Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
-
submitted
11/12/2023, 11:40
General
-
Target
e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.exe
-
Size
6.9MB
-
MD5
216de506133cc6ec8a9a7e9ca1227cba
-
SHA1
8db471b7cf9c851b20d62be8ab5effd50fe9a121
-
SHA256
e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044
-
SHA512
397331a58516a1798a96d0c64c72a947a0ae3dd1437281c3e22be8d332ad70efec260bf73fd57355cb0cd04f474e358e81b35e3be0cb7c917f088687fa00b61d
-
SSDEEP
98304:ZzyQ4kc+v4jvDhsQepuwmrkz216aPE8d9X+X1M2CX27eGqc6hxTGZtsAzFjTidLb:UQ4PTP94zHQ9OX1M2CGjn6hDc6LKEzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.exe"C:\Users\Admin\AppData\Local\Temp\e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-TQ4FQ.tmp\e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp"C:\Users\Admin\AppData\Local\Temp\is-TQ4FQ.tmp\e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.tmp" /SL5="$5006C,6985458,68096,C:\Users\Admin\AppData\Local\Temp\e41daab703ddd0eef4cc570516fed7462fe57a957f33d7cd6f12a3f9357b7044.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\WMAFormat\wmaformat.exe"C:\Program Files (x86)\WMAFormat\wmaformat.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\WMAFormat\wmaformat.exe"C:\Program Files (x86)\WMAFormat\wmaformat.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 111⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
220KB
MD5b95e7f3cc0dc4397250f0dbfd8484301
SHA1dda36150110913d7d0d53efe958bc4c695988720
SHA256b9db8e42b097fcd9b294309adb32b65c442728ec89bbe4a777215e4ead60c6eb
SHA5125ef13363e52dc26d949f6d57ae2e16cee52b79bb6bfbe10bfb26990742ad4f619e70a928edf25e0456068e9ea6247ca769aee008ed8d72614c1d86cf34c2f282
-
Filesize
139KB
MD5419a73adfd5e81fb6adfa3d37b855883
SHA12b0f89ecdb53c0e86c353147998c6c523eb57b3d
SHA25673aca61563ad7f8c22a8133c6b596e9102f1bef4ebb76f0a6dea90509f9911dd
SHA51248718eb87f84f298ad30df86b756997050b26dcbef3e427e89877583433671ed04a8543b4b2b61a7c162309d43974b83cfd10dfde072eddef009ccd2ec721ca9
-
Filesize
329KB
MD5c21c6db60e298b645ad02d740a519463
SHA199ef2f41426c4a3d22817b15e1c7362129e9eba3
SHA2565bd944167aa2712045b9d05b2a7aa3dbcde95d1a0b844f655a668f20e2fa4c4f
SHA51257e3e0ab8e5e7445786a0d5c882fa70f0168e6059637c936ea2fe7fad5ac40ed1ccebdc8852f9875ddce961a9c943d59e50c873678426db4b5a7603be7a1706e
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
120KB
MD538155a3220ca03c5d0eb4d56631cc3b1
SHA10709fe97410f68c02e67dd41c1354827f3bd5207
SHA25648d2b86de0426a600d1116d9d0b01f4e1b2d5cfbe8e8413a9df0029c39ed594e
SHA5125a7cffdd467c061130116a67fbf0f6d00a936442d7e013f08a7c0572add5f3c0a776529e5976c614da51b89bab390def6ae819fc88bf0b5a2e1ea83f7a3fb112
-
Filesize
41KB
MD560df3abf4326e6f3f059596270d95416
SHA1abfcf783cf7e0c0ff223760951964260f766a121
SHA256f15969fe20154da943edf8e6a887491fc043479f979e287ce5cf6a51e2d900fa
SHA512ce10c465cb56f870f39eea2d4267b47ba14cac01367399f0a91ac6b55c9a5d4d17de00e44c5c869aa7b38b24031e11fee86928404c421b1e7039df44421f7df4
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB