Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
133s -
platform
windows10-1703_x64 -
resource
win10-20231020-en -
resource tags
-
submitted
11/12/2023, 08:31
General
-
Target
93997b8dbff9da7d6037606742162aba9c7a8908fbcf4e7f9e54eb1cb7727eff.exe
-
Size
6.9MB
-
MD5
cce9f3a178ccb5cfc1e6be8c18470b13
-
SHA1
a26bc6f113f58b7040c592f857edf58212dc473c
-
SHA256
93997b8dbff9da7d6037606742162aba9c7a8908fbcf4e7f9e54eb1cb7727eff
-
SHA512
86f636deff1b4a66dda4d72b03d9adaf761651e2c62d1794d3df286efca4c5b035e481d7847545609d76e9079c0833f9c62e63041a5a5fa618d28ff197eaf82c
-
SSDEEP
196608:1H/2cOhoGEpX+jRFRvz29jgM7+3Utny3r/mvZO0agzj:scOhoGE1ArRvqlgM7xtAT0Hzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\93997b8dbff9da7d6037606742162aba9c7a8908fbcf4e7f9e54eb1cb7727eff.exe"C:\Users\Admin\AppData\Local\Temp\93997b8dbff9da7d6037606742162aba9c7a8908fbcf4e7f9e54eb1cb7727eff.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-7DV11.tmp\93997b8dbff9da7d6037606742162aba9c7a8908fbcf4e7f9e54eb1cb7727eff.tmp"C:\Users\Admin\AppData\Local\Temp\is-7DV11.tmp\93997b8dbff9da7d6037606742162aba9c7a8908fbcf4e7f9e54eb1cb7727eff.tmp" /SL5="$D01D4,6982471,68096,C:\Users\Admin\AppData\Local\Temp\93997b8dbff9da7d6037606742162aba9c7a8908fbcf4e7f9e54eb1cb7727eff.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
C:\Program Files (x86)\WMAFormat\wmaformat.exe"C:\Program Files (x86)\WMAFormat\wmaformat.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\WMAFormat\wmaformat.exe"C:\Program Files (x86)\WMAFormat\wmaformat.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 114⤵
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD508527fdc405d9af23a6963e437332098
SHA153e0d6aa4e718380eff611cfc0ce94a6d3b39441
SHA25698eb9b75bc877cecf3a1611192cd6c8b2ffc04a44b15191e3ce35cf0a03a454b
SHA512dd5fd4b649e33a74005040656186d9a8cf29965e82a9676be7312fcc0d4215998ff3849f1099337f5e5431a92d4c895d1e6c3b2e90b020403f52f8d1ec257f48
-
Filesize
112KB
MD51a6e495074422e16e0de45d8f49fce85
SHA15021b81d2a8fce695acbd6ffee414bf80ced402c
SHA2566c90dc8f229805c092784a6581ee27e8ca61f07b428422b0c0d1813d16a7da52
SHA5129c7b7154f588910ca1e734f91b390ced67aedd6ae279bed5242c95fc61345f0b803c53c7efcf59bf721f2a8a915cbad4b622676688f593b96feb2e120f84b787
-
Filesize
13KB
MD5f089f6eb7bf13b41eb6346520628cf23
SHA11ee9fa5a1a64de38bee445a6de4d10855ff26c76
SHA256c59ca0108b004ad7c49181c228326e148969cbc586ff91c041a93d6ba36d7a49
SHA5125e084c03d66587f0e1780431907fc907706773a6a1accd747ff6a705dee7df6b67adbfd0d425274afa261f38922cc610625d12f2ed319d481fc83214f5bdb264
-
Filesize
558KB
MD528520606f0e446231b64e46a4c1742e6
SHA14bf4d58f0cc087c646be6b847689f93218d3bc3c
SHA2564284087de089f3c937cffd41fbef12e43ddf6a5de607dafc5b22faad39ae3251
SHA512e82605f04ae9ba75728d53c6f4e05d85389be50c94885a0f38153b6e7f7beae6a7a86d515f174c39e2acb2c33160e877415a2d2df30cae669836a1ad440039fe
-
Filesize
251KB
MD5a88abfb4d9bd324994666b2e5fc851f7
SHA1d5390def5b1a0a45e695c5eb6725ce9c1502e12f
SHA25638882fdccb90fb5822b7fca7ced97b5a5a1badf35d34204dcc65ef1adabb21f6
SHA512338263afbd0f9f0f2dc0650ade61a20ce564b399bb4fb239afdd1ce36f85fc62060874ecc3d516fe19ff874a0e58238dd593193325f180a94f71367510199088
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
4KB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB