Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system -
submitted
11/12/2023, 08:53
Static task
static1
Behavioral task
behavioral1
Sample
9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.exe
Resource
win10v2004-20231127-en
General
-
Target
9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.exe
-
Size
6.9MB
-
MD5
085cf2c1e8f3eb1366960607373a4f69
-
SHA1
f88c67e2d5893e0e2c8af3df15c4914a18b0b0a3
-
SHA256
9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544
-
SHA512
dd9d5265dee9eee8e69003fe63a60a99a71d1fef0d2b6bc377e81f55d9bb6045fa1b96d7a1c8a3b4d7c024939f2d78ac0ea805ffee51d3bb8dfeb2349875247d
-
SSDEEP
98304:OCtQAsI29jHcxWjRTp6azZzB8hi4ZoEiAmP+xhctqd60dVADjhSF1O8lw3kBL7l7:TstjRJ/4ZoSQQhtd6sWDlSrM0BLRrzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 332 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp 2212 wmaformat.exe 2488 wmaformat.exe -
Loads dropped DLL 3 IoCs
pid Process 332 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp 332 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp 332 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 152.89.198.214 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
description ioc Process File created C:\Program Files (x86)\WMAFormat\bin\x86\is-E3DRK.tmp 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-E52LQ.tmp 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp File created C:\Program Files (x86)\WMAFormat\stuff\is-AQSPD.tmp 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-A7BCN.tmp 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-DR7AR.tmp 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-4611J.tmp 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp File opened for modification C:\Program Files (x86)\WMAFormat\wmaformat.exe 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp File created C:\Program Files (x86)\WMAFormat\stuff\is-JUMSG.tmp 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-1K88D.tmp 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-DGS5T.tmp 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-MQ9PI.tmp 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-CUEHA.tmp 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-IFU5D.tmp 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\lessmsi\is-25OMH.tmp 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-8KHAE.tmp 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\plugins\internal\is-OJQMR.tmp 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-KBKU7.tmp 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-JTRKK.tmp 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-04MAN.tmp 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\plugins\internal\is-HVM86.tmp 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-MS9KN.tmp 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-QURVJ.tmp 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp File created C:\Program Files (x86)\WMAFormat\stuff\is-QPBRN.tmp 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-OG801.tmp 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-D4MHC.tmp 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-UOPLS.tmp 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-K36V4.tmp 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp File created C:\Program Files (x86)\WMAFormat\uninstall\is-F7R1O.tmp 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-3K498.tmp 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-G5S41.tmp 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-UML3A.tmp 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-4LQG0.tmp 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-QFVNP.tmp 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-CJD2S.tmp 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-PITI3.tmp 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp File created C:\Program Files (x86)\WMAFormat\stuff\is-VO7U8.tmp 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-8CRCT.tmp 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-RA591.tmp 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-S2ODE.tmp 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-Q65J1.tmp 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-2KTSP.tmp 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-5VP9F.tmp 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-A1P6N.tmp 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-Q5VB1.tmp 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-EAHV4.tmp 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-I1GS9.tmp 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-PE8BO.tmp 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-V8TMO.tmp 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-SSTK7.tmp 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-KAAGD.tmp 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp File created C:\Program Files (x86)\WMAFormat\is-5IAPN.tmp 