Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system -
submitted
11/12/2023, 10:02
Static task
static1
Behavioral task
behavioral1
Sample
191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.exe
Resource
win10v2004-20231127-en
General
-
Target
191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.exe
-
Size
6.9MB
-
MD5
28d1d72f94921e68ec36847a344092e9
-
SHA1
71242b265a543173b5db10fb4412e7841e384da6
-
SHA256
191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4
-
SHA512
c06631ed36fdf1d9ce749798f8cb8576d2c7d34695036a17c036f5008f960a3e94314b4ae18da3649dd6493881de353d999d6ca93c92c63dddaec5f512d4db04
-
SSDEEP
196608:IRW8Bq+q3WGhRQY914E1DF+V3bm/LCGNq3eUeKP3gdVfzj:IQeqbhPK4DFY4CtOUYVfzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 4404 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp 3988 wmaformat.exe 5104 wmaformat.exe -
Loads dropped DLL 3 IoCs
pid Process 4404 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp 4404 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp 4404 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 81.31.197.38 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
description ioc Process File created C:\Program Files (x86)\WMAFormat\stuff\is-04IU0.tmp 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-B3V9C.tmp 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-B0MH4.tmp 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-01UIM.tmp 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-T31TO.tmp 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp File created C:\Program Files (x86)\WMAFormat\stuff\is-E4KGF.tmp 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-9LUN3.tmp 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-90ND4.tmp 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-33O1G.tmp 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-1JBFK.tmp 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-R40GU.tmp 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\lessmsi\is-MSFGR.tmp 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-MKFGU.tmp 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp File opened for modification C:\Program Files (x86)\WMAFormat\uninstall\unins000.dat 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-QGL1M.tmp 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-JJR6I.tmp 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-G7R1F.tmp 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-2381J.tmp 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-RBKSC.tmp 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-2K5VG.tmp 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-97GT5.tmp 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-SUOH9.tmp 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-AF4KE.tmp 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-HC3T5.tmp 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp File created C:\Program Files (x86)\WMAFormat\uninstall\is-4TIBK.tmp 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-7RQFL.tmp 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-RLHLB.tmp 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-T8TFK.tmp 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-M5IM7.tmp 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-GB9R8.tmp 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\plugins\internal\is-VD6U8.tmp 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp File created C:\Program Files (x86)\WMAFormat\stuff\is-2EMI7.tmp 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-RUH0F.tmp 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-KHGPN.tmp 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp File created C:\Program Files (x86)\WMAFormat\stuff\is-24D63.tmp 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-UHVP3.tmp 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-LFQGR.tmp 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp File created C:\Program Files (x86)\WMAFormat\uninstall\unins000.dat 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-AAFOM.tmp 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-PPEKF.tmp 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp File opened for modification C:\Program Files (x86)\WMAFormat\wmaformat.exe 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-J4JE3.tmp 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-EC4CJ.tmp 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-KI0AU.tmp 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-EJI18.tmp 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-LD8RL.tmp 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-BUK38.tmp 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-7Q89N.tmp 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-0PNIQ.tmp 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-MCQKQ.tmp 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-9RL00.tmp 