Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    151s
  • platform
    windows10-1703_x64
  • resource
    win10-20231129-en
  • resource tags

    arch:x64arch:x86image:win10-20231129-enlocale:en-usos:windows10-1703-x64system
  • submitted
    11/12/2023, 07:16

General

  • Target

    8daf7f82e39a14ee949c67e006dda4860a1abbc07ea4d9546fc4ddd451561d47.exe

  • Size

    6.9MB

  • MD5

    ab2a0bc6e24d1f1fbc574621bc7a80c3

  • SHA1

    d87450d9117bf583e39458db96e84be75e24c405

  • SHA256

    8daf7f82e39a14ee949c67e006dda4860a1abbc07ea4d9546fc4ddd451561d47

  • SHA512

    b28105fee27f1deb196dcd4eea27d1395a4813949f5d47d098c38a0f08651990432bf89ae1be8f37b12d7ae1e3fb465506b54e041fa2d4e69c513c05412c60b1

  • SSDEEP

    196608:YH/2cOhoGEpX+jRFRvz29jgM7+3Utny3r/mvZO0agzj:NcOhoGE1ArRvqlgM7xtAT0Hzj

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 63 IoCs
  • Runs net.exe
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8daf7f82e39a14ee949c67e006dda4860a1abbc07ea4d9546fc4ddd451561d47.exe
    "C:\Users\Admin\AppData\Local\Temp\8daf7f82e39a14ee949c67e006dda4860a1abbc07ea4d9546fc4ddd451561d47.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4456
    • C:\Users\Admin\AppData\Local\Temp\is-LBN7Q.tmp\8daf7f82e39a14ee949c67e006dda4860a1abbc07ea4d9546fc4ddd451561d47.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-LBN7Q.tmp\8daf7f82e39a14ee949c67e006dda4860a1abbc07ea4d9546fc4ddd451561d47.tmp" /SL5="$701C8,6982471,68096,C:\Users\Admin\AppData\Local\Temp\8daf7f82e39a14ee949c67e006dda4860a1abbc07ea4d9546fc4ddd451561d47.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1124
      • C:\Program Files (x86)\WMAFormat\wmaformat.exe
        "C:\Program Files (x86)\WMAFormat\wmaformat.exe" -i
        3⤵
        • Executes dropped EXE
        PID:3424
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\system32\schtasks.exe" /Query
        3⤵
          PID:692
        • C:\Windows\SysWOW64\net.exe
          "C:\Windows\system32\net.exe" helpmsg 11
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4272
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 helpmsg 11
            4⤵
              PID:2692
          • C:\Program Files (x86)\WMAFormat\wmaformat.exe
            "C:\Program Files (x86)\WMAFormat\wmaformat.exe" -s
            3⤵
            • Executes dropped EXE
            PID:1772

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\WMAFormat\wmaformat.exe

        Filesize

        221KB

        MD5

        342ce104cfe3a3cf919cdf706baf0287

        SHA1

        967449ce2d80d9eb4721cdda5308ab599fe395f8

        SHA256

        017f0663c5ee852d07e9089316f85d96e2ce865d5acc531e9045b36e586fb5cd

        SHA512

        6f0935b01d1d4a540c409964905a2a65768dc1ba26c8fba425414317eafd135b1d7d4de6a692dc2d290c850a4e8150b63a40e6c48ff294ea2fa2fc7575858457

      • C:\Program Files (x86)\WMAFormat\wmaformat.exe

        Filesize

        165KB

        MD5

        ddf11c33f9668a6e0f70859c42281532

        SHA1

        098a768789d09dc5157ff846a0c03fcf95de8001

        SHA256

        e0e80bd01d67d2adae6272b734f53fc5ddc9d08e76a6a878c2fc2df77ce191b1

        SHA512

        5c246695cbb8592d47fa751a82c191d40685bbddd4ccca80b3e98007cd9b6942191ec518c3e9bfdfa6bbc5fdd0c20eb0239b03a3c463120f7f2408043a8ed0ed

      • C:\Program Files (x86)\WMAFormat\wmaformat.exe

        Filesize

        66KB

        MD5

        20b59280cb9673a3a9cacc57ceeec31c

        SHA1

        5a902f4775396017fed32db65f60d8eae392ddbb

        SHA256

        49d789f0567fa0bdfa580e36195562dcbd13aa85231202a843bb03b2a55a0430

        SHA512

        2d95b75bd707d7f40b124e731745b731e0ceaf47aa7a15c90ec9447e95b4de25cc6cd50f9a440d8bad184b1983cb9a55d889d469ffe25f5ec7bf7f4e97de2e02

      • C:\Users\Admin\AppData\Local\Temp\is-LBN7Q.tmp\8daf7f82e39a14ee949c67e006dda4860a1abbc07ea4d9546fc4ddd451561d47.tmp

        Filesize

        687KB

        MD5

        f448d7f4b76e5c9c3a4eaff16a8b9b73

        SHA1

        31808f1ffa84c954376975b7cdb0007e6b762488

        SHA256

        7233b85eb0f8b3aa5cae3811d727aa8742fec4d1091c120a0fe15006f424cc49

        SHA512

        f8197458cd2764c0b852dac34f9bf361110a7dc86903024a97c7bcd3f77b148342bf45e3c2b60f6af8198ae3b83938dbaad5e007d71a0f88006f3a0618cf36f4

      • \Users\Admin\AppData\Local\Temp\is-2Q7B6.tmp\_isetup\_iscrypt.dll

        Filesize

        2KB

        MD5

        a69559718ab506675e907fe49deb71e9

        SHA1

        bc8f404ffdb1960b50c12ff9413c893b56f2e36f

        SHA256

        2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

        SHA512

        e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

      • \Users\Admin\AppData\Local\Temp\is-2Q7B6.tmp\_isetup\_isdecmp.dll

        Filesize

        19KB

        MD5

        3adaa386b671c2df3bae5b39dc093008

        SHA1

        067cf95fbdb922d81db58432c46930f86d23dded

        SHA256

        71cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38

        SHA512

        bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303

      • memory/1124-6-0x00000000001F0000-0x00000000001F1000-memory.dmp

        Filesize

        4KB

      • memory/1124-162-0x00000000001F0000-0x00000000001F1000-memory.dmp

        Filesize

        4KB

      • memory/1124-160-0x0000000000400000-0x00000000004BC000-memory.dmp

        Filesize

        752KB

      • memory/1772-182-0x00000000008B0000-0x000000000094E000-memory.dmp

        Filesize

        632KB

      • memory/1772-192-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/1772-158-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/1772-157-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/1772-208-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/1772-205-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/1772-161-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/1772-202-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/1772-164-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/1772-166-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/1772-169-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/1772-172-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/1772-175-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/1772-177-0x00000000008B0000-0x000000000094E000-memory.dmp

        Filesize

        632KB

      • memory/1772-181-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/1772-198-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/1772-185-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/1772-188-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/1772-189-0x00000000008B0000-0x000000000094E000-memory.dmp

        Filesize

        632KB

      • memory/1772-195-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/3424-154-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/3424-150-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/3424-151-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/4456-0-0x0000000000400000-0x0000000000418000-memory.dmp

        Filesize

        96KB

      • memory/4456-159-0x0000000000400000-0x0000000000418000-memory.dmp

        Filesize

        96KB