31f2e642bb20b307c773a1410c86
SHA11297a4db513fae6aeefeb171d6df5a8b738d388d
SHA2560dcd6cd64e183874164bbb17ec4f74fc4a8f00180c40c0c37896f0319490d472
SHA512f853208b4c3730dc86934b2e2cf1751bfa650f3baf7b833f6a884ee673264689fc33e5d0f3f977cc1ea1240bcb90c6b659fe4bcfb7243f2a61f4199aedca4998
-
Filesize
32KB
MD5da506cef4a6082587618a456b86e4e99
SHA12eeea4f81aefe55c49001b737bc85a1a0b07daca
SHA256a3b7ab4a82b6a98c29be628e6d4a030d414dcf1dcf4abd2ff2704cbe9c967fda
SHA512f403bd0fe265f5b4af33558cee9b1f6d181ac59a26b0b3100d6b658f44098c38a560478b1a116ee28579f3507e766130f3801c7e0110a5c580bb1f4e4712ffe1
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
133KB
MD5da58c86ba6ade2148681ff2f73967f35
SHA1c1546a8df70d3d44745a6aa414b0de2e890cc6b0
SHA2562c887831b619ca982cc4b9340834a117921a40a31d60057c401b6e99f4b1e299
SHA5129f56d514de313f2c49dae01729bd83453d0669701f97a1cc08173075fb8e310ac715a438fd51d97543365f19f2826de2910880771abeacd00a150638d43adb9b
-
Filesize
87KB
MD5acc8e074e39c84d267d813cba6b08640
SHA106ef406ec57825958c5c42e49a7a69d1c88de058
SHA2569041a9fa6f66cccf8a426a3c529f18cecbd32ae1f4d9e471473c1ec522f2c70a
SHA5124ec37c49f54b195a23183a2e82c61f7d54442f523a2304878a61fc5509116fea124f7485e722d7d20850ff63a86e5ca559d0df3c5422f118aae60f68aec9dda6
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
632KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
4KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB