Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
149s -
platform
windows10-1703_x64 -
resource
win10-20231129-en -
resource tags
arch:x64arch:x86image:win10-20231129-enlocale:en-usos:windows10-1703-x64system -
submitted
11/12/2023, 09:14
Static task
static1
Behavioral task
behavioral1
Sample
a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.exe
Resource
win10-20231129-en
General
-
Target
a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.exe
-
Size
6.9MB
-
MD5
c1a1a831f2866ae30b4be11578ab59c2
-
SHA1
c5850bbd412c1aa30450acb86cd108ca19d9db9d
-
SHA256
a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba
-
SHA512
7cd1d7828519ce057e44c4bf19841353e3b3b70b31e3384caecb4dc34db4a62a5e2560151246b546f4bd4a40d882770550207563706dde19dc221fab72c8381d
-
SSDEEP
98304:PzyQ4kc+v4jvDhsQepuwmrkz216aPE8d9X+X1M2CX27eGqc6hxTGZtsAzFjTidLb:mQ4PTP94zHQ9OX1M2CGjn6hDc6LKEzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 1512 a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp 4108 wmaformat.exe 4708 wmaformat.exe -
Loads dropped DLL 3 IoCs
pid Process 1512 a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp 1512 a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp 1512 a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 152.89.198.214 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
description ioc Process File created C:\Program Files (x86)\WMAFormat\bin\x86\is-F01G9.tmp a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-DQLOE.tmp a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\lessmsi\is-E686R.tmp a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-IS7K8.tmp a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-TC57K.tmp a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-DMJBI.tmp a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-6UR59.tmp a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-ORQ79.tmp a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-P1BM5.tmp a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-OV9LB.tmp a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\plugins\internal\is-U7OGM.tmp a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-MRNJC.tmp a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp File opened for modification C:\Program Files (x86)\WMAFormat\uninstall\unins000.dat a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-B1TQJ.tmp a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-FU2AO.tmp a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-EQ2LN.tmp a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-2TP0V.tmp a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-761QS.tmp a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-99D3L.tmp a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-DL0U4.tmp a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-MGGK1.tmp a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-H9PGC.tmp a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp File opened for modification C:\Program Files (x86)\WMAFormat\wmaformat.exe a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp File created C:\Program Files (x86)\WMAFormat\stuff\is-MKP5C.tmp a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-B28S2.tmp a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-1P41U.tmp a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-0O8NS.tmp a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-SUNC3.tmp a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-GU6QF.tmp a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-QSPFC.tmp a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-2D6T2.tmp a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-F159M.tmp a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-G67VL.tmp a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-F0EMT.tmp a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\plugins\internal\is-LTUE2.tmp a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-A3LL7.tmp a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-1LRSQ.tmp a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-1ANLK.tmp a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-HTFBG.tmp a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-J7KH4.tmp a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp File created C:\Program Files (x86)\WMAFormat\stuff\is-RO33R.tmp a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-G210V.tmp a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-0D9MG.tmp a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-AK26J.tmp a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-C7TPE.tmp a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-4U302.tmp a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp File created C:\Program Files (x86)\WMAFormat\stuff\is-KIP6J.tmp a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp File created C:\Program Files (x86)\WMAFormat\stuff\is-BUDAD.tmp a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-G7A8U.tmp a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-NR8RR.tmp a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-PQT4M.tmp a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-OJA20.tmp a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp File created C:\Program Files (x86)\WMAFormat\is-DIIR3.tmp a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp File created C:\Program Files (x86)\WMAFormat\uninstall\unins000.dat a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp File created C:\Program Files (x86)\WMAFormat\uninstall\is-78NUC.tmp a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-R8B6M.tmp a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-MQ6SC.tmp a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-VGE6J.tmp a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-TMJSH.tmp a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-BL3GE.tmp a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-AAG9J.tmp a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-1U2R7.tmp a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-FHGVE.tmp a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp -
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1512 a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 4048 wrote to memory of 1512 4048 a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.exe 74 PID 4048 wrote to memory of 1512 4048 a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.exe 74 PID 4048 wrote to memory of 1512 4048 a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.exe 74 PID 1512 wrote to memory of 1192 1512 a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp 75 PID 1512 wrote to memory of 1192 1512 a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp 75 PID 1512 wrote to memory of 1192 1512 a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp 75 PID 1512 wrote to memory of 4108 1512 a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp 76 PID 1512 wrote to memory of 4108 1512 a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp 76 PID 1512 wrote to memory of 4108 1512 a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp 76 PID 1512 wrote to memory of 2032 1512 a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp 81 PID 1512 wrote to memory of 2032 1512 a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp 81 PID 1512 wrote to memory of 2032 1512 a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp 81 PID 1512 wrote to memory of 4708 1512 a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp 79 PID 1512 wrote to memory of 4708 1512 a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp 79 PID 1512 wrote to memory of 4708 1512 a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp 79 PID 2032 wrote to memory of 4832 2032 net.exe 80 PID 2032 wrote to memory of 4832 2032 net.exe 80 PID 2032 wrote to memory of 4832 2032 net.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.exe"C:\Users\Admin\AppData\Local\Temp\a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\is-713B8.tmp\a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp"C:\Users\Admin\AppData\Local\Temp\is-713B8.tmp\a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp" /SL5="$901C8,6985458,68096,C:\Users\Admin\AppData\Local\Temp\a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵PID:1192
-
-
C:\Program Files (x86)\WMAFormat\wmaformat.exe"C:\Program Files (x86)\WMAFormat\wmaformat.exe" -i3⤵
- Executes dropped EXE
PID:4108
-
-
C:\Program Files (x86)\WMAFormat\wmaformat.exe"C:\Program Files (x86)\WMAFormat\wmaformat.exe" -s3⤵
- Executes dropped EXE
PID:4708
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
- Suspicious use of WriteProcessMemory
PID:2032
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 111⤵PID:4832
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
812KB
MD5dbb3879f119fb6284c36496c1825d58d
SHA1e243430c265676d43e6bdb35316a8673eeeda26a
SHA256999a16321cd890bc3d1f360ba773fe98b3ec83d127173cefff70ead2fa6d9333
SHA5125dcba3f634004a4dea692a963bf26900c05efc4335e026affe92635f48ec7c1b154829b7fc0f53c5fed22a5ae60ffcaa5c37dc5fef62c7a124086211daea570a
-
Filesize
810KB
MD5828c3c70989518eba5722e9fc6ef847d
SHA1521d80b01b1850dd5af5a0b57ee867ef74074be8
SHA2561a8b3f0fe330a30817014e2752064960a470328ce43c1e3ca9de2d74645c4508
SHA512ffaf387e2b225e209e0d3203f62d22bc0510217d320f3c463b5fd6f31304070f9099d84834e317ccbe83df591a41e96d710ad2e592f1b4ebc0f45940b7b31a3d
-
Filesize
718KB
MD50e2e964a151901ada356f04da129a719
SHA12abecdbcf3195ef9f465b6b5881582667ad905cb
SHA256a963a1a02176591372df075ec81aeb5a3fbce0c82b251fc446ef9ef0eb0b9da6
SHA5123a3806b2891582fafe92a75c59c1a5e70b84d709dedc118b4471bffbe95ec6fee2fa1125982a5c03a54f24a1024132574c33e886cb5ba937b09fdaac6f39eb48
-
C:\Users\Admin\AppData\Local\Temp\is-713B8.tmp\a428e93a3889454b32800b80b1b83bafb0ae26cfaf01430a6c79faa8b279e3ba.tmp
Filesize687KB
MD5f448d7f4b76e5c9c3a4eaff16a8b9b73
SHA131808f1ffa84c954376975b7cdb0007e6b762488
SHA2567233b85eb0f8b3aa5cae3811d727aa8742fec4d1091c120a0fe15006f424cc49
SHA512f8197458cd2764c0b852dac34f9bf361110a7dc86903024a97c7bcd3f77b148342bf45e3c2b60f6af8198ae3b83938dbaad5e007d71a0f88006f3a0618cf36f4
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303