Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
-
submitted
11/12/2023, 11:23
General
-
Target
ec6e8c8e7a2d6fdda3f0e23c994c365decbfbe850f560329cb781c6b202f0a70.exe
-
Size
6.9MB
-
MD5
113e134e9841a55e2895f8bf7e1579d2
-
SHA1
3251d4ad7fa1698ad5c225eb4c27f5e1675a7d50
-
SHA256
ec6e8c8e7a2d6fdda3f0e23c994c365decbfbe850f560329cb781c6b202f0a70
-
SHA512
5502cf23c58688f8e28c192cc9fae1848b4d5b70a85385973e94d241926e13aaef40fefdf0048a792155ca09dbf0be1588f594ee699b393e5b01818a23955768
-
SSDEEP
98304:NzyQ4kc+v4jvDhsQepuwmrkz216aPE8d9X+X1M2CX27eGqc6hxTGZtsAzFjTidLb:gQ4PTP94zHQ9OX1M2CGjn6hDc6LKEzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec6e8c8e7a2d6fdda3f0e23c994c365decbfbe850f560329cb781c6b202f0a70.exe"C:\Users\Admin\AppData\Local\Temp\ec6e8c8e7a2d6fdda3f0e23c994c365decbfbe850f560329cb781c6b202f0a70.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-9V1OM.tmp\ec6e8c8e7a2d6fdda3f0e23c994c365decbfbe850f560329cb781c6b202f0a70.tmp"C:\Users\Admin\AppData\Local\Temp\is-9V1OM.tmp\ec6e8c8e7a2d6fdda3f0e23c994c365decbfbe850f560329cb781c6b202f0a70.tmp" /SL5="$E0030,6985458,68096,C:\Users\Admin\AppData\Local\Temp\ec6e8c8e7a2d6fdda3f0e23c994c365decbfbe850f560329cb781c6b202f0a70.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
C:\Program Files (x86)\WMAFormat\wmaformat.exe"C:\Program Files (x86)\WMAFormat\wmaformat.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\WMAFormat\wmaformat.exe"C:\Program Files (x86)\WMAFormat\wmaformat.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 114⤵
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
352KB
MD5ff91d3ade106d62c5e4bd4235d045e26
SHA1eff388997e7b8f79a3aeb758b577d434fb14aea7
SHA256081816d5b5f2c22f688bac4753cb62808016d4f4c6d1acdd98af3a55e293a320
SHA5126c8ff35b5811227c678f594c015958114ba90381d46e31d81019b838a167d6cd504e01cec96dcba3ef772770021a8a12afe4f5a796a27b00ba8e511daf9f92bd
-
Filesize
327KB
MD59c117dce5235b175ab895fd62ef84d36
SHA1558cb3639fb92a759158d7b620eed5aedc098798
SHA256f7d777b249ff3dea8ac76b3ac3d8b6b1dff7b57bd86c47f1743589e2b6e23518
SHA512b1c8a79eb387738897185199c782f3aee24a4e52f251c08b4334b88544b628e53be931de37f0c470de35192d2a66e2780a5a2075dea27662a0197432307fafb5
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
14KB
MD58f9f2272719595df181521a7cb6c9272
SHA1fb0f6da39f0e10088b98a4b8005e3e97b34e2de8
SHA256730de7d729672670b60c93ff04bdb5bc00c8fc954773ee99b10aee839b021436
SHA512005d31e59c6305037053ae26136ba7e43e9c56fc61d4261e3fd42bd3492202ca6603c84a6bb7b6a62bd534660c74fd8e910f0f70222ae3dd927ca7ea4ce7be97
-
Filesize
219KB
MD51eab15c05d3c5aa25fb575e82a255954
SHA1f5c23e239d8c4c62ef1236777b28f48bdca8ffed
SHA256edab52b85c3d95cec17bc5eae9b34cc626836805dc006aca1bb9d411fb6dbf9e
SHA51238d568626c10a4f11afd6f8adaa3bfc38f4bb9deab071e856de6c42e303607ec3d21968420c207931b7df6aaa1c39604ec542c1569d512e84dcd1abeb2479cd9
-
Filesize
310KB
MD5ae883c965ea95b9cd7fcdb8e6d484203
SHA1c5b870f7303268e27560a85c7d3059d5a4ceb324
SHA2560974ef582bac23b39505503978f21b7bc37708212fc148528c25a0d78bb465b0
SHA512db196e1047e2d6f1e6799913f9231c3f54720e19035e919a03e114eb568125452539c686f4995f03ca3befba2bc0809380c970a2061f9bec03c040dddb554cb6
-
Filesize
752KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB