Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system -
submitted
11/12/2023, 08:12
Static task
static1
Behavioral task
behavioral1
Sample
1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.exe
Resource
win10v2004-20231130-en
General
-
Target
1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.exe
-
Size
6.9MB
-
MD5
24c327b07283b8397f3d97ea000af087
-
SHA1
8ef62f622b7c5a1b718895cd50a94a91d9ab219c
-
SHA256
1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03
-
SHA512
6cbb6dedd4a0696d26509749128c652e921cbc5d398e0d8a3907da2c9b35484a2dc5f3b08f450bbc078e4d588969997d80249d984bbde6b588e94cac28829fa4
-
SSDEEP
98304:+CtQAsI29jHcxWjRTp6azZzB8hi4ZoEiAmP+xhctqd60dVADjhSF1O8lw3kBL7l7:jstjRJ/4ZoSQQhtd6sWDlSrM0BLRrzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2492 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp 2688 wmaformat.exe 1272 wmaformat.exe -
Loads dropped DLL 3 IoCs
pid Process 2492 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp 2492 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp 2492 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp -
Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 194.49.94.194 Destination IP 152.89.198.214 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
description ioc Process File created C:\Program Files (x86)\WMAFormat\bin\x86\is-IN60I.tmp 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\lessmsi\is-K1CDD.tmp 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\plugins\internal\is-0KU02.tmp 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp File created C:\Program Files (x86)\WMAFormat\uninstall\unins000.dat 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-PST51.tmp 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-73G6E.tmp 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp File created C:\Program Files (x86)\WMAFormat\stuff\is-ET3VJ.tmp 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-CHD4P.tmp 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp File created C:\Program Files (x86)\WMAFormat\stuff\is-93HEM.tmp 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-92OKM.tmp 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-335GH.tmp 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\plugins\internal\is-2PR8E.tmp 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-2SJ6O.tmp 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-RS5VJ.tmp 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-SV46D.tmp 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-RPFGS.tmp 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-MF8JM.tmp 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-S9DOU.tmp 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-HO002.tmp 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-N7MLT.tmp 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-U96EV.tmp 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-CHMCJ.tmp 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-AHJBL.tmp 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-M92MF.tmp 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-O53BU.tmp 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-P5V9F.tmp 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp File opened for modification C:\Program Files (x86)\WMAFormat\uninstall\unins000.dat 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp File created C:\Program Files (x86)\WMAFormat\stuff\is-1ASSD.tmp 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-9I1AT.tmp 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-C451O.tmp 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-CL6OL.tmp 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-PP1M8.tmp 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-VVLC3.tmp 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-HQ0V3.tmp 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-9C6QC.tmp 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp File opened for modification C:\Program Files (x86)\WMAFormat\wmaformat.exe 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-I2489.tmp 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-3TA3U.tmp 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-VT13N.tmp 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-E64GE.tmp 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-3OOT9.tmp 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-U7ERI.tmp 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp File created C:\Program Files (x86)\WMAFormat\is-NR64A.tmp 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp File created C:\Program Files (x86)\WMAFormat\uninstall\is-ULN5B.tmp 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-TAE3P.tmp 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp File created C:\Program Files (x86)\WMAFormat\stuff\is-V73FM.tmp 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-H3AI0.tmp 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-U23BM.tmp 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-VVE2B.tmp 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-MDSRS.tmp 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-EDRN5.tmp 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-8BOLB.tmp 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-P9AJK.tmp 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-LFA99.tmp 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-DJSAU.tmp 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-EH71K.tmp 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-66FCT.tmp 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-B11K9.tmp 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-21PRH.tmp 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-U07V1.tmp 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-GNNT5.tmp 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-5B225.tmp 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-4P03R.tmp 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp -
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2492 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 980 wrote to memory of 2492 980 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.exe 41 PID 980 wrote to memory of 2492 980 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.exe 41 PID 980 wrote to memory of 2492 980 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.exe 41 PID 2492 wrote to memory of 4924 2492 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp 91 PID 2492 wrote to memory of 4924 2492 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp 91 PID 2492 wrote to memory of 4924 2492 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp 91 PID 2492 wrote to memory of 2688 2492 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp 93 PID 2492 wrote to memory of 2688 2492 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp 93 PID 2492 wrote to memory of 2688 2492 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp 93 PID 2492 wrote to memory of 1044 2492 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp 94 PID 2492 wrote to memory of 1044 2492 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp 94 PID 2492 wrote to memory of 1044 2492 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp 94 PID 2492 wrote to memory of 1272 2492 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp 96 PID 2492 wrote to memory of 1272 2492 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp 96 PID 2492 wrote to memory of 1272 2492 1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp 96 PID 1044 wrote to memory of 3564 1044 net.exe 97 PID 1044 wrote to memory of 3564 1044 net.exe 97 PID 1044 wrote to memory of 3564 1044 net.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.exe"C:\Users\Admin\AppData\Local\Temp\1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Users\Admin\AppData\Local\Temp\is-NAQDG.tmp\1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp"C:\Users\Admin\AppData\Local\Temp\is-NAQDG.tmp\1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp" /SL5="$B0042,6990075,68096,C:\Users\Admin\AppData\Local\Temp\1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵PID:4924
-
-
C:\Program Files (x86)\WMAFormat\wmaformat.exe"C:\Program Files (x86)\WMAFormat\wmaformat.exe" -i3⤵
- Executes dropped EXE
PID:2688
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 114⤵PID:3564
-
-
-
C:\Program Files (x86)\WMAFormat\wmaformat.exe"C:\Program Files (x86)\WMAFormat\wmaformat.exe" -s3⤵
- Executes dropped EXE
PID:1272
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
503KB
MD538ce866ad0801ff361cfe07df5c83e77
SHA1b549e5beab06abd56fbc009c87790b46b4fd8cd5
SHA256f9ea86ff3da14ed8ce6310bfbf7b2409c8d55ad733aa55d8e8d73a1ae329b218
SHA512fa7362d97fc9efde371bf3cf63f3094e73d19d9b171356b1bd3ebdcd7165571354fedba7481683d7a6828719f75bb575857cf45011690846953b4b6f5cf885d4
-
Filesize
520KB
MD5bc7869aa253a32e244e382c4043c6e48
SHA1abf365acac9fdb1cc8690d8730e0713417b123d9
SHA256e631331bf14ec4071119f54db5e4634926996677672fd6eb58c321a52127e189
SHA5123ed1c8aef5e4af1a74622538e583f13d2fdb25274870ff637b4b3a6efd91fcfa670f20f6bae1719609208789cf2eb4f366ac4bd1f48e404b278002d2cc72b770
-
Filesize
335KB
MD515b10d08209c7d492f746d4120bb6591
SHA19d27f9621024178aca2d54b8c7febc03c10b61d6
SHA256f26ae765c27dd9ec4137e203866c44ddae2bf38dabf8970dbfa9124d1a1cd3b7
SHA512eb9190ec54278d26321b1bc6cb931a276cc60891f308f8e5c845f90ace74353d2ed8e867cedd3c88e95cbeb86c77c27d0c61589e5874419ac297bd310e8a8f41
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
C:\Users\Admin\AppData\Local\Temp\is-NAQDG.tmp\1b06cc4c3add95e3bf631253a52101c41bc4abfa752aef743f682c83ff843f03.tmp
Filesize687KB
MD5f448d7f4b76e5c9c3a4eaff16a8b9b73
SHA131808f1ffa84c954376975b7cdb0007e6b762488
SHA2567233b85eb0f8b3aa5cae3811d727aa8742fec4d1091c120a0fe15006f424cc49
SHA512f8197458cd2764c0b852dac34f9bf361110a7dc86903024a97c7bcd3f77b148342bf45e3c2b60f6af8198ae3b83938dbaad5e007d71a0f88006f3a0618cf36f4