Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
124s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system -
submitted
11/12/2023, 08:14
Static task
static1
Behavioral task
behavioral1
Sample
bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.exe
Resource
win10v2004-20231127-en
General
-
Target
bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.exe
-
Size
6.9MB
-
MD5
5300d719502d276812d861d16c582b80
-
SHA1
f559fe14fc11b32b3e7c214a297a5e51422173ef
-
SHA256
bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916
-
SHA512
dbdabc1abf3b58f0fc851c166c54f3f0b52361f33c4ab4fce5ef3ac16ae4ba13f8db8ffc2db21b06e03cc37160e36e2bfa7b36413a5e41b018590769a3b4b3ce
-
SSDEEP
98304:LCtQAsI29jHcxWjRTp6azZzB8hi4ZoEiAmP+xhctqd60dVADjhSF1O8lw3kBL7l7:AstjRJ/4ZoSQQhtd6sWDlSrM0BLRrzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 4652 bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp 1044 wmaformat.exe 4688 wmaformat.exe -
Loads dropped DLL 3 IoCs
pid Process 4652 bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp 4652 bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp 4652 bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 81.31.197.38 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
description ioc Process File created C:\Program Files (x86)\WMAFormat\uninstall\unins000.dat bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\plugins\internal\is-I3RD4.tmp bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-9OSI2.tmp bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-3K7UM.tmp bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-Q0R57.tmp bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-62HUC.tmp bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-FGAHS.tmp bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-RIUAE.tmp bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-ARH7J.tmp bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-NJUIG.tmp bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp File created C:\Program Files (x86)\WMAFormat\uninstall\is-0EVEJ.tmp bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp File created C:\Program Files (x86)\WMAFormat\stuff\is-MRKVV.tmp bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-GECMA.tmp bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-PQUV5.tmp bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-9LLHO.tmp bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-CR4P9.tmp bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-MBDM2.tmp bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-KCU69.tmp bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-EV823.tmp bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp File created C:\Program Files (x86)\WMAFormat\is-TNS4L.tmp bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp File created C:\Program Files (x86)\WMAFormat\stuff\is-RNJNQ.tmp bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-DHB5P.tmp bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-4UA03.tmp bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-HBEH1.tmp bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-IE0P2.tmp bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-S2LHP.tmp bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp File opened for modification C:\Program Files (x86)\WMAFormat\wmaformat.exe bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-1VMEB.tmp bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-S8EJF.tmp bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-VRC7H.tmp bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-3CCRH.tmp bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-7GLKH.tmp bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp File created C:\Program Files (x86)\WMAFormat\stuff\is-7LRCE.tmp bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-7K4TN.tmp bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-08UJJ.tmp bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-162M8.tmp bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-6T6UE.tmp bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-D3C83.tmp bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-12LRH.tmp bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-UBPE3.tmp bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-UNDVQ.tmp bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-BAD5F.tmp bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\plugins\internal\is-NS9AA.tmp bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp File opened for modification C:\Program Files (x86)\WMAFormat\uninstall\unins000.dat bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-JMQ7J.tmp bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-7O172.tmp bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-ATP3N.tmp bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-A0AR4.tmp bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-EO3F5.tmp bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\lessmsi\is-CCLEU.tmp bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp File created C:\Program Files (x86)\WMAFormat\stuff\is-RF8L1.tmp bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-EH3MS.tmp bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-NNTG3.tmp bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-J44C6.tmp bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-KI9BL.tmp bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-NCRLT.tmp bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-IOA8U.tmp bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-GJKR5.tmp bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-MNH90.tmp bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-CRTQJ.tmp bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-6BQNR.tmp bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-VAN9H.tmp bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-FRRVK.tmp bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp -
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4652 bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2908 wrote to memory of 4652 2908 bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.exe 46 PID 2908 wrote to memory of 4652 2908 bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.exe 46 PID 2908 wrote to memory of 4652 2908 bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.exe 46 PID 4652 wrote to memory of 4664 4652 bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp 90 PID 4652 wrote to memory of 4664 4652 bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp 90 PID 4652 wrote to memory of 4664 4652 bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp 90 PID 4652 wrote to memory of 1044 4652 bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp 91 PID 4652 wrote to memory of 1044 4652 bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp 91 PID 4652 wrote to memory of 1044 4652 bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp 91 PID 4652 wrote to memory of 1080 4652 bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp 94 PID 4652 wrote to memory of 1080 4652 bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp 94 PID 4652 wrote to memory of 1080 4652 bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp 94 PID 4652 wrote to memory of 4688 4652 bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp 92 PID 4652 wrote to memory of 4688 4652 bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp 92 PID 4652 wrote to memory of 4688 4652 bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp 92 PID 1080 wrote to memory of 3208 1080 net.exe 96 PID 1080 wrote to memory of 3208 1080 net.exe 96 PID 1080 wrote to memory of 3208 1080 net.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.exe"C:\Users\Admin\AppData\Local\Temp\bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\is-O56F8.tmp\bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp"C:\Users\Admin\AppData\Local\Temp\is-O56F8.tmp\bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp" /SL5="$9006A,6990075,68096,C:\Users\Admin\AppData\Local\Temp\bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵PID:4664
-
-
C:\Program Files (x86)\WMAFormat\wmaformat.exe"C:\Program Files (x86)\WMAFormat\wmaformat.exe" -i3⤵
- Executes dropped EXE
PID:1044
-
-
C:\Program Files (x86)\WMAFormat\wmaformat.exe"C:\Program Files (x86)\WMAFormat\wmaformat.exe" -s3⤵
- Executes dropped EXE
PID:4688
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 114⤵PID:3208
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
414KB
MD535f272adb51770a9766fbb4ca17c406f
SHA1b5079f1b04d2806e0a34cc71d874cabc8405bfa0
SHA25615abcb0c3b52305e41e57bb5dc61b47d7e3fd2e56044837770dcfe3aae818bd4
SHA51238474b29794ad1ccfd2679b1d21843fda51e4e6c69964bc66771baf6b1912c78b0684e2d12cecd96469e8090adafb5da553e5b8d57d6ecaa6e933a44bb870bc9
-
Filesize
288KB
MD5b620ab4bb9de57ec1f67dc080a7833cf
SHA1e34e334eccabfe24a9ba7fc57097edec5e8ee000
SHA2560814c8ee58e529ae5ad9de71f1e39afa277187aa4f0a8d6d40b1fdf46b1d30ce
SHA5122b5963f3d867f065c12b3792d59ff32332ea4c7a6896d9109fcefb84e4a5cf0362d8f309f1f9167c92d8e0af9ef523e1534038468bc812b411c2358fd605b0b3
-
Filesize
158KB
MD5e64c66c3032e60b2ac8a9ffb0776e586
SHA12152ed35cb10d702f147dfd10dce0300c9f03468
SHA256c41da10296e41ce3fe81b3744c4d405cc9880af0d25fcbb7c071235dd1e745e1
SHA512733a78c6351ffb1477ea8893660bc912b90241678eff92a1a81ad5164e0ca538b2e0ded9f28781b4f02b29172d01b8031a150177b7f82f6f1bc6af907c95d4c7
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
C:\Users\Admin\AppData\Local\Temp\is-O56F8.tmp\bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp
Filesize488KB
MD536f5ba0fb4f24de08a587093b81f1453
SHA1ffa96cbbd5a212271de185af0f3c606ae94486b2
SHA256e5415318ae39c46b02a9641dd24c9258970d41e5fa6fda80026adb596e322c46
SHA512b48f6d10bbcb9fc7d7ef388de22ff8ae8b8d85d7d2c3867024521775616b5837bcf639e64253237af3d7ec34d7507c6b5c874a0d23faf06f9bcf9c6d941ff021
-
C:\Users\Admin\AppData\Local\Temp\is-O56F8.tmp\bcc667a87e61c73c4022b23fde6645a33b62539ad95bcd8e2e31e48b8c3d9916.tmp
Filesize447KB
MD5bd3b79d1521aff9d9616f2394bb6299d
SHA1145a1239b7db71f6c6b955de3aa767f8b214230a
SHA256fb6c3361102bb9b5d79acce73f0e2d18ac222f46a5546f24bb370485fca5857d
SHA5124cd1f4850e74d120a4080f631c8b051900954b10123b16e9d754b3c13abd941f2f140efefca3aa6381e3b9d2047f205c2be000ed6a9d75017c0c370f070b0c97