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-9MDBF.tmp 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-GKDK9.tmp 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-UFQ6K.tmp 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-060C6.tmp 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-KOL32.tmp 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-SCBUR.tmp 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-G8M57.tmp 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp File created C:\Program Files (x86)\WMAFormat\is-UDGGO.tmp 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-BA9M9.tmp 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-KBP22.tmp 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\plugins\internal\is-29NV0.tmp 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp File created C:\Program Files (x86)\WMAFormat\bin\x86\is-OG1AL.tmp 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp -
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4404 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1516 wrote to memory of 4404 1516 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.exe 88 PID 1516 wrote to memory of 4404 1516 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.exe 88 PID 1516 wrote to memory of 4404 1516 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.exe 88 PID 4404 wrote to memory of 4464 4404 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp 90 PID 4404 wrote to memory of 4464 4404 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp 90 PID 4404 wrote to memory of 4464 4404 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp 90 PID 4404 wrote to memory of 3988 4404 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp 91 PID 4404 wrote to memory of 3988 4404 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp 91 PID 4404 wrote to memory of 3988 4404 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp 91 PID 4404 wrote to memory of 4992 4404 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp 94 PID 4404 wrote to memory of 4992 4404 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp 94 PID 4404 wrote to memory of 4992 4404 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp 94 PID 4404 wrote to memory of 5104 4404 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp 93 PID 4404 wrote to memory of 5104 4404 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp 93 PID 4404 wrote to memory of 5104 4404 191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp 93 PID 4992 wrote to memory of 2340 4992 net.exe 96 PID 4992 wrote to memory of 2340 4992 net.exe 96 PID 4992 wrote to memory of 2340 4992 net.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.exe"C:\Users\Admin\AppData\Local\Temp\191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\is-QEASH.tmp\191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp"C:\Users\Admin\AppData\Local\Temp\is-QEASH.tmp\191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp" /SL5="$50220,6953145,68096,C:\Users\Admin\AppData\Local\Temp\191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵PID:4464
-
-
C:\Program Files (x86)\WMAFormat\wmaformat.exe"C:\Program Files (x86)\WMAFormat\wmaformat.exe" -i3⤵
- Executes dropped EXE
PID:3988
-
-
C:\Program Files (x86)\WMAFormat\wmaformat.exe"C:\Program Files (x86)\WMAFormat\wmaformat.exe" -s3⤵
- Executes dropped EXE
PID:5104
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 114⤵PID:2340
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD5b500837ebbfe5281ca118869de8e0075
SHA1f204cf37c63656bdef70eea395f0de92612f4b5c
SHA256c6767c23a6ffd68f9d4a8f0423ad84c28cc2d461e8ce6c9032e3d9ed0c62123c
SHA512d016b7b74c2c64b6edf7992971bf8bb7364e9fe2741ff1b3707a0515e2492ed4b8f60e3da9f23c27a011116e14a5d6094e7da00e08f7e59ff88f9230ca9a714c
-
Filesize
1.2MB
MD5926ff407e83427c4c7d9bd7e9b23f73f
SHA12a3825f213c2b753636ab3aafb13b2613f7634c9
SHA256e404928e1601019c7c96baf883582f59395e79123c00b2d8cba42c5f387e2642
SHA5126e2a75fe93b81bfde8b3990e63ca690c85ffea1b0f84f1f7bc2ec66e9e554f4c012817a715325c3fc249493e4fe63f1043fd559d899e3a1379c4f58438b3e78d
-
Filesize
1.3MB
MD509feb52269eb12fce77d75531d4a940f
SHA1018c5b86240dc5126bdb11cf48f761335decc9f7
SHA256c52277689ec57d345fbdf8307bde53009576d142541ca72332611540bdd45f03
SHA51266877f47074005a71243dc5b37b445a25e725ed207b2590030893a2d490c2b2e031754b5dce201980503f9c153653f472ad1ea8fcf2cbd92fab6142ff1cf2b13
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
C:\Users\Admin\AppData\Local\Temp\is-QEASH.tmp\191353d41a9e17d24d31ce1a8117d74ed3cfd007ddd7fa2cf3a61ad7edae65d4.tmp
Filesize687KB
MD5f448d7f4b76e5c9c3a4eaff16a8b9b73
SHA131808f1ffa84c954376975b7cdb0007e6b762488
SHA2567233b85eb0f8b3aa5cae3811d727aa8742fec4d1091c120a0fe15006f424cc49
SHA512f8197458cd2764c0b852dac34f9bf361110a7dc86903024a97c7bcd3f77b148342bf45e3c2b60f6af8198ae3b83938dbaad5e007d71a0f88006f3a0618cf36f4