Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows10-1703_x64 -
resource
win10-20231129-en -
resource tags
-
submitted
11/12/2023, 11:07
General
-
Target
1348ba4f64c9931d3787ab7a182eafce06e4ca9f1b763b2033afcf9912fc2751.exe
-
Size
6.9MB
-
MD5
7f5967b98744f14d2124728be5269c7d
-
SHA1
4d160acc034819ff06d71a49159872fe8bedfe7a
-
SHA256
1348ba4f64c9931d3787ab7a182eafce06e4ca9f1b763b2033afcf9912fc2751
-
SHA512
e8527b6b84cd36ad0a8ca49714343e6358ad1599f67b5be766cda1581f895010a506a8bca50522c181c4ba594d7425077e0655280d2a847eaacc66ccd83f5dc2
-
SSDEEP
98304:4zyQ4kc+v4jvDhsQepuwmrkz216aPE8d9X+X1M2CX27eGqc6hxTGZtsAzFjTidLb:BQ4PTP94zHQ9OX1M2CGjn6hDc6LKEzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1348ba4f64c9931d3787ab7a182eafce06e4ca9f1b763b2033afcf9912fc2751.exe"C:\Users\Admin\AppData\Local\Temp\1348ba4f64c9931d3787ab7a182eafce06e4ca9f1b763b2033afcf9912fc2751.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-34N8C.tmp\1348ba4f64c9931d3787ab7a182eafce06e4ca9f1b763b2033afcf9912fc2751.tmp"C:\Users\Admin\AppData\Local\Temp\is-34N8C.tmp\1348ba4f64c9931d3787ab7a182eafce06e4ca9f1b763b2033afcf9912fc2751.tmp" /SL5="$501F6,6985458,68096,C:\Users\Admin\AppData\Local\Temp\1348ba4f64c9931d3787ab7a182eafce06e4ca9f1b763b2033afcf9912fc2751.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\WMAFormat\wmaformat.exe"C:\Program Files (x86)\WMAFormat\wmaformat.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\WMAFormat\wmaformat.exe"C:\Program Files (x86)\WMAFormat\wmaformat.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 111⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
319KB
MD58135c53b74e80de4923ec13051054491
SHA1813b6a7de35bdaf582734baac7094293b4fdf314
SHA256571962131ee2d0298da7f2f4775620d159ca5973476d3dbe838501761954f453
SHA5120c13022de17adc7b806721d34665766ecfc94f9123a860fc7cd8a5d4200197ff556459048c0f457c5f54ad65f5e2d7aad2ee13fb7d3291ef5df21337d41a7233
-
Filesize
330KB
MD59ebf419aa0f02734fa3a99be66c972b2
SHA1da8ee4f91b9cb32ce52dc8ada9906220402a4274
SHA2565e0ec460a1e98d2319ee3ac5dd3ccc69004fa6b2ae1545c470feffc326e601ad
SHA512aa6b725fbd47d01b1aa25bd02d1a910baa900f06395d2794e4d305a14281c030a3be258f0e13f1582b7a0451a5578beb8bb72cc1a158d0cf18f1aa4863f19f7f
-
Filesize
268KB
MD531f95164415f43ac2f26d2eb0f9ad87b
SHA1caca16d4268aa99189a4f89e2bef7e1c34d1a5e8
SHA25674adb6273da9ad4d77d59f83b0616330ebad47aa13aa8465a89928016fb42ef5
SHA512d4f30c1956742c03c190e5d19d63ab1507f80362e32ab8c1c6af2bc442ac857b409dcb134024cea34e258e0ec815fb34c8b97047676490a221d24245c137d7ed
-
Filesize
594KB
MD5aa177886d3b200d83da4bf5930797b7a
SHA1f764e10ec59ae81dba6cd0ce311dac11490ab844
SHA2568738562bc043553dd365020b6c41acf93c93f563cad18a1e8aac72404dc10ead
SHA51208dc6b85d29dc6e7259346fcc1d8bfe6bc2a0431d9aedef3eea18346c996511392cf766f5bd4ff8eb7f4fa1555ac8f8a31dadc4fa9991f58e84f60ed41efaeb9
-
Filesize
661KB
MD51cde52a466627398e833d09e30951e92
SHA171d034de15720750f323d9fe937f65f338cef53d
SHA2568aa4098c99793a2e820450134b3def4cd4f025f4b33c580fd9811a961a28a4c4
SHA512f268aa682e9344a8dad0a0d3e8d325ec37b3b56a35d8faf8eb178cd72534a7518769eafde0f94c66cb8faf7954b65f564d425e24d087a56074a6a46c58c5cc1f
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
4KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB