Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1s -
max time network
142s -
platform
windows10-1703_x64 -
resource
win10-20231129-en -
resource tags
-
submitted
11/12/2023, 05:19
General
-
Target
26ecea010f73203e6170bc428906165c44b80d2029359fa4763e902699c46717.exe
-
Size
6.9MB
-
MD5
9042957cff26f1e056c5b7de2f21372c
-
SHA1
cf12877a728d6cca4a51253adedfda228e45674c
-
SHA256
26ecea010f73203e6170bc428906165c44b80d2029359fa4763e902699c46717
-
SHA512
5f8ce63d59e829f7440039238600d74c8b831457cf9bcb76aad701f5f78f6d888dac4ece583148f1d49e9b419680b73df5c5059b46b28fadfbdb4ed5691af438
-
SSDEEP
98304:izyQ4kc+v4jvDhsQepuwmrkz216aPE8d9X+X1M2CX27eGqc6hxTGZtsAzFjTidLb:3Q4PTP94zHQ9OX1M2CGjn6hDc6LKEzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\26ecea010f73203e6170bc428906165c44b80d2029359fa4763e902699c46717.exe"C:\Users\Admin\AppData\Local\Temp\26ecea010f73203e6170bc428906165c44b80d2029359fa4763e902699c46717.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-BFF2S.tmp\26ecea010f73203e6170bc428906165c44b80d2029359fa4763e902699c46717.tmp"C:\Users\Admin\AppData\Local\Temp\is-BFF2S.tmp\26ecea010f73203e6170bc428906165c44b80d2029359fa4763e902699c46717.tmp" /SL5="$50232,6985458,68096,C:\Users\Admin\AppData\Local\Temp\26ecea010f73203e6170bc428906165c44b80d2029359fa4763e902699c46717.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\WMAFormat\wmaformat.exe"C:\Program Files (x86)\WMAFormat\wmaformat.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
-
-
C:\Program Files (x86)\WMAFormat\wmaformat.exe"C:\Program Files (x86)\WMAFormat\wmaformat.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 111⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14KB
MD5c23f440466c7d54f9737228a9dce4f37
SHA13266f7e8cc7bc22be631a8856e7d59d0a965e7de
SHA256c8f8b0041167c449d793b8dfff1ccf97c95c0e7ae2e641c078a7527af4efb815
SHA51222a4d00376abf396bc827cf9cf9dfde768a93bf4474fffc29a7053640475a86f588da9326d5ecbda2bebef7452d4262e6974f85d0cfd09047cc75049eeb8b383
-
Filesize
7KB
MD594170dc8a6bfdd3798a7993626759d6f
SHA10cb4677c51ea7e0d4047d0c154eb614accd55820
SHA256f7e12bf21031ce155ace40d8099ad2abd5a5d707ff4c01de0ddc4459148864a4
SHA51235ba0661afb22a50a8dfe93fc55b72fd792f52d4a459e3dcdc92e9f1a73332f52bb633cfae2c87b09ec81fbbfcc5c23f62557b2232485858553da1bdd82ac64a
-
Filesize
36KB
MD5b64d6f6e29e34f5d54aa001985f51724
SHA1b5174473e3e4040f65f30fcb28784a37ac306fd6
SHA256da72dea6557e495f512c71f13ca74b9f70b78e4fc1ecc7ba181e4fdb008fdb52
SHA512829ad06f8e426f7266283bcbad4d6c1b54ef2e5e76f57f8aa012a6e15e39ae26336d76cb89b08fcf1f6f910256be12294976ce0684ac5bbeedd6048e733a438e
-
Filesize
23KB
MD5929b4dda04c3e19bf09d28aaa3fa8ca8
SHA1fa84390f6d4cfef45ac6cb0e027ccdfa9f788b82
SHA2565bfb2ae82f8ea133844e8ccab9b8367ebc8b07064eea287a7ca64d384492aefb
SHA512de2215d9dc1bdc62b5d480984cc676330280bb3b1e884bb66e440afe58f275e545dbaca86b8641b5cfc949e921fdc9ef49441c7c43f4779bd03020348c1e446f
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
632KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
4KB