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-HCLUP.tmp 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp File opened for modification C:\Program Files (x86)\WMAFormat\uninstall\unins000.dat 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-KC7RD.tmp 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-64PGG.tmp 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-AT5K1.tmp 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-E7DSG.tmp 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-GFE3O.tmp 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-R5UG4.tmp 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-16A2P.tmp 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-OJDLM.tmp 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-8GFH8.tmp 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp File created C:\Program Files (x86)\WMAFormat\uninstall\unins000.dat 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp -
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 332 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 4112 wrote to memory of 332 4112 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.exe 87 PID 4112 wrote to memory of 332 4112 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.exe 87 PID 4112 wrote to memory of 332 4112 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.exe 87 PID 332 wrote to memory of 2320 332 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp 90 PID 332 wrote to memory of 2320 332 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp 90 PID 332 wrote to memory of 2320 332 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp 90 PID 332 wrote to memory of 2212 332 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp 91 PID 332 wrote to memory of 2212 332 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp 91 PID 332 wrote to memory of 2212 332 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp 91 PID 332 wrote to memory of 4372 332 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp 95 PID 332 wrote to memory of 4372 332 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp 95 PID 332 wrote to memory of 4372 332 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp 95 PID 332 wrote to memory of 2488 332 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp 94 PID 332 wrote to memory of 2488 332 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp 94 PID 332 wrote to memory of 2488 332 9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp 94 PID 4372 wrote to memory of 1192 4372 net.exe 96 PID 4372 wrote to memory of 1192 4372 net.exe 96 PID 4372 wrote to memory of 1192 4372 net.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.exe"C:\Users\Admin\AppData\Local\Temp\9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\is-NPSQF.tmp\9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp"C:\Users\Admin\AppData\Local\Temp\is-NPSQF.tmp\9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp" /SL5="$60066,6990075,68096,C:\Users\Admin\AppData\Local\Temp\9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:332 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵PID:2320
-
-
C:\Program Files (x86)\WMAFormat\wmaformat.exe"C:\Program Files (x86)\WMAFormat\wmaformat.exe" -i3⤵
- Executes dropped EXE
PID:2212
-
-
C:\Program Files (x86)\WMAFormat\wmaformat.exe"C:\Program Files (x86)\WMAFormat\wmaformat.exe" -s3⤵
- Executes dropped EXE
PID:2488
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 114⤵PID:1192
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
788KB
MD5b126ede2e2ad5c1ff3f29961923f126b
SHA19d022acd3ef70c14d89eee5942a84090831e962f
SHA2569526bb48342d3259e6fa91d38e0560ba9016d3111c4a4298cc60378822035a35
SHA512def28fd2501967c6057c91c954bd98ce9e05e3eed27eef254c3948b0b38723632e3e6d875061bb0d62d9c4976cb1e7273e89cb2d22e5591017c462b3edcec984
-
Filesize
1.1MB
MD59376faea07c54e7c6f8a492f29f494ef
SHA1484a7e24167196ef6dfa61c43bd6fcb456b0c965
SHA25637a876e49f7b71ef38390a48719d1574334a4047d4a63f0d1c6d9ca6bf9990be
SHA5126c8d33ca3c3a2c220d7ac399a8fffc513121e96a4a09209ce49b59f0647d13f3c762aff5e44c2a83e9bf38914cc59351703ec8e17ec49ef0dd1c2191bee64988
-
Filesize
346KB
MD54760bae25dd2c1d3a9f43339bb4dc60d
SHA1773038ddba24e4012cd3fbd83ec40afe80ac199f
SHA25620c1020bdb170f5c67953f75275bf3d5b252a8e93f4367073723a3ee058016b5
SHA5120a2b637ddb15475be81b47a459b1c48aeaea8eb079c23addc0e82888d5944a9644aa31a5ac0e540a16a07f40e6b00d11e1674d2c67d76a70b3dbdb0f4d4e7690
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
C:\Users\Admin\AppData\Local\Temp\is-NPSQF.tmp\9761d200a86a0d43d9d3edbbcf10d1ab7f41e26676aebec77edfb2a64bef4544.tmp
Filesize687KB
MD5f448d7f4b76e5c9c3a4eaff16a8b9b73
SHA131808f1ffa84c954376975b7cdb0007e6b762488
SHA2567233b85eb0f8b3aa5cae3811d727aa8742fec4d1091c120a0fe15006f424cc49
SHA512f8197458cd2764c0b852dac34f9bf361110a7dc86903024a97c7bcd3f77b148342bf45e3c2b60f6af8198ae3b83938dbaad5e007d71a0f88006f3a0618cf36